Data processing method, electronic device, and storage medium

Abstract

The application provides a data processing method, an electronic device and a storage medium. The method comprises the following steps: receiving a plurality of plaintext data packets from a plurality of first links; dividing a plurality of algorithm cores into a plurality of algorithm core groups according to a link combination mode of the plurality of first links; distributing the plurality of plaintext data packets to the plurality of algorithm core groups according to a corresponding relationship between the plurality of plaintext data packets and the link combination mode; and performing data encryption processing on each plaintext data packet by all algorithm cores in each algorithm core group to obtain a plurality of ciphertext data packets of the plurality of first links. The embodiment of the application can meet diversified data security requirements in complex application scenarios.

Description

Technical Field

[0001] The embodiments of this application relate to, but are not limited to, the field of information processing technology, and in particular to a data processing method, electronic device, and storage medium. Background Technology

[0002] In today's complex data center environments, numerous complex data transmission scenarios exist, such as those involving multiple high-speed Peripheral Component Interconnect Express (PCIe) links and multiple Compute Express Link (CXL) links. These links are primarily used for transmitting critical data between the Central Processing Unit (CPU) and devices, and between devices themselves, thus requiring secure data protection. However, current data security protection methods fail to meet the diverse data security needs of today's complex application scenarios. Therefore, improving data security protection methods to adapt to these diverse data security requirements is an urgent technical problem to be solved. Summary of the Invention

[0003] This application provides a data processing method, an electronic device, and a storage medium that can meet diverse data security needs in complex application scenarios.

[0004] On one hand, embodiments of this application provide a data processing method, including: receiving multiple plaintext data packets from multiple first links; dividing multiple algorithm cores into multiple algorithm core groups according to the link combination mode of the multiple first links; distributing the multiple plaintext data packets to the multiple algorithm core groups according to the correspondence between the multiple plaintext data packets and the link combination mode; and encrypting each plaintext data packet through all the algorithm cores in each of the algorithm core groups to obtain ciphertext data packets for each of the first links.

[0005] On the other hand, embodiments of this application also provide a data processing method, including: receiving multiple encrypted data packets from multiple second links; dividing multiple algorithm cores into multiple algorithm core groups according to the link combination mode of the multiple second links; distributing the multiple encrypted data packets to the multiple algorithm core groups according to the correspondence between the multiple encrypted data packets and the link combination mode; and performing data decryption processing on each encrypted data packet through all the algorithm cores in each algorithm core group to obtain plaintext data packets for each second link.

[0006] On the other hand, embodiments of this application also provide an electronic device, including: at least one processor; at least one memory for storing at least one program; and implementing the data processing method described above when at least one of the programs is executed by at least one of the processors.

[0007] On the other hand, embodiments of this application also provide a computer-readable storage medium storing computer-executable instructions for performing the data processing method described above.

[0008] On the other hand, embodiments of this application also provide a computer program product, including a computer program or computer instructions, wherein the computer program or computer instructions are stored in a computer-readable storage medium, a processor of an electronic device reads the computer program or computer instructions from the computer-readable storage medium, and the processor executes the computer program or computer instructions, causing the electronic device to perform the data processing method as described above.

[0009] In this embodiment, after receiving multiple plaintext data packets from multiple first links, the algorithm cores are first divided into multiple algorithm core groups according to the link combination modes of the multiple first links. Then, based on the correspondence between the multiple plaintext data packets and the link combination modes, the multiple plaintext data packets are distributed to the multiple algorithm core groups. Each plaintext data packet is then encrypted by all algorithm cores in each algorithm core group to obtain the ciphertext data packets for each first link. This process fully considers the relationship between the link combination modes of the multiple first links and the multiple algorithm cores, dividing the multiple algorithm cores into multiple different algorithm core groups to encrypt different plaintext data packets. This achieves parallel processing of plaintext data packets from multiple first links, thus supporting complex application scenarios with multiple link combinations. Furthermore, since the plaintext data packets from different first links are encrypted by different algorithm core groups, the encryption processes for the plaintext data packets of each first link are independent of each other, without any interference, thus fully meeting the diverse data security needs in complex application scenarios. Attached Figure Description

[0010] Figure 1 This is a centralized IDE hardware architecture diagram for multi-link high-speed interfaces provided in one embodiment of this application;

[0011] Figure 2 This is a flowchart of a data processing method provided in one embodiment of this application;

[0012] Figure 3 This is a schematic flowchart illustrating a data processing method executed by a data processing path according to an embodiment of this application;

[0013] Figure 4 This is a flowchart of a data processing method provided in another embodiment of this application;

[0014] Figure 5 This is a schematic diagram of the data encryption process performed on the TX side path according to an embodiment of this application;

[0015] Figure 6 This is a schematic diagram of the data decryption process performed by the RX side path according to an embodiment of this application;

[0016] Figure 7 This is a schematic diagram of the structure of an electronic device provided in one embodiment of this application. Detailed Implementation

[0017] To make the objectives, technical methods, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0018] It should be noted that although the flowchart shows a logical order, in some cases, the steps shown or described may be executed in a different order than that shown in the flowchart. In the description of the specification, claims, and the above-mentioned figures, "multiple" means two or more; "greater than," "less than," and "exceeding" are understood to exclude the stated number; "above," "below," and "within" are understood to include the stated number. The use of terms such as "first" and "second" is merely for distinguishing technical features and should not be construed as indicating or implying relative importance, or implicitly specifying the number of indicated technical features or their sequential relationship. Furthermore, in the description of the specification, claims, and the above-mentioned figures, the various values ​​mentioned (such as first value, second value, etc.) can be flexibly represented as single numeric codes or enumerated type values. These values ​​can clearly guide and control the execution flow and behavior patterns of various functional modules, ensuring the efficiency of data processing.

[0019] In today's complex data center environments, numerous scenarios involve parallel data transmission across multiple links. PCIe and CXL links often work together to complete data transmission tasks. PCIe, as a universal high-speed interconnect standard in the computer field, is widely used in high-performance computing, artificial intelligence (AI) chips, and high-bandwidth memory, offering advantages such as high speed and low latency. CXL, on the other hand, is designed specifically for heterogeneous computing, aiming to solve the problem of efficient communication between CPUs, accelerators, and memory expansion devices. Typical scenarios include large model training and scientific computing. With the widespread adoption of PCIe and CXL, more severe security challenges have emerged, such as data integrity protection and end-to-end encryption of sensitive data. Therefore, the implementation of Integrity and Data Encryption (IDE) has become particularly crucial for protecting communication security.

[0020] Using a distributed approach to encrypt PCIe and CXL links, where encryption / decryption is performed independently on each device, presents several challenges: First, it necessitates deploying an independent encryption engine for each link, increasing hardware overhead and significantly raising equipment costs. Second, key management becomes difficult. Third, storing keys across multiple devices increases the risk of key leakage. Specifically, the distributed approach requires nodes to synchronize parameters such as keys and initialization vectors. Managing keys separately for each link increases the complexity of key distribution. Furthermore, for hot-swapping and link reconfiguration scenarios, this distributed approach requires dynamically updating keys to all new nodes, which is time-consuming. If key synchronization is delayed or fails, some devices may be unable to encrypt / decrypt data, leading to service failures or data corruption.

