Cipher card data processing method and device, computer equipment, storage medium and computer program product

Abstract

The invention relates to a password card data processing method and device, computer equipment, a storage medium and a computer program product. The method comprises the following steps: establishing high-speed serial computer expansion bus standard link connection with a field-programmable gate array chip, configuring a base address register of the field-programmable gate array chip, initializing a direct memory access engine of the field-programmable gate array chip, carrying out initialization setting on a scheduling acceleration module of an anti-quantum algorithm system on the field programmable gate array chip; constructing a descriptor table, wherein the descriptor table is configured to cooperate with the scheduling acceleration module to execute the operation of the anti-quantum algorithm system; the descriptor table is analyzed through the scheduling acceleration module, the anti-quantum algorithm system is called to execute calculation, and a calculation result is output to a target address. By adopting the method, the security and flexibility of the password card can be improved, and a traditional algorithm and an anti-quantum algorithm are compatibly supported.

Description

Technical Field

[0001] This application relates to the field of computer hardware technology, and in particular to a method, apparatus, computer equipment, storage medium and computer program product for processing data on a cryptographic card. Background Technology

[0002] In today's global digital age, information security has become a cornerstone of societal operation, especially in data centers, cloud computing platforms, and critical information infrastructure. With continuous breakthroughs in quantum computing theory and rapid advancements in engineering practice, traditional cryptographic systems built on classical computing models are facing the risk of fundamental disruption. Traditional cryptographic cards remain the mainstream hardware devices for ensuring information security across various fields.

[0003] In traditional technologies, cryptographic cards often require firmware modifications or main chip replacements for algorithm updates, and the hardware lacks reserved resources for quantum-resistant algorithm acceleration. This results in insufficient security; the classical algorithms relied upon by traditional cryptographic cards are easily cracked by quantum computing technology, making them unable to withstand future quantum attacks and failing to meet the long-term data security requirements of critical sectors. Furthermore, quantum-resistant upgrades are costly. Designing a dedicated quantum-resistant chip to achieve quantum resistance necessitates a complete hardware architecture overhaul, which not only prevents the reuse of classical algorithm resources and communication interfaces from traditional main chips but also significantly increases the overall hardware cost of the cryptographic card. Summary of the Invention

[0004] Therefore, it is necessary to provide a cryptographic card data processing method, apparatus, computer equipment, computer-readable storage medium, and computer program product that can improve the security and flexibility of cryptographic cards and is compatible with both traditional and quantum-resistant algorithms, in order to address the aforementioned technical problems.

[0005] Firstly, this application provides a method for processing cryptographic card data. The method includes:

[0006] Establish a high-speed serial computer extended bus standard link connection with the field-programmable gate array (FPGA) chip, configure the base address register of the FPGA chip, initialize the direct memory access engine of the FPGA chip, and initialize the scheduling acceleration module of the quantum-resistant algorithm system on the FPGA chip.

[0007] Construct a descriptor table, which is configured to cooperate with the scheduling acceleration module to execute the operation of the quantum-resistant algorithm system;

[0008] The scheduling acceleration module parses the descriptor table, calls the quantum-resistant algorithm system to perform calculations, and outputs the calculation results to the target address.

[0009] In some embodiments of the method, establishing a high-speed serial computer expansion bus standard link connection with the field-programmable gate array chip includes:

[0010] With the power supply and clock of the main chip and the field programmable gate array chip in a stable state, set the device type, data transmission rate and number of channels of the high-speed serial computer expansion bus standard;

[0011] After resetting the field-programmable gate array (FPGA) chip, a link connection request is initiated with the FPGA chip.

[0012] If a normal link connection with the field-programmable gate array chip is detected, the connection is deemed correct and the process continues; otherwise, the link connection process is terminated.

[0013] In some embodiments of the method, configuring the base address register of the field-programmable gate array (FPGA) chip, initializing the direct memory access engine of the FPGA chip, and initializing the scheduling acceleration module of the quantum-resistant algorithm system on the FPGA chip include:

[0014] Under normal link connection conditions, configure the base address register of the field-programmable gate array chip, set the address of the address translation unit, and map the direct memory access configuration space with the address space of the quantum-resistant algorithm system;

[0015] By extending the standard link of the high-speed serial computer bus, register initialization operations are performed on the direct memory access engine that maps the base address register and the scheduling acceleration module of the quantum-resistant algorithm system.