[0021] The above analysis shows that current data security protection methods for PCIe and CXL links are insufficient to meet the diverse data security needs of today's complex application scenarios. To address these diverse data security requirements, this application provides a data processing method, electronic device, computer-readable storage medium, and computer program product. Upon receiving multiple plaintext data packets from multiple first links, the method first divides multiple algorithm cores into multiple algorithm core groups based on the link combination patterns of the multiple first links. Then, based on the correspondence between the multiple plaintext data packets and the link combination patterns, the multiple plaintext data packets are distributed to the multiple algorithm core groups. Each plaintext data packet is then encrypted using all the algorithm cores in each algorithm core group to obtain the ciphertext data packets for each first link. This process fully considers the relationship between the link combination patterns of the multiple first links and the multiple algorithm cores, dividing the multiple algorithm cores into multiple different algorithm core groups to encrypt different plaintext data packets. This achieves parallel processing of plaintext data packets from multiple first links, thereby supporting complex application scenarios with multiple link combinations. Furthermore, since the plaintext data packets of different first links are encrypted by different algorithm core groups, the data encryption processing of plaintext data packets of each first link is independent of each other and there is no interference between them, thus fully meeting the diverse data security needs in complex application scenarios.

[0022] Based on the above analysis, the embodiments of this application will be further described below with reference to the accompanying drawings.

[0023] Figure 1 This is a centralized IDE hardware architecture diagram for multi-link high-speed interfaces provided in one embodiment of this application. This hardware architecture can implement the data processing method provided in the embodiments of this application. This hardware architecture can be applied to products that require encryption and decryption of PCIe high-speed interface traffic or CXL high-speed interface traffic, such as server chips, AI chips, smart network cards, and graphics processing unit (GPU) chips. This application does not limit the application to these applications. In other words, server chips, AI chips, smart network cards, GPU chips, and other products with this hardware architecture can all execute the data processing method provided in any embodiment of this application.

[0024] exist Figure 1In this hardware architecture, two independent paths are included: the TX side (or sending / encryption side) and the RX side (or receiving / decryption side). The structures of the TX side path and the RX side path are similar. The TX side path 110 includes a PCIe_TX input interface module 111, a CXL_TX input interface module 112, a TX link traffic unpacking module 113, a TX plaintext distribution module 114, an encryption engine 115, a TX ciphertext distribution module 116, a TX link traffic packet assembly module 117, a PCIe_TX output interface module 118, and a CXL_TX output interface module 119. The RX side path 120 includes a PCIe_RX input interface module 121, a CXL_RX input interface module 122, an RX link traffic unpacking module 123, an RX ciphertext distribution module 124, a decryption engine 125, an RX plaintext distribution module 126, an RX link traffic packet assembly module 127, a PCIe_RX output interface module 128, and a CXL_RX output interface module 129. Both the encryption engine 115 and the decryption engine 125 include multiple algorithm cores. For example, the encryption engine 115 includes multiple encryption algorithm cores for data encryption, and the decryption engine 125 includes multiple decryption algorithm cores for data decryption. Additionally, the hardware architecture includes a control register and a key management module shared by the TX-side path 110 and the RX-side path 120. These control registers and the key management module are uniformly controlled by the host (e.g., a server, electronic device).

[0025] The PCIe_TX input interface module 111 receives data traffic from multiple PCIe links, the CXL_TX input interface module 112 receives data traffic from multiple CXL links, the TX link traffic unpacking module 113 performs packet unpacking processing on the data traffic from multiple PCIe links and / or multiple CXL links, and the TX plaintext distribution module 114 distributes the corresponding data traffic to the encryption engine 115 according to the link combination mode of multiple PCIe links or multiple CXL links. The encryption engine 115 internally instantiates multiple encryption algorithm cores. The core is used to encrypt the corresponding data traffic. The TX ciphertext distribution module 116 is used to distribute the encrypted ciphertext data to the original data packet. The TX link traffic packet assembly module 117 is used to restore the encrypted data packet to the original multiple PCIe links or multiple CXL links according to the link combination mode of multiple PCIe links or multiple CXL links. The PCIe_TX output interface module 118 is used to output the data traffic of multiple PCIe links to the outside. The CXL_TX output interface module 119 is used to output the data traffic of multiple CXL links to the outside.

[0026] Additionally, the PCIe_RX input interface module 121 is used to receive data traffic from multiple PCIe links, the CXL_RX input interface module 122 is used to receive data traffic from multiple CXL links, the RX link traffic unpacking module 123 is used to depacketize and unpack data packets in the data traffic from multiple PCIe links and / or multiple CXL links, and the RX ciphertext distribution module 124 is used to distribute the corresponding data traffic to the decryption engine 125 according to the link combination mode of multiple PCIe links or multiple CXL links. The decryption engine 125 internally instantiates multiple decryption algorithm cores. The core is used to decrypt the corresponding data traffic. The RX plaintext distribution module 126 is used to distribute the decrypted plaintext data to the original data packet. The RX link traffic packet assembly module 127 is used to restore the decrypted data packet to the original multiple PCIe links or multiple CXL links according to the link combination mode of multiple PCIe links or multiple CXL links. The PCIe_RX output interface module 128 is used to output the data traffic of multiple PCIe links to the outside. The CXL_RX output interface module 129 is used to output the data traffic of multiple CXL links to the outside.

[0027] The specific processing procedures for the TX-side path 110 and the RX-side path 120 are described below.

[0028] In TX-side pathway 110:

[0029] Both the PCIe_TX input interface module 111 and the CXL_TX input interface module 112 can use custom interfaces, where multiple PCIe links or multiple CXL links share a single input interface using time-division multiplexing. Both the PCIe_TX input interface module 111 and the CXL_TX input interface module 112 will split the data traffic according to the link identifier and then send it to the TX link traffic unpacking module 113 for depackaging and unpacking processing.

[0030] The TX link traffic unpacking module 113 is used to unpack the received PCIe data traffic or CXL data traffic, extract the plaintext to be encrypted and the additional authentication data (AAD) to be authenticated, and combine the extracted plaintext and AAD into a data block of a certain size and send it to the TX plaintext distribution module 114.

[0031] TX plaintext distribution module 114 is used to send the received plaintext and AAD to the encryption engine 115 according to the link combination mode of multiple PCIe links or multiple CXL links;

[0032] Encryption engine 115 is used to encrypt received plaintext and calculate the Message Authentication Code (MAC). To comply with the PCIe / CXL IDE protocol, the Advanced Encryption Standard Galois / Counter Mode (AES-GCM) algorithm can be used to encrypt the received plaintext and calculate the MAC. Alternatively, for non-standard PCIe / CXL interface devices, the AES-GCM algorithm in encryption engine 115 can be replaced with other symmetric algorithms, as long as they can encrypt the received plaintext and calculate the MAC.

[0033] The TX ciphertext distribution module 116 is used to combine the ciphertext and MAC after encryption by the encryption engine 115 according to the link combination mode of multiple PCIe links or multiple CXL links to obtain the encrypted sub-data of each link, and then send the encrypted sub-data of each link to the TX link traffic packet grouping module 117.

[0034] The TX link traffic packet assembly module 117 is used to place the encrypted sub-data (including ciphertext and MAC) of each link into the corresponding fields of the original data packet, generate PCIe_IDE packets and / or CXL_IDE packets, and then send the PCIe_IDE packets and / or CXL_IDE packets to the PCIe_TX output interface module 118 or CXL_TX output interface module 119 respectively.

[0035] PCIe_TX output interface module 118 is used to output multiple PCIe_IDE messages via a time-division multiplexing method through one output interface;

[0036] CXL_TX output interface module 119 is used to output multiple CXL_IDE messages via a time-division multiplexing method through one output interface.

[0037] In RX side passage 120:

[0038] Both the PCIe_RX input interface module 121 and the CXL_RX input interface module 122 can use custom interfaces, where multiple PCIe links or multiple CXL links share a single input interface using time-division multiplexing. Both the PCIe_RX input interface module 121 and the CXL_RX input interface module 122 will split the data traffic according to the link identifier and then send it to the RX link traffic unpacking module 123 for depackaging and unpacking processing.

[0039] The RX link traffic unpacking module 123 is used to unpack the received PCIe data traffic or CXL data traffic, extract the ciphertext to be decrypted and the AAD to be authenticated, and combine the extracted ciphertext and AAD into a data block of a certain size and send it to the RX ciphertext distribution module 124.

[0040] The RX ciphertext distribution module 124 is used to send the received ciphertext and AAD to the decryption engine 125 according to the link combination mode of multiple PCIe links or multiple CXL links.

[0041] The decryption engine 125 is used to decrypt the received ciphertext and calculate the MAC address. To comply with the PCIe / CXLIDE protocol, the AES-GCM algorithm can be used to decrypt the received ciphertext and calculate the MAC address. Alternatively, for non-standard PCIe / CXL interface devices, the AES-GCM algorithm in the decryption engine 125 can be replaced with other symmetric algorithms, as long as they can encrypt the received ciphertext and calculate the MAC address.

[0042] The RX plaintext distribution module 126 is used to combine the encrypted plaintext and MAC after being decrypted by the decryption engine 125 according to the link combination mode of multiple PCIe links or multiple CXL links to obtain the decrypted sub-data of each link, and then send the decrypted sub-data of each link to the RX link traffic packet assembly module 127.

[0043] The RX link traffic packet assembly module 127 is used to receive the decrypted sub-data (including plaintext and MAC) of each link, and then compare whether the MAC verification passes. If it passes, it generates the corresponding PCIe_IDE packet and / or CXL_IDE packet and sends them to the PCIe_RX output interface module 128 or CXL_RX output interface module 129 accordingly; otherwise, it reports an error.

[0044] PCIe_RX output interface module 128 is used to output multiple PCIe_IDE messages via a single output interface using time-division multiplexing.

[0045] CXL_RX output interface module 129 is used to output multiple CXL_IDE messages via a time-division multiplexing method through one output interface.

[0046] In addition, the control register and key management module are shared by the TX side path 110 and the RX side path 120. They are used for IDE register configuration, IDE status monitoring, interrupt management, and key management for each link. They are managed uniformly by the host (e.g., server, electronic device, etc.) and store the encryption keys for all PCIe and CXL links. They have functions such as key initialization, key update, key lifetime management, enabling or disabling link encryption, monitoring link encryption and decryption status, anomaly reporting, and error packet handling, thereby simplifying the key management process.

[0047] Reference Figure 2 , Figure 2 This is a flowchart of a data processing method provided in one embodiment of this application. Figure 2 The data processing method shown corresponds to the processing procedure of the TX side channel, and the data processing method may include, but is not limited to, steps S210 to S230.

[0048] Step S210: Receive multiple plaintext data packets from multiple first links;

[0049] Step S220: Divide multiple algorithm cores into multiple algorithm core groups according to the link combination mode of multiple first links;

[0050] Step S230: Based on the correspondence between multiple plaintext data packets and link combination modes, distribute multiple plaintext data packets to multiple algorithm core groups, and encrypt each plaintext data packet through all algorithm cores in each algorithm core group to obtain the ciphertext data packets of each first link.

[0051] The data processing method in this embodiment, upon receiving multiple plaintext data packets from multiple first links, firstly divides multiple algorithm cores into multiple algorithm core groups based on the link combination patterns of the multiple first links. Then, according to the correspondence between the multiple plaintext data packets and the link combination patterns, the multiple plaintext data packets are distributed to the multiple algorithm core groups. Each plaintext data packet is then encrypted by all algorithm cores in each algorithm core group to obtain the ciphertext data packets for each first link. This process fully considers the relationship between the link combination patterns of the multiple first links and the multiple algorithm cores, dividing the multiple algorithm cores into multiple different algorithm core groups to encrypt different plaintext data packets. This achieves parallel processing of plaintext data packets from multiple first links, thus supporting complex application scenarios involving multiple link combinations. Furthermore, since the plaintext data packets from different first links are encrypted by different algorithm core groups, the encryption processes for each plaintext data packet from each first link are independent and do not interfere with each other, thereby fully meeting the diverse data security requirements in complex application scenarios.

[0052] In some embodiments, the plurality of first links may include at least one of the following:

[0053] Multiple PCIe links;

[0054] Multiple CXL links.

[0055] It should be noted that when these multiple first links simultaneously include multiple PCIe links and multiple CXL links, the transmission between these PCIe links and multiple CXL links is independent of each other. Furthermore, the data processing procedure for multiple PCIe links is the same as that for multiple CXL links. That is, for multiple PCIe links, multiple algorithm cores are divided into multiple algorithm core groups according to the link combination mode of the multiple PCIe links. Then, based on the correspondence between the multiple plaintext data packets of the multiple PCIe links and the link combination mode, the multiple plaintext data packets are distributed to the multiple algorithm core groups. Each plaintext data packet is then encrypted by all algorithm cores in each algorithm core group to obtain the ciphertext data packets for each PCIe link. For multiple CXL links, the algorithm cores are divided into multiple algorithm core groups according to the link combination mode of the multiple CXL links. Then, according to the correspondence between the multiple plaintext data packets of the multiple CXL links and the link combination mode, the multiple plaintext data packets are distributed to the multiple algorithm core groups. Each plaintext data packet is encrypted by all the algorithm cores in each algorithm core group to obtain the ciphertext data packets of each CXL link.

[0056] In some embodiments, in the process of dividing multiple algorithm cores into multiple algorithm core groups according to the link combination mode of multiple first links, the number of channel groups included in the multiple first links and the number of channels included in each channel group can be determined first according to the link combination mode of the multiple first links. Then, the multiple algorithm cores can be divided into multiple algorithm core groups according to the number of channel groups and the number of channels included in each channel group.

[0057] It's important to clarify that the link combination mode for multiple primary links refers to the link rate combination mode for multiple primary links. For example, PCIe links can be categorized into four rates: X16, X8, X4, and X2. High-speed links can operate at reduced speeds; for instance, an X16 rate link can operate at X8, X4, or X2 rates, an X8 rate link can operate at X4 or X2 rates, and an X4 rate link can operate at X2 rates. CXL links can be categorized into two rates: X16 and X8. High-speed links can also operate at reduced speeds; for example, an X16 rate link can operate at X8 rates. Therefore, taking PCIe links as an example (and CXL links similarly), the link combination mode for multiple PCIe links can include various different link combination modes such as 4X4, 8X2, and X8+2X4. Here, 4X4 refers to a link combination mode of four X4 links, i.e., an X4+X4+X4+X4 link combination mode. 8X2 refers to a link combination mode of eight X2 links, i.e., X2+X2+X2+X2+X2+X2+X2+X2. X8+2X4 refers to a link combination mode of one X8 and two X4 links, i.e., X8+X4+X4. Furthermore, taking a PCIe link as an example (the same applies to CXL links), when the PCIe link rate is X16, it means that all 16 channels of the PCIe link (forming a logical group) simultaneously transmit one type of service data packet. When the PCIe link rate is 2X8, it means that eight channels of the PCIe link (forming a logical group) simultaneously transmit one type of service data packet, and the remaining eight channels (forming another logical group) simultaneously transmit another type of service data packet. Furthermore, the encryption engine internally instantiates multiple encryption algorithm cores, and the decryption engine internally instantiates multiple decryption algorithm cores. Regardless of the algorithm core, each core can handle X2 rate traffic. This means that an X16 rate link requires 8 algorithm cores, an X8 rate link requires 4 algorithm cores, and so on. Therefore, after determining the number of channel groups and the number of channels within each channel group based on the link combination pattern of the multiple first links, the multiple algorithm cores can be divided into multiple algorithm core groups based on the number of channel groups and the number of channels within each channel group. For example, assuming the link combination pattern of multiple first links is X8+2X4, it can be determined that the number of channel groups included in these multiple first links is 3. Here, X8 corresponds to one channel group, 2X4 corresponds to two channel groups, and the channel group corresponding to X8 contains 8 channels, the channel group corresponding to one X4 contains 4 channels, and the channel group corresponding to another X4 also contains 4 channels. Therefore, it can be determined that multiple algorithm cores are divided into 3 algorithm core groups.The first algorithm core group corresponds to the X8 channel group and contains 4 algorithm cores; the second algorithm core group corresponds to an X4 channel group and contains 2 algorithm cores; the third algorithm core group corresponds to another X4 channel group and contains 2 algorithm cores.