[0016] In some embodiments of the method, constructing the descriptor table includes:

[0017] Initialize descriptor table data in the storage space, the descriptor table data including input descriptor table data and output descriptor table data;

[0018] The direct memory access engine is invoked to transfer the input symbol table data to the scheduling acceleration module, and the computation completion status is determined by reading the registers of the scheduling acceleration module.

[0019] When the computation is complete, the direct memory access engine is invoked to transfer the output symbol table data to the storage space.

[0020] In some embodiments of the method, the input symbol table data includes 4 bytes of control data, 4 bytes of data length information, 8 bytes of identification data, and algorithm input parameter data;

[0021] The output symbol table data includes 8 bytes of identifier data and algorithm output result data.

[0022] In some embodiments of the method, the step of parsing the descriptor table through the scheduling acceleration module, invoking the quantum-resistant algorithm system to perform computation, and outputting the computation result to the target address includes:

[0023] The scheduling acceleration module parses the input symbol table data and transmits the data required by the algorithm to the quantum-resistant algorithm system.

[0024] After receiving the output completion signal sent by the anti-quantum algorithm system, the system calls the scheduling acceleration module to update the status register and then outputs the calculation result to the target address.

[0025] According to a second aspect of the present disclosure, a cryptographic card data processing apparatus is provided. The apparatus includes:

[0026] The link connection module is used to establish a high-speed serial computer extended bus standard link connection with the field-programmable gate array chip, configure the base address register of the field-programmable gate array chip, initialize the direct memory access engine of the field-programmable gate array chip, and initialize the scheduling acceleration module of the quantum-resistant algorithm system on the field-programmable gate array chip.

[0027] A descriptor table construction module is used to construct a descriptor table, which is configured to cooperate with the scheduling acceleration module to execute the operation of the quantum-resistant algorithm system;

[0028] The processing module is used to parse the descriptor table through the scheduling acceleration module, call the quantum-resistant algorithm system to perform calculations, and output the calculation results to the target address.

[0029] According to a third aspect of the present disclosure, a computer device is provided. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program performing the following steps:

[0030] Establish a high-speed serial computer extended bus standard link connection with the field-programmable gate array (FPGA) chip, configure the base address register of the FPGA chip, initialize the direct memory access engine of the FPGA chip, and initialize the scheduling acceleration module of the quantum-resistant algorithm system on the FPGA chip.

[0031] Construct a descriptor table, which is configured to cooperate with the scheduling acceleration module to execute the operation of the quantum-resistant algorithm system;

[0032] The scheduling acceleration module parses the descriptor table, calls the quantum-resistant algorithm system to perform calculations, and outputs the calculation results to the target address.

[0033] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:

[0034] Establish a high-speed serial computer extended bus standard link connection with the field-programmable gate array (FPGA) chip, configure the base address register of the FPGA chip, initialize the direct memory access engine of the FPGA chip, and initialize the scheduling acceleration module of the quantum-resistant algorithm system on the FPGA chip.

[0035] Construct a descriptor table, which is configured to cooperate with the scheduling acceleration module to execute the operation of the quantum-resistant algorithm system;

[0036] The scheduling acceleration module parses the descriptor table, calls the quantum-resistant algorithm system to perform calculations, and outputs the calculation results to the target address.

[0037] According to a fifth aspect of the present disclosure, a computer program product is provided. The computer program product includes a computer program that, when executed by a processor, performs the following steps:

[0038] Establish a high-speed serial computer extended bus standard link connection with the field-programmable gate array (FPGA) chip, configure the base address register of the FPGA chip, initialize the direct memory access engine of the FPGA chip, and initialize the scheduling acceleration module of the quantum-resistant algorithm system on the FPGA chip.

[0039] Construct a descriptor table, which is configured to cooperate with the scheduling acceleration module to execute the operation of the quantum-resistant algorithm system;

[0040] The scheduling acceleration module parses the descriptor table, calls the quantum-resistant algorithm system to perform calculations, and outputs the calculation results to the target address.