[0058] As described above, there is a corresponding relationship between the link combination mode and the number of algorithm cores used. Therefore, in some implementations, the required number of algorithm cores can be selected based on the highest traffic scenario of the link combination mode. For example, assuming the highest traffic of the link combination mode is X32, then 16 algorithm cores are required. For PCIe links, the interface traffic limit is X16, so the full-traffic link combination modes include X16, 2X8, 4X4, 8X2, X8+2X4, X8+X4+2X2, X8+4X2, X4+6X2, and 3X4+2X2, corresponding to 9 full-traffic scenarios. For PCIe links in non-full-traffic scenarios, since the interface combination is the same, the processing is similar to that in full-traffic scenarios. For CXL links, the interface traffic limit is X16, so the full-traffic link combination modes include X16 and 2X8, corresponding to 2 full-traffic scenarios. For CXL links in non-full-traffic scenarios, the X8 link combination mode is included. Therefore, if encryption / decryption tasks need to be processed simultaneously at full traffic on both PCIe and CXL links, a maximum of 16 algorithm cores are required. For other scenarios with non-full traffic, the required number of algorithm cores can be determined based on the specific link combination mode. It should be noted that the data processing method provided in this application is applicable to full traffic scenarios on X32 and can satisfy all combination scenarios of PCIe and CXL links. The data processing method provided in this application is also applicable to other rate-reduced combination scenarios.

[0059] In some embodiments, the correspondence between multiple plaintext data packets and link combination modes includes the attribution relationship between multiple plaintext data packets and multiple channel groups included in multiple first links. In this case, when multiple plaintext data packets are distributed to multiple algorithm core groups according to the correspondence between multiple plaintext data packets and link combination modes, each plaintext data packet can be distributed to its corresponding algorithm core group according to the attribution relationship between multiple plaintext data packets and multiple channel groups included in multiple first links.

[0060] The following examples illustrate the relationship between link combination patterns and algorithm core groups.

[0061] Taking a scenario with two PCIe links (e.g., PCIe link 1 and PCIe link 2), and each PCIe link having 16 channels (i.e., a maximum rate of x16), the total number of algorithm cores in the encryption / decryption engine is 16, with the following possibilities:

[0062] When both PCIe links transmit at X16 rate, i.e. the link combination mode is X16+X16 mode, these 16 algorithm cores can be divided into two categories: the first category of 8 algorithm cores is dedicated to packet processing of PCIe link 1 (e.g. packet processing of the first type of service); the second category of 8 algorithm cores is dedicated to packet processing of PCIe link 2 (e.g. packet processing of the second type of service).

[0063] When PCIe link 1 transmits at a rate of x16 and PCIe link 2 transmits at a rate of 2x8, i.e., the link combination mode is x16+2x8 mode, these 16 algorithm cores can be divided into three categories: the first category of 8 algorithm cores is dedicated to packet processing of PCIe link 1 (e.g., packet processing of the first type of service); the second category of 4 algorithm cores is dedicated to packet processing of 8 channels of PCIe link 2 (e.g., packet processing of the second type of service); and the third category of 4 algorithm cores is dedicated to packet processing of the remaining 8 channels of PCIe link 2 (e.g., packet processing of the third type of service).

[0064] Taking a scenario with only one PCIe link and 16 channels (i.e., a maximum speed of X16) as an example, the total number of algorithm cores in the encryption / decryption engine is 8, with the following possibilities:

[0065] When the PCIe link transmits at an X16 rate, i.e., the link combination mode is X16 mode, these 8 algorithm cores belong to the same category: these 8 algorithm cores are specifically used for packet processing of this PCIe link (e.g., packet processing for the first type of service).

[0066] When the PCIe link transmits at a 2x8 rate, i.e., the link combination mode is 2x8 mode, these 8 algorithm cores can be divided into two categories: the first category of 4 algorithm cores is dedicated to the packet processing of 8 channels of the PCIe link (e.g., packet processing of the first type of service); the second category of 4 algorithm cores is dedicated to the packet processing of the remaining 8 channels of the PCIe link (e.g., packet processing of the second type of service).

[0067] When the PCIe link transmits at an X8+2X4 rate, i.e., the link combination mode is X8+2X4, these 8 algorithm cores can be divided into three categories: the first category has 4 algorithm cores, which are dedicated to the packet processing of 8 channels of the PCIe link (e.g., packet processing of the first type of service); the second category has 2 algorithm cores, which are dedicated to the packet processing of 4 channels of the remaining channels of the PCIe link (e.g., packet processing of the second type of service); and the third category has 2 algorithm cores, which are dedicated to the packet processing of the remaining 4 channels of the PCIe link (e.g., packet processing of the third type of service).

[0068] In some embodiments, during the process of distributing each plaintext data packet to the corresponding algorithm core group, the data to be encrypted in each plaintext data packet can be extracted first, and then the data to be encrypted in each plaintext data packet can be split into multiple sub-data to be encrypted. The number of sub-data to be encrypted is consistent with the number of algorithm cores included in the corresponding algorithm core group. Then, each sub-data to be encrypted is distributed to each algorithm core in the corresponding algorithm core group.

[0069] In some embodiments, in the process of encrypting each plaintext data packet with all the algorithm cores in each algorithm core group to obtain the ciphertext data packet of each first link, all the sub-data to be encrypted in each plaintext data packet can be encrypted in parallel with all the algorithm cores in each algorithm core group to obtain multiple encrypted sub-data. Then, the multiple encrypted sub-data are distributed to the original plaintext data packets for packet conversion to obtain the ciphertext data packet of each first link.

[0070] In some embodiments, after obtaining multiple encrypted sub-data, the MAC corresponding to the multiple encrypted sub-data can be further determined. In this case, when distributing the multiple encrypted sub-data to the original plaintext data packets for message conversion to obtain ciphertext data packets for each first link, the multiple encrypted sub-data and MAC can be distributed to the original plaintext data packets for message conversion to obtain ciphertext data packets for each first link.

[0071] In some embodiments, when multiple encrypted sub-data and MACs are distributed to the original plaintext data packets for packet conversion to obtain ciphertext data packets for each first link, the sub-data to be encrypted in each of the original plaintext data packets can be replaced with the corresponding encrypted sub-data, and the corresponding MAC can be added to the corresponding original plaintext data packets to obtain ciphertext data packets for each first link.

[0072] In some embodiments, during the process of extracting the data to be encrypted from each plaintext data packet, the plaintext to be encrypted and the AAD to be authenticated can be extracted from each plaintext data packet first, and then the plaintext and AAD can be combined into data blocks to obtain the data to be encrypted from each plaintext data packet.

[0073] In some embodiments, the process of receiving multiple plaintext data packets from multiple first links may include: firstly, receiving traffic data from multiple first links through a single input interface using time-division multiplexing, wherein each first link corresponds to a link identifier; and then, splitting the traffic data according to the link identifier to obtain plaintext data packets for each first link. For example, multiple PCIe links can share a single input interface to receive traffic data from these PCIe links using time-division multiplexing, and similarly, multiple CXL links can also share a single input interface to receive traffic data from these CXL links using time-division multiplexing.

[0074] In some embodiments, after obtaining the encrypted data packets of each first link, the corresponding encrypted data packets can be further sent to the second links corresponding to each first link.

[0075] The following is a detailed description of the specific processing procedure of the data processing method of this application embodiment using a concrete example.

[0076] refer to Figure 3 As shown, Figure 3 This is a schematic flowchart illustrating a data processing method executed by a data processing path according to an embodiment of this application. Figure 3 The data processing path described here uses the PCIe link as an example (the CXL link is similar), and it applies to both the TX and RX sides. In other words, the various data processing steps performed in both the TX and RX sides can be referenced from this example. Figure 3 The content shown.

[0077] exist Figure 3 In this scenario, assume there are PCIe link 1 and PCIe link 2, both with a speed of X8, meaning each link uses 8 channels. Data from PCIe link 1 and PCIe link 2 is first combined using a combiner and then shares a single input interface using time-division multiplexing. Data transmitted through this input interface is then sent to the link traffic unpacking module for unpacking. The unpacked data is then transmitted to the plaintext distribution module, which distributes the data to different algorithm cores for processing. Figure 3As shown, the encryption engine includes eight encryption algorithm cores. Encryption algorithm core 1, encryption algorithm core 2, encryption algorithm core 3 and encryption algorithm core 4 form an algorithm core group for data packet encryption of PCIe link 1, and encryption algorithm core 5, encryption algorithm core 6, encryption algorithm core 7 and encryption algorithm core 8 form another algorithm core group for data packet encryption of PCIe link 2. After the encryption engine completes the encryption process and obtains the ciphertext data, it sends the ciphertext data to the ciphertext distribution module. The ciphertext distribution module then combines the ciphertext data according to the link combination mode of PCIe Link 1 and PCIe Link 2 (i.e., the 2x8 link combination mode) to obtain encrypted sub-data for PCIe Link 1 and PCIe Link 2. This encrypted sub-data is then sent to the link traffic packet assembly module. The link traffic packet assembly module places the encrypted sub-data from PCIe Link 1 and PCIe Link 2 into the corresponding fields of the original data packet, generating corresponding ciphertext packets. These ciphertext packets are then sent to the splitting module through one output interface using time-division multiplexing. The splitting module then splits the data in this output interface, sending different ciphertext packets to PCIe Link 1 and PCIe Link 2 respectively, and transmitting these ciphertext packets through PCIe Link 1 and PCIe Link 2.

[0078] Additionally, refer to Figure 4 , Figure 4 This is a flowchart of a data processing method provided in another embodiment of this application. Figure 4 The data processing method shown corresponds to the processing procedure of the RX side path, and the data processing method may include, but is not limited to, steps S410 to S430.

[0079] Step S410: Receive multiple encrypted data packets from multiple second links;

[0080] Step S420: Divide multiple algorithm cores into multiple algorithm core groups according to the link combination mode of multiple second links;

[0081] Step S430: Based on the correspondence between multiple ciphertext data packets and link combination modes, distribute multiple ciphertext data packets to multiple algorithm core groups, and decrypt each ciphertext data packet through all algorithm cores in each algorithm core group to obtain the plaintext data packets of each second link.

[0082] The data processing method in this embodiment, upon receiving multiple encrypted data packets from multiple second links, first divides multiple algorithm cores into multiple algorithm core groups based on the link combination patterns of the multiple second links. Then, according to the correspondence between the multiple encrypted data packets and the link combination patterns, the multiple encrypted data packets are distributed to the multiple algorithm core groups. Each encrypted data packet is then decrypted by all algorithm cores in each algorithm core group to obtain the plaintext data packets for each second link. This process fully considers the relationship between the link combination patterns of the multiple second links and the multiple algorithm cores, dividing the multiple algorithm cores into multiple different algorithm core groups to decrypt different encrypted data packets, thus achieving parallel processing of encrypted data packets from multiple second links and supporting complex application scenarios with multiple link combinations. Furthermore, since the encrypted data packets from different second links are decrypted by different algorithm core groups, the decryption processes for each encrypted data packet from each second link are independent and do not interfere with each other, thereby fully meeting the diverse data security requirements in complex application scenarios.

[0083] In some embodiments, the plurality of second links may include at least one of the following:

[0084] Multiple PCIe links;

[0085] Multiple CXL links.

[0086] It should be noted that when these multiple second links simultaneously include multiple PCIe links and multiple CXL links, the transmission between these PCIe links and CXL links is independent of each other. Furthermore, the data processing procedure for multiple PCIe links is the same as that for multiple CXL links. That is, for multiple PCIe links, the multiple algorithm cores are divided into multiple algorithm core groups according to the link combination mode of the multiple PCIe links. Then, based on the correspondence between the multiple encrypted data packets of the multiple PCIe links and the link combination mode, the multiple encrypted data packets are distributed to the multiple algorithm core groups. Each encrypted data packet is then decrypted by all algorithm cores in each algorithm core group to obtain the plaintext data packets for each PCIe link. For multiple CXL links, the multiple algorithm cores are divided into multiple algorithm core groups according to the link combination mode of the multiple CXL links. Then, according to the correspondence between the multiple ciphertext data packets of the multiple CXL links and the link combination mode, the multiple ciphertext data packets are distributed to the multiple algorithm core groups. Each algorithm core in each algorithm core group decrypts each ciphertext data packet to obtain the plaintext data packet of each CXL link.

[0087] In some embodiments, in the process of dividing multiple algorithm cores into multiple algorithm core groups according to the link combination mode of multiple second links, the number of channel groups included in the multiple second links and the number of channels included in each channel group can be determined first according to the link combination mode of the multiple second links. Then, the multiple algorithm cores can be divided into multiple algorithm core groups according to the number of channel groups and the number of channels included in each channel group.

[0088] It's important to clarify that the link combination mode for multiple secondary links refers to the link rate combination mode for multiple secondary links. For example, PCIe links can be categorized into four rates: X16, X8, X4, and X2. High-speed links can operate at reduced speeds; for instance, an X16 rate link can operate at X8, X4, or X2 rates, an X8 rate link can operate at X4 or X2 rates, and an X4 rate link can operate at X2 rates. CXL links can be categorized into two rates: X16 and X8. High-speed links can also operate at reduced speeds; for example, an X16 rate link can operate at X8 rates. Therefore, taking PCIe links as an example (and CXL links similarly), the link combination mode for multiple PCIe links can include various different link combination modes such as 4X4, 8X2, and X8+2X4. Here, 4X4 refers to a link combination mode of four X4 links, i.e., an X4+X4+X4+X4 link combination mode. 8X2 refers to a link combination mode of eight X2 links, i.e., X2+X2+X2+X2+X2+X2+X2+X2. X8+2X4 refers to a link combination mode of one X8 and two X4 links, i.e., X8+X4+X4. Furthermore, taking a PCIe link as an example (the same applies to CXL links), when the PCIe link rate is X16, it means that all 16 channels of the PCIe link (forming a logical group) simultaneously transmit one type of service data packet. When the PCIe link rate is 2X8, it means that eight channels of the PCIe link (forming a logical group) simultaneously transmit one type of service data packet, and the remaining eight channels (forming another logical group) simultaneously transmit another type of service data packet. Furthermore, the encryption engine internally instantiates multiple encryption algorithm cores, and the decryption engine internally instantiates multiple decryption algorithm cores. Regardless of the algorithm core, each core can handle X2 rate traffic. This means that an X16 rate link requires 8 algorithm cores, an X8 rate link requires 4 algorithm cores, and so on. Therefore, after determining the number of channel groups and the number of channels within each channel group based on the link combination pattern of the multiple second links, the multiple algorithm cores can be divided into multiple algorithm core groups based on the number of channel groups and the number of channels within each channel group. For example, assuming the link combination pattern of multiple second links is X8+2X4, it can be determined that the number of channel groups included in these multiple second links is 3. Here, X8 corresponds to one channel group, 2X4 corresponds to two channel groups, and the channel group corresponding to X8 contains 8 channels, the channel group corresponding to one X4 contains 4 channels, and the channel group corresponding to another X4 also contains 4 channels. Therefore, it can be determined that multiple algorithm cores are divided into 3 algorithm core groups.The first algorithm core group corresponds to the X8 channel group and contains 4 algorithm cores; the second algorithm core group corresponds to an X4 channel group and contains 2 algorithm cores; the third algorithm core group corresponds to another X4 channel group and contains 2 algorithm cores.