[0041] The cryptographic card data processing solution provided in this application achieves compatibility support for both traditional security algorithms and quantum-resistant algorithms through a collaborative architecture of a main chip and a field-programmable gate array (FPGA) chip. It reuses the existing classical algorithm resources and communication interfaces of the main chip without requiring hardware architecture reconstruction, while introducing quantum-resistant protection capabilities through the FPGA chip to effectively resist quantum attacks, thus solving the problem of insufficient security protection in traditional cryptographic cards. Simultaneously, the programmable nature of the FPGA chip allows the quantum-resistant algorithm to be updated independently without replacing the main chip or the entire firmware, improving the cryptographic card's flexibility and reducing the cost of quantum-resistant upgrades.

[0042] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0043] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure, and are not intended to unduly limit this disclosure.

[0044] Figure 1 This is a flowchart illustrating a password card data processing method according to an exemplary embodiment;

[0045] Figure 2 This is a schematic diagram illustrating the structure of a quantum-resistant cryptographic card according to an exemplary embodiment;

[0046] Figure 3 This is a schematic diagram illustrating the register settings of an acceleration scheduling module according to an exemplary embodiment;

[0047] Figure 4 This is a flowchart illustrating the operation of an accelerated scheduling module according to an exemplary embodiment;

[0048] Figure 5 This is a flowchart illustrating a quantum-resistant algorithm computation method according to an exemplary embodiment;

[0049] Figure 6 This is a structural block diagram of a password card data processing apparatus according to an exemplary embodiment;

[0050] Figure 7 This is a diagram illustrating the internal structure of a computer device according to an exemplary embodiment. Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0052] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure. The terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitations, the presence of other identical or equivalent elements in a process, method, product, or apparatus that includes said elements is not excluded. For example, the use of terms such as "first," "second," etc., to denote names does not indicate any specific order.

[0053] In some embodiments provided in this disclosure, the execution of the cryptographic card data processing method can be controlled by a unified controller or by multiple controllers. These controllers may include controllers on local terminals or controllers on remote servers. In some embodiments, the controllers on local terminals and servers may work together to complete the cryptographic card data processing. The local terminal mentioned in this disclosure may include, but is not limited to, various robotic devices, in-vehicle devices, personal computers, laptops, smartphones, tablets, wearable devices, medical devices, VR (Virtual Reality) devices, etc. The server may also be a server, server cluster, distributed subsystem, cloud processing platform, server containing blockchain nodes, or a combination thereof. The controllers described in this disclosure may include various control units capable of implementing logic processing functions, including but not limited to CPU (Central Processing Unit), PLC (Programmable Logic Controller), ECU (Electronic Control Unit), MCU (Microcontroller Unit), FPGA (Field Programmable Gate Array), and CPLD (Complex Programmable Logic Device), as well as controllers composed of one or more logic function units, chips, etc.

[0054] In some embodiments of this disclosure, a method for processing password card data is provided, such as... Figure 1 As shown, when applied to the main chip, it includes the following steps:

[0055] S20. Establish a high-speed serial computer extended bus standard link connection with the field-programmable gate array (FPGA) chip, configure the base address register of the FPGA chip, initialize the direct memory access engine of the FPGA chip, and initialize the scheduling acceleration module of the quantum-resistant algorithm system on the FPGA chip.

[0056] The main chip typically refers to the core control unit of a cryptographic card. It handles communication and interaction with the host computer, executes standard security algorithms, and is responsible for initializing, configuring, and scheduling the various functions of the field-programmable gate array (FPGA) chip. It is the dominant part of the cryptographic card's data processing flow. The FPGA chip is a programmable hardware chip used to support quantum-resistant algorithm systems. Upgrades to quantum-resistant algorithms can be achieved by updating its internal code, adapting to new quantum-resistant protection requirements without replacing the hardware.

[0057] The high-speed serial computer expansion bus standard (Peripheral Component Interconnect Express, PCIe) is a high-speed data transmission interface between the main chip and the field-programmable gate array (FPGA) chip, providing stable and efficient link support for communication between the two, ensuring data transmission rate and reliability. The Direct Memory Access (DMA) engine is a hardware module that can complete memory data transmission without relying on the main chip processor. It can independently realize the transfer of data between storage space and functional modules, reducing the burden on the main chip and improving overall data processing efficiency.

[0058] The scheduling acceleration module is a functional module integrated on the field-programmable gate array chip. Its core functions are to parse the descriptor table, schedule the quantum-resistant algorithm engine to perform calculations, provide real-time feedback on the calculation status, and coordinate the collaborative process between modules.