[0089] As described above, there is a corresponding relationship between the link combination mode and the number of algorithm cores used. Therefore, in some implementations, the required number of algorithm cores can be selected based on the highest traffic scenario of the link combination mode. For example, assuming the highest traffic of the link combination mode is X32, then 16 algorithm cores are required. For PCIe links, the interface traffic limit is X16, so the full-traffic link combination modes include X16, 2X8, 4X4, 8X2, X8+2X4, X8+X4+2X2, X8+4X2, X4+6X2, and 3X4+2X2, corresponding to 9 full-traffic scenarios. For PCIe links in non-full-traffic scenarios, since the interface combination is the same, the processing is similar to that in full-traffic scenarios. For CXL links, the interface traffic limit is X16, so the full-traffic link combination modes include X16 and 2X8, corresponding to 2 full-traffic scenarios. For CXL links in non-full-traffic scenarios, the X8 link combination mode is included. Therefore, if encryption / decryption tasks need to be processed simultaneously at full traffic on both PCIe and CXL links, a maximum of 16 algorithm cores are required. For other scenarios with non-full traffic, the required number of algorithm cores can be determined based on the specific link combination mode. It should be noted that the data processing method provided in this application is applicable to full traffic scenarios on X32 and can satisfy all combination scenarios of PCIe and CXL links. The data processing method provided in this application is also applicable to other rate-reduced combination scenarios.

[0090] In some embodiments, the correspondence between multiple encrypted data packets and link combination modes includes the attribution relationship between the multiple encrypted data packets and the multiple channel groups included in the multiple second links. In this case, when distributing multiple encrypted data packets to multiple algorithm core groups according to the correspondence between the multiple encrypted data packets and link combination modes, each encrypted data packet can be distributed to its corresponding algorithm core group according to the attribution relationship between the multiple encrypted data packets and the multiple channel groups included in the multiple second links.

[0091] The following examples illustrate the relationship between link combination patterns and algorithm core groups.

[0092] Taking a scenario with two PCIe links (e.g., PCIe link 1 and PCIe link 2), and each PCIe link having 16 channels (i.e., a maximum rate of x16), the total number of algorithm cores in the encryption / decryption engine is 16, with the following possibilities:

[0093] When both PCIe links transmit at X16 rate, i.e. the link combination mode is X16+X16 mode, these 16 algorithm cores can be divided into two categories: the first category of 8 algorithm cores is dedicated to packet processing of PCIe link 1 (e.g. packet processing of the first type of service); the second category of 8 algorithm cores is dedicated to packet processing of PCIe link 2 (e.g. packet processing of the second type of service).

[0094] When PCIe link 1 transmits at a rate of x16 and PCIe link 2 transmits at a rate of 2x8, i.e., the link combination mode is x16+2x8 mode, these 16 algorithm cores can be divided into three categories: the first category of 8 algorithm cores is dedicated to packet processing of PCIe link 1 (e.g., packet processing of the first type of service); the second category of 4 algorithm cores is dedicated to packet processing of 8 channels of PCIe link 2 (e.g., packet processing of the second type of service); and the third category of 4 algorithm cores is dedicated to packet processing of the remaining 8 channels of PCIe link 2 (e.g., packet processing of the third type of service).

[0095] Taking a scenario with only one PCIe link and 16 channels (i.e., a maximum speed of X16) as an example, the total number of algorithm cores in the encryption / decryption engine is 8, with the following possibilities:

[0096] When the PCIe link transmits at an X16 rate, i.e., the link combination mode is X16 mode, these 8 algorithm cores belong to the same category: these 8 algorithm cores are specifically used for packet processing of this PCIe link (e.g., packet processing for the first type of service).

[0097] When the PCIe link transmits at a 2x8 rate, i.e., the link combination mode is 2x8 mode, these 8 algorithm cores can be divided into two categories: the first category of 4 algorithm cores is dedicated to the packet processing of 8 channels of the PCIe link (e.g., packet processing of the first type of service); the second category of 4 algorithm cores is dedicated to the packet processing of the remaining 8 channels of the PCIe link (e.g., packet processing of the second type of service).

[0098] When the PCIe link transmits at an X8+2X4 rate, i.e., the link combination mode is X8+2X4, these 8 algorithm cores can be divided into three categories: the first category has 4 algorithm cores, which are dedicated to the packet processing of 8 channels of the PCIe link (e.g., packet processing of the first type of service); the second category has 2 algorithm cores, which are dedicated to the packet processing of 4 channels of the remaining channels of the PCIe link (e.g., packet processing of the second type of service); and the third category has 2 algorithm cores, which are dedicated to the packet processing of the remaining 4 channels of the PCIe link (e.g., packet processing of the third type of service).

[0099] In some embodiments, during the process of distributing each encrypted data packet to the corresponding algorithm core group, the data to be decrypted in each encrypted data packet can be extracted first, and then the data to be decrypted in each encrypted data packet can be split into multiple sub-data to be decrypted. The number of sub-data to be decrypted is consistent with the number of algorithm cores included in the corresponding algorithm core group. Then, each sub-data to be decrypted is distributed to each algorithm core in the corresponding algorithm core group.

[0100] In some embodiments, during the process of decrypting each ciphertext data packet using all algorithm cores in each algorithm core group to obtain the plaintext data packet for each second link, all the sub-data to be decrypted in each ciphertext data packet can first be decrypted in parallel using all the algorithm cores in each algorithm core group to obtain multiple decrypted sub-data. Then, the multiple decrypted sub-data are distributed to the original ciphertext data packet for packet conversion to obtain the plaintext data packet for each second link.

[0101] In some embodiments, after obtaining multiple decrypted sub-data, the MAC corresponding to the multiple decrypted sub-data can be further determined. In this case, when distributing the multiple decrypted sub-data to the original ciphertext data packets for packet conversion to obtain plaintext data packets for each second link, the multiple decrypted sub-data and MAC can be distributed to the original ciphertext data packets for packet conversion to obtain plaintext data packets for each second link.

[0102] In some embodiments, during the process of distributing multiple decrypted sub-data and MACs to the original ciphertext data packets for packet conversion to obtain plaintext data packets for each second link, the original ciphertext data packets corresponding to the multiple decrypted sub-data can be determined first. Then, for the multiple decrypted sub-data, MAC verification is performed according to the corresponding MAC to obtain the verification result. If the verification result is successful, the sub-data to be decrypted in each of the original ciphertext data packets is replaced with the corresponding decrypted sub-data, and the corresponding MAC is added to the corresponding original ciphertext data packet to obtain the plaintext data packets for each second link.

[0103] In some embodiments, during the process of extracting the data to be decrypted from each encrypted data packet, the ciphertext to be decrypted and the AAD to be authenticated from each encrypted data packet can be extracted first, and then the ciphertext and AAD can be combined into data blocks to obtain the data to be decrypted from each encrypted data packet.

[0104] In some embodiments, the process of receiving multiple encrypted data packets from multiple second links may include: firstly, receiving traffic data from multiple second links through a single input interface using time-division multiplexing, wherein each second link corresponds to a link identifier; and then, splitting the traffic data according to the link identifier to obtain encrypted data packets for each second link.

[0105] In some embodiments, after obtaining the plaintext data packets of each second link, the corresponding plaintext data packets can be further sent to the first link corresponding to each second link.

[0106] The data processing method provided in this application will be described in detail below with specific embodiments.

[0107] In one embodiment, before executing the data processing method, the host (i.e., the electronic device such as a server or terminal executing the data processing method) first needs to configure the registers, such as configuring the link combination mode, data frame mode, status register, interrupt mask register, etc., and then configuring the keys for each link, including encryption keys, authentication keys, initialization vectors, etc. After the host completes the above configuration, it can encrypt / decrypt the received messages and send the encrypted / decrypted messages downstream.

[0108] like Figure 5 As shown, Figure 5 This is a flowchart illustrating the data encryption process on the TX side. The data encryption process on the TX side may include the following:

[0109] After the device receives PCIe and CXL packets, it first parses the PCIe and CXL packets respectively through the TX link traffic unpacking module to extract the corresponding plaintext and AAD.

[0110] For PCIe packets, the plaintext and AAD are concatenated into a data block of a certain size, and then sent to the TX plaintext distribution module.

[0111] For CXL messages, the plaintext and AAD are aggregated to obtain a data block of a certain size, which is then sent to the TX plaintext distribution module.

[0112] After receiving the data block, the TX plaintext distribution module distributes the data block to the encryption engine.

[0113] After receiving the data block, the encryption engine verifies the data block using its internal encryption algorithm and performs parallel data encryption or authentication processing. Then, it sends the encrypted or authenticated ciphertext to the TX ciphertext distribution module.

[0114] The TX ciphertext distribution module distributes ciphertext that has undergone data encryption or data authentication to the TX link traffic packet assembly module.

[0115] The TX link traffic packet assembly module replaces the plaintext in the original packet corresponding to the ciphertext with the ciphertext, and appends the MAC address to the end of the original packet or inserts it into a fixed field of the original packet, generating corresponding PCIe_IDE and CXL_IDE packets. Then, the PCIe_IDE and CXL_IDE packets are sent to the corresponding PCIe_TX and CXL_TX output interface modules. The PCIe_IDE packet refers to the encrypted PCIe packet, and the CXL_IDE packet refers to the encrypted CXL packet.

[0116] The PCIe_TX output interface module sends PCIe_IDE messages to the outside world, and the CXL_TX output interface module sends CXL_IDE messages to the outside world.

[0117] It should be noted that the processing of PCIe packets and CXL packets is similar in the above process. The difference is that packet aggregation is required for CXL packets, while packet aggregation is not supported for PCIe packets.

[0118] like Figure 6 As shown, Figure 6 This is a flowchart illustrating the data decryption process performed on the RX side path. The data decryption process on the RX side path may include the following:

[0119] After the device receives the PCIe_IDE and CXL_IDE packets, it first parses the PCIe_IDE and CXL_IDE packets respectively through the RX link traffic unpacking module to extract the corresponding ciphertext and AAD.

[0120] For PCIe_IDE messages, the ciphertext and AAD are concatenated into a data block of a certain size and then sent to the RX ciphertext distribution module.

[0121] For CXL_IDE messages, the ciphertext and AAD are aggregated to obtain a data block of a certain size, which is then sent to the RX ciphertext distribution module.

[0122] After receiving the data block, the RX ciphertext distribution module distributes the data block to the decryption engine.

[0123] After receiving the data block, the decryption engine performs parallel data decryption or data authentication processing on the data block using its internal decryption algorithm. Then, it sends the decrypted or authenticated plaintext to the RX plaintext distribution module.

[0124] The RX plaintext distribution module distributes plaintext data that has undergone data decryption or data authentication to the RX link traffic packet assembly module.

[0125] After receiving the plaintext, the RX link traffic packet assembly module first performs a MAC check. If the MAC check passes, it replaces the ciphertext in the original packet corresponding to the plaintext with the plaintext, and then appropriately trims the packet containing the plaintext to generate the corresponding PCIe and CXL packets. Finally, it sends the PCIe and CXL packets to the corresponding PCIe_RX and CXL_RX output interface modules. Here, the PCIe packet refers to the decrypted PCIe_IDE packet, and the CXL packet refers to the decrypted CXL_IDE packet.

[0126] The PCIe_RX output interface module sends PCIe messages to the outside world, and the CXL_RX output interface module sends CXL messages to the outside world.

[0127] It should be noted that the processing of PCIe_IDE packets and CXL_IDE packets is similar in the above process. The difference is that packet aggregation is required for CXL_IDE packets, while packet aggregation is not supported for PCIe_IDE packets.

[0128] By employing the data processing method provided in this application embodiment, encryption / decryption of multiple PCIe links and multiple CXL links can be achieved simultaneously without interference between the links. Furthermore, the data processing method provided in this application embodiment, based on a centralized architecture concept, utilizes a multiplexed algorithm core approach, which improves the chip's power consumption, performance, and area (PPA) performance, reduces hardware resource overhead, and lowers hardware costs. Additionally, the centralized architecture adopted in this application embodiment facilitates key management, allowing all link keys to be managed uniformly by the host, thereby reducing the complexity of key management and the risk of key leakage, and improving system security.

[0129] Additionally, refer to Figure 7As shown, one embodiment of this application also discloses an electronic device 700, which includes at least one processor 710; at least one memory 720 for storing at least one program; and when the at least one program is executed by the at least one processor 710, it implements the data processing method as described in any of the preceding embodiments.

[0130] In addition, one embodiment of this application discloses a computer-readable storage medium storing computer-executable instructions for performing data processing methods as described in any of the preceding embodiments.

[0131] Furthermore, one embodiment of this application discloses a computer program product, including a computer program or computer instructions, which are stored in a computer-readable storage medium. The processor of an electronic device reads the computer program or computer instructions from the computer-readable storage medium and executes the computer program or computer instructions, causing the electronic device to perform the data processing method as described in any of the preceding embodiments.

[0132] It will be understood by those skilled in the art that all or some of the steps and systems in the methods disclosed above can be implemented as software, firmware, hardware, and suitable combinations thereof. Some or all of the physical components can be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, which can include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, as is known to those skilled in the art, communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0133] The above is a detailed description of the preferred embodiments of this application. However, this application is not limited to the above embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of this application. All such equivalent modifications or substitutions are included within the scope defined by the claims of this application.

Claims

1. A data processing method, comprising: Receive multiple plaintext data packets from multiple first links; Based on the link combination mode of the plurality of first links, the plurality of algorithm cores are divided into a plurality of algorithm core groups, wherein the link combination mode of the plurality of first links refers to the link rate combination mode of the plurality of first links; Based on the correspondence between the plurality of plaintext data packets and the link combination mode, the plurality of plaintext data packets are distributed to the plurality of algorithm core groups, and each plaintext data packet is encrypted by all the algorithm cores in each of the algorithm core groups to obtain the ciphertext data packets of each first link. The correspondence between the plurality of plaintext data packets and the link combination mode includes the affiliation relationship between the plurality of plaintext data packets and the plurality of channel groups included in the plurality of first links.

2. The data processing method according to claim 1, characterized in that, The plurality of first links includes at least one of the following: Multiple high-speed peripheral components interconnect PCIe links; Multiple fast computation links are linked by CXL.

3. The data processing method according to claim 1, characterized in that, The step of dividing multiple algorithm cores into multiple algorithm core groups based on the link combination pattern of the multiple first links includes: Based on the link combination mode of the plurality of first links, determine the number of channel groups included in the plurality of first links and the number of channels included in each channel group; Based on the number of channel groups and the number of channels contained in each channel group, multiple algorithm cores are divided into multiple algorithm core groups.