[0059] Reference Figure 2 The main chip connects to the FPGA via the PCIe root complex port to control the quantum-resistant algorithm system on the FPGA. After power-on, the main chip firmware code detects the PCIe link connection between the main chip and the FPGA. Once the connection is established, it initializes the DMA engine on the FPGA and configures the scheduling acceleration module of the quantum-resistant algorithm system.

[0060] S22. Construct a descriptor table, which is configured to cooperate with the scheduling acceleration module to execute the operation of the quantum-resistant algorithm system.

[0061] The quantum-resistant algorithm system is a core computing module deployed on a field-programmable gate array (FPGA) chip. It possesses the ability to resist quantum attacks, can perform various quantum-resistant computations, and provides quantum security protection for cryptographic cards. The descriptor table is a structured data collection that standardizes data transmission formats and computational instructions. It can contain input / output related control information, identification information, and parameter data, providing a unified data basis for the collaboration between the scheduling acceleration module and the quantum-resistant algorithm system.

[0062] S24. The descriptor table is parsed by the scheduling acceleration module, the quantum-resistant algorithm system is called to perform calculations, and the calculation results are output to the target address.

[0063] The calculation result is the final data set generated by the cryptographic card's quantum-resistant algorithm system after receiving instructions and input parameters transmitted by the scheduling acceleration module and completing the computation according to the preset quantum-resistant algorithm logic. The target address is a storage space identifier pre-set during the cryptographic card system initialization and configuration phase, used to store the quantum-resistant algorithm calculation results. This identifier corresponds to a specific physical storage location in the cryptographic card hardware architecture.

[0064] In some embodiments of this disclosure, a collaborative architecture between the main chip and the field-programmable gate array (FPGA) chip achieves compatibility support for both traditional security algorithms and quantum-resistant algorithms. This reuses the existing classical algorithm resources and communication interfaces of the main chip without requiring hardware architecture reconstruction, while introducing quantum-resistant protection capabilities through the FPGA chip effectively resists quantum attacks, addressing the insufficient security protection of traditional cryptographic cards. Simultaneously, the programmable nature of the FPGA chip allows for independent updates to the quantum-resistant algorithms without replacing the main chip or the entire firmware, improving the cryptographic card's flexibility and reducing the cost of quantum-resistant upgrades.

[0065] In some embodiments of this disclosure, S20 includes:

[0066] With the power supply and clock of the main chip and the field programmable gate array chip in a stable state, set the device type, data transmission rate and number of channels of the high-speed serial computer expansion bus standard;

[0067] After resetting the field-programmable gate array (FPGA) chip, a link connection request is initiated with the FPGA chip.

[0068] If a normal link connection with the field-programmable gate array chip is detected, the connection is deemed correct and the process continues; otherwise, the link connection process is terminated.

[0069] In some implementations, after the cryptographic card is activated, it first enters the link establishment and initialization phase. The main chip waits for both its own power supply and clock speed of the FPGA chip to reach a stable state. Then, it determines the link's device type, data transfer rate, and channel configuration. After resetting the FPGA chip, it initiates a link connection request. The main chip continuously monitors the connection status. If the link connection is confirmed to be normal, it continues subsequent operations; if a connection anomaly is detected, the current link establishment process is terminated to avoid invalid configuration. In some examples, after the device is powered on, when the power supply and clock speed reach a stable state, the main chip sets the PCIe device type, data transfer rate, and number of channels. After resetting the FPGA device, it begins establishing a link with the FPGA. It checks whether the current FPGA's PCIe link status is normal. If the device is correctly connected, it continues running; otherwise, it exits.

[0070] In some embodiments of this disclosure, the link connection between the main chip and the field-programmable gate array chip can be ensured to be stable and reliable; link interruption or data transmission abnormality caused by non-standard connection process is avoided, laying a solid foundation for subsequent configuration initialization, data transmission and calculation operations, and improving the stability and feasibility of the whole method.

[0071] In some embodiments of this disclosure, S20 further includes:

[0072] Under normal link connection conditions, configure the base address register of the field-programmable gate array chip, set the address of the address translation unit, and map the direct memory access configuration space with the address space of the quantum-resistant algorithm system;

[0073] By extending the standard link of the high-speed serial computer bus, register initialization operations are performed on the direct memory access engine that maps the base address register and the scheduling acceleration module of the quantum-resistant algorithm system.