4. The data processing method according to claim 3, characterized in that, The step of distributing the plurality of plaintext data packets to the plurality of algorithm core groups according to the correspondence between the plurality of plaintext data packets and the link combination mode includes: Based on the attribution relationship, each plaintext data packet is distributed to its corresponding algorithm core group.

5. The data processing method according to claim 4, characterized in that, The step of distributing each of the plaintext data packets to the corresponding algorithm core groups includes: Extract the data to be encrypted from each of the plaintext data packets; The data to be encrypted in each plaintext data packet is split into multiple sub-data to be encrypted, and the number of sub-data to be encrypted is consistent with the number of algorithm cores included in the corresponding algorithm core group; Each of the sub-data to be encrypted is distributed to the corresponding algorithm core in the corresponding algorithm core group.

6. The data processing method according to claim 5, characterized in that, The step of encrypting each plaintext data packet using all the algorithm cores in each of the algorithm core groups to obtain ciphertext data packets for each of the first links includes: By using all the algorithm cores in each of the algorithm core groups, all the sub-data to be encrypted in each plaintext data packet are encrypted in parallel to obtain multiple encrypted sub-data; The multiple encrypted sub-data are distributed to the original plaintext data packets for packet conversion to obtain ciphertext data packets for each of the first links.

7. The data processing method according to claim 6, characterized in that, The method further includes: determining the Message Authentication Code (MAC) corresponding to the plurality of encrypted sub-data; The step of distributing the plurality of encrypted sub-data to the original plaintext data packets for packet conversion to obtain ciphertext data packets for each of the first links includes: distributing the plurality of encrypted sub-data and the MAC to the original plaintext data packets for packet conversion to obtain ciphertext data packets for each of the first links.

8. The data processing method according to claim 7, characterized in that, The step of distributing the plurality of encrypted sub-data and the MAC to the original plaintext data packets for packet conversion to obtain ciphertext data packets for each of the first links includes: The sub-data to be encrypted in each of the original plaintext data packets is replaced with the corresponding encrypted sub-data, and the corresponding MAC is added to the corresponding original plaintext data packet to obtain the ciphertext data packets of each of the first links.

9. The data processing method according to claim 5, characterized in that, The step of extracting the data to be encrypted from each of the plaintext data packets includes: Extract the plaintext to be encrypted and the additional authentication data (AAD) to be authenticated from each of the plaintext data packets; The plaintext and the AAD are combined into data blocks to obtain the data to be encrypted in each plaintext data packet.

10. The data processing method according to claim 1, characterized in that, The receiving of multiple plaintext data packets from multiple first links includes: The system uses time-division multiplexing to receive traffic data from multiple first links through a single input interface, where each first link has a corresponding link identifier. The traffic data is split according to the link identifier to obtain plaintext data packets for each of the first links.

11. The data processing method according to claim 1, characterized in that, The method further includes: Send the corresponding encrypted data packet to each of the second links corresponding to the first link.

12. A data processing method, comprising: Receive multiple encrypted data packets from multiple second links; Based on the link combination mode of the multiple second links, the multiple algorithm cores are divided into multiple algorithm core groups, where the link combination mode of the multiple second links refers to the link rate combination mode of the multiple second links; Based on the correspondence between the plurality of encrypted data packets and the link combination mode, the plurality of encrypted data packets are distributed to the plurality of algorithm core groups, and each encrypted data packet is decrypted by all the algorithm cores in each of the algorithm core groups to obtain the plaintext data packets of each second link. The correspondence between the plurality of encrypted data packets and the link combination mode includes the affiliation relationship between the plurality of encrypted data packets and the plurality of channel groups included in the plurality of second links.

13. The data processing method according to claim 12, characterized in that, The plurality of second links includes at least one of the following: Multiple PCIe links; Multiple CXL links.

14. The data processing method according to claim 12, characterized in that, The step of dividing multiple algorithm cores into multiple algorithm core groups based on the link combination pattern of the multiple second links includes: Based on the link combination mode of the plurality of second links, determine the number of channel groups included in the plurality of second links and the number of channels included in each channel group; Based on the number of channel groups and the number of channels contained in each channel group, multiple algorithm cores are divided into multiple algorithm core groups.

15. The data processing method according to claim 14, characterized in that, The step of distributing the multiple encrypted data packets to the multiple algorithm core groups according to the correspondence between the multiple encrypted data packets and the link combination mode includes: Based on the attribution relationship, each encrypted data packet is distributed to the corresponding algorithm core group.

16. The data processing method according to claim 15, characterized in that, The step of distributing each of the encrypted data packets to the corresponding algorithm core groups includes: Extract the data to be decrypted from each of the encrypted data packets; The data to be decrypted in each of the encrypted data packets is split into multiple sub-data to be decrypted, and the number of sub-data to be decrypted is consistent with the number of algorithm cores included in the corresponding algorithm core group; Each of the sub-data to be decrypted is distributed to the corresponding algorithm core in the corresponding algorithm core group.

17. The data processing method according to claim 16, characterized in that, The step of decrypting each encrypted data packet using all the algorithm cores in each of the algorithm core groups to obtain the plaintext data packets of each of the second links includes: By using all the algorithm cores in each of the algorithm core groups, all the undecrypted sub-data of each of the ciphertext data packets are decrypted in parallel to obtain multiple decrypted sub-data; The multiple decrypted sub-data are distributed to the original ciphertext data packets for packet conversion to obtain plaintext data packets for each of the second links.

18. The data processing method according to claim 17, characterized in that, The method further includes: determining the MAC corresponding to the plurality of decrypted sub-data; The step of distributing the plurality of decrypted sub-data to the original ciphertext data packets for packet conversion to obtain plaintext data packets for each of the second links includes: distributing the plurality of decrypted sub-data and the MAC to the original ciphertext data packets for packet conversion to obtain plaintext data packets for each of the second links.

19. The data processing method according to claim 18, characterized in that, The step of distributing the multiple decrypted sub-data and the MAC to the original ciphertext data packets for packet conversion to obtain plaintext data packets for each of the second links includes: Determine the original ciphertext data packet corresponding to the plurality of decrypted sub-data; For the multiple decrypted sub-data, MAC verification is performed according to the corresponding MAC to obtain the verification result; In response to the verification result being successful, the decryption sub-data in each of the original ciphertext data packets is replaced with the corresponding decryption sub-data, and the corresponding MAC is added to the corresponding original ciphertext data packet to obtain the plaintext data packets of each of the second links.

20. The data processing method according to claim 16, characterized in that, The step of extracting the data to be decrypted from each of the encrypted data packets includes: Extract the ciphertext to be decrypted and the AAD to be authenticated from each of the ciphertext data packets; The ciphertext and the AAD are combined into data blocks to obtain the data to be decrypted in each ciphertext data packet.

21. The data processing method according to claim 12, characterized in that, The receiving of multiple encrypted data packets from multiple second links includes: The system uses time-division multiplexing to receive traffic data from multiple second links through a single input interface, where each second link has a corresponding link identifier. The traffic data is split according to the link identifier to obtain encrypted data packets for each second link.

22. The data processing method according to claim 12, characterized in that, The method further includes: Send the corresponding plaintext data packet to each of the first links corresponding to the second link.

23. An electronic device, characterized in that, include: At least one processor; At least one memory for storing at least one program; The data processing method according to any one of claims 1 to 22 is implemented when at least one of the programs is executed by at least one of the processors.

24. A computer-readable storage medium storing computer-executable instructions, characterized in that, The computer-executable instructions are used to execute the data processing method according to any one of claims 1 to 22.

25. A computer program product, comprising a computer program or computer instructions, characterized in that, The computer program or the computer instructions are stored in a computer-readable storage medium, the processor of the electronic device reads the computer program or the computer instructions from the computer-readable storage medium, and the processor executes the computer program or the computer instructions, causing the electronic device to perform the data processing method according to any one of claims 1 to 22.

Images