[0074] In some implementations, after the link connection is established, the main chip begins various configuration and initialization operations. First, the base address register of the field-programmable gate array (FPGA) chip is configured, setting the address of the address translation unit to achieve a mapping between the direct memory access configuration space and the address space of the quantum-resistant algorithm system, allowing the main chip to accurately access relevant functional modules. Then, through the established high-speed serial computer extended bus standard link, the registers of the direct memory access engine and the scheduling acceleration module of the quantum-resistant algorithm system within the mapping range of the base address register are initialized, assigning each module the initial parameters required for normal operation. In some examples, with the link connection established, the number of DMA channels is initialized, the DMA mode is selected, DMA descriptor storage addresses are allocated, and the DMA channel control register and interrupt enable register are initialized. The scheduling acceleration module of the quantum-resistant algorithm system is configured, and the initial addresses of the input and output descriptors are initialized.

[0075] In some embodiments of this disclosure, address association and functional readiness between the direct memory access engine and the quantum-resistant algorithm system can be achieved; the main chip can accurately control the relevant modules on the field-programmable gate array chip, the cooperation between modules is smoother, the functional failures caused by address conflicts or inadequate initialization are reduced, and the overall system's collaborative efficiency is improved.

[0076] In some embodiments of this disclosure, S22 includes:

[0077] Initialize descriptor table data in the storage space, the descriptor table data including input descriptor table data and output descriptor table data;

[0078] The direct memory access engine is invoked to transfer the input symbol table data to the scheduling acceleration module, and the computation completion status is determined by reading the registers of the scheduling acceleration module.

[0079] When the computation is complete, the direct memory access engine is invoked to transfer the output symbol table data to the storage space.

[0080] In some implementations, after initialization, the descriptor table construction phase begins. The main chip initializes the descriptor table data in its own storage space, which is divided into input and output parts. Input data includes control instructions, data length information, identification information, and input parameters required by the algorithm. Output data includes identification information and the result data calculated by the algorithm. After construction, the main chip calls the direct memory access engine to transfer the input data to the scheduling acceleration module. Simultaneously, it checks the register status of the scheduling acceleration module to determine whether the calculation is complete. After the calculation is finished, the output data is transferred back to the main chip's storage space via the direct memory access engine.

[0081] In some embodiments of this disclosure, the data transmission path and method are standardized through a closed-loop operation of initialization data, data transmission, status judgment, and result return; the application of the direct memory access engine reduces the intervention of the main chip processor, avoids the problem of serial blocking calls, makes full use of bus bandwidth, improves data transmission efficiency, and provides stable data guarantee for the efficient execution of quantum-resistant algorithms.

[0082] In some embodiments of this disclosure, the input symbol table data includes 4 bytes of control data, 4 bytes of data length information, 8 bytes of identification data, and algorithm input parameter data;

[0083] The output symbol table data includes 8 bytes of identifier data and algorithm output result data.

[0084] In some examples, referring to Table 1, the input descriptor table data may include the following fields: for example, the first word is control data, which is parsed by the scheduling acceleration module and then calls the corresponding interface of the quantum-resistant algorithm; the lower 31 bits of the second word indicate the length of the input parameter data in this descriptor table, and the highest 32 bits indicate whether this descriptor table is the last one; the third and fourth words are descriptor table identification data, and the last part is the algorithm input parameter data. Considering the length of the input data of different quantum-resistant algorithms and the byte alignment requirements of DMA transfer, the size of each input descriptor table is fixed at 6K bytes.

[0085] Table 1. Input Symbol Table Data Illustration

[0086]

[0087] In other examples, referring to Table 2, the output descriptor table data may include the following fields: for example, the first word field corresponds to format header 2 in the descriptor table; the high bits of the second word contain bits [31:2] of format header 3 in the descriptor table; and the low two bits, Mul, indicate the number of output descriptors required (Mul=00 indicates only one, Mul=01 indicates two, and so on, with Mul=11 indicating four descriptors). Considering the different quantum-resistant algorithm output data lengths and DMA transfer byte alignment requirements, each output descriptor table size is fixed at 4KB.

[0088] Table 2. Input Symbol Table Data Illustration

[0089]

[0090] In some embodiments of this disclosure, the scheduling acceleration module can quickly and accurately parse data content, avoiding parsing errors or parameter loss caused by chaotic data formats. At the same time, reasonable content division makes the various types of information required by the algorithm clear and explicit, improving the accuracy and efficiency of data processing and ensuring that the quantum-resistant algorithm can obtain complete and valid input parameters.

[0091] In some embodiments of this disclosure, S24 includes:

[0092] The scheduling acceleration module parses the input symbol table data and transmits the data required by the algorithm to the quantum-resistant algorithm system.

[0093] After receiving the output completion signal sent by the anti-quantum algorithm system, the system calls the scheduling acceleration module to update the status register and then outputs the calculation result to the target address.

[0094] In some implementations, the final stage is computation and result output. The scheduling acceleration module parses the received input data, extracts the various data required for the execution of the quantum-resistant algorithm, and accurately transmits them to the quantum-resistant algorithm system. After completing the computation according to the instructions, the quantum-resistant algorithm system sends an output completion signal to the scheduling acceleration module. Upon receiving this signal, the scheduling acceleration module promptly updates its own status register and then transmits the computation result to the pre-set target address.

[0095] In some implementations, refer to Figure 3 and Figure 4 The main chip first initializes the IN_PTR and OUT_PTR registers in the accelerated scheduling module, specifying the corresponding input / output descriptor table addresses. Then, it updates the IN_NUM register and starts the scheduling module (the initial value of the IN_NUM register is 0x10, indicating that 0x10 sets of data can be written; if the software prepares 4 sets, then 4 are written to the IN_NUM register). The accelerated scheduling module reads and parses the input descriptor table from the specified address, extracts the control parameters and input data, passes them to the quantum-resistant algorithm module for calculation, and automatically updates the IN_NUM and IN_PTR registers. When the quantum-resistant algorithm completes its calculation, it actively outputs a completion signal to notify the accelerated scheduling module. The scheduling module then outputs the algorithm's result to OUT_PTR (in the memory of another FPGA) and simultaneously updates OUT_NUM.

[0096] Quantum-resistant algorithms can be implemented based on a quantum-resistant algorithm system on a main chip and an FPGA, as shown in the following figure. Figure 5The system comprises three layers: a host computer application layer, a cryptographic card firmware layer, and an FPGA layer. The host computer application layer includes a quantum-resistant algorithm application interface, a PCIe driver, and an FPGA driver. The quantum-resistant algorithm application interface corresponds to the algorithm interface supported by the quantum-resistant algorithm module in the FPGA. The PCIe driver establishes a PCIe connection between the host computer and the cryptographic card, initializes the cryptographic card device, and the FPGA driver is responsible for initializing the DMA engine on the FPGA and the input and output descriptor table addresses of the acceleration scheduling module. The cryptographic card firmware layer initializes each module of the cryptographic card, establishes a PCIe connection between the cryptographic card main chip and the FPGA, maps the addresses of the traditional security algorithm modules, and performs FPGA space address translation, allowing the host computer driver to directly access the FPGA address space. The FPGA acceleration scheduling module is responsible for parsing the input descriptor table, transmitting input data, controlling the quantum-resistant algorithm module to perform calculations, and outputting the result status and data. The quantum-resistant computation module completes the specific quantum-resistant algorithm calculation process, while the DMA module is responsible for the input and output functions of the FPGA data.

[0097] In some embodiments of this disclosure, the intermediate scheduling function of the scheduling acceleration module enables efficient connection between data parsing and algorithm execution; timely feedback of signals and updates of status registers allow the main chip to monitor the computation progress in real time; and the directional output of computation results ensures the accuracy and security of the data, thereby improving the execution efficiency of quantum-resistant algorithms and the reliability of result transmission.

[0098] The cryptographic card data processing methods disclosed herein achieve compatibility support for both traditional security algorithms and quantum-resistant algorithms through a collaborative architecture of a main chip and a field-programmable gate array (FPGA). This reuses existing classical algorithm resources and communication interfaces of the main chip without requiring hardware architecture reconstruction, while introducing quantum-resistant protection capabilities through the FPGA, effectively resisting quantum attacks and addressing the insufficient security protection of traditional cryptographic cards. Furthermore, the programmable nature of the FPGA allows for independent updates to the quantum-resistant algorithms without replacing the main chip or the entire firmware, improving the cryptographic card's flexibility and reducing the cost of quantum-resistant upgrades.

[0099] It is understood that the various embodiments of the methods described in this specification are presented in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. Related details can be found in the descriptions of other method embodiments.

[0100] It should be understood that although the steps in the flowcharts shown in the accompanying drawings are displayed sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in the accompanying drawings may include multiple steps or stages, which are not necessarily completed at the same time, but may be executed at different times, and the execution order of these steps or stages is not necessarily sequential, but may be performed alternately or in turn with other steps or at least a portion of the steps or stages of other steps.

[0101] Based on the description of the above-described embodiments of the cryptographic card data processing method, this disclosure also provides a cryptographic card data processing apparatus for implementing the aforementioned cryptographic card data processing method. The apparatus may include a system (including a distributed system), software (application), module, component, controller, server, terminal, etc., using the method described in the embodiments of this specification, combined with necessary hardware implementation. Based on the same innovative concept, the apparatuses in one or more embodiments provided by this disclosure are as described in the following embodiments. Since the implementation schemes and methods for solving the problem by the apparatus are similar, the implementation of specific apparatuses in the embodiments of this specification can refer to the implementation of the aforementioned method, and repeated details will not be repeated. As used below, the terms "unit" or "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the apparatuses described in the following embodiments are preferably implemented in software, hardware implementations, or a combination of software and hardware, are also possible and contemplated.

[0102] Figure 6 This is a schematic block diagram of a password card data processing device according to an exemplary embodiment. The device can be the aforementioned terminal, a server, or a module, component, device, control unit, etc., integrated into the terminal. For details, please refer to... Figure 6 The device 100 may include a link connection module 120, a symbol table construction module 140, and a processing module 160. The link connection module 120 is used to establish a high-speed serial computer expansion bus standard link connection with the field-programmable gate array (FPGA) chip, configure the base address register of the FPGA chip, initialize the direct memory access engine of the FPGA chip, and initialize the scheduling acceleration module of the quantum-resistant algorithm system on the FPGA chip. The symbol table construction module 140 is used to construct a descriptor table, which is configured to cooperate with the scheduling acceleration module to execute the operation of the quantum-resistant algorithm system. The processing module 160 is used to parse the descriptor table through the scheduling acceleration module, call the quantum-resistant algorithm system to perform calculations, and output the calculation results to a target address.

[0103] In some embodiments of the device, the link connection module 120 is further configured to set the device type, data transmission rate, and number of channels of the high-speed serial computer extended bus standard when the power supply and clock of the main chip and the field-programmable gate array chip reach a stable state; and to initiate a link connection request with the field-programmable gate array chip after resetting the field-programmable gate array chip; and to determine that the link connection with the field-programmable gate array chip is correct and continue to run if the link connection with the field-programmable gate array chip is detected to be normal; otherwise, to terminate the link connection process.

[0104] In some embodiments of the device, the link connection module 120 is further configured, under normal link connection conditions, to configure the base address register of the field-programmable gate array chip, set the address of the address translation unit, and map the direct memory access configuration space to the address space of the quantum-resistant algorithm system; and to perform register initialization operations on the direct memory access engine mapped by the base address register and the scheduling acceleration module of the quantum-resistant algorithm system through the high-speed serial computer extended bus standard link.

[0105] In some embodiments of the device, the symbol table construction module 140 is further configured to initialize descriptor table data in the storage space, the descriptor table data including input symbol table data and output symbol table data; and to call the direct memory access engine to transfer the input symbol table data to the scheduling acceleration module, and to determine the computation completion status by reading the scheduling acceleration module register; and to call the direct memory access engine to transfer the output symbol table data to the storage space when the computation completion status is computation completion.

[0106] In some embodiments of the device, the input symbol table data includes 4 bytes of control data, 4 bytes of data length information, 8 bytes of identification data, and algorithm input parameter data; the output symbol table data includes 8 bytes of identification data and algorithm output result data.

[0107] In some embodiments of the device, the processing module 160 is further configured to parse the input symbol table data through the scheduling acceleration module, transmit the data required by the algorithm to the quantum-resistant algorithm system, and receive the output completion signal sent by the quantum-resistant algorithm system, call the scheduling acceleration module to update the status register, and then output the output calculation result to the target address.

[0108] Each module in the aforementioned cryptographic card data processing device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0109] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 7 As shown, the computer device includes a processor, memory, communication interface, display screen, and input device connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage medium. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When executed by the processor, the computer program implements a cryptographic card data processing method.

[0110] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0111] Based on the foregoing description of the relevant methods and apparatus embodiments, this disclosure also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, it implements the password card data processing method described in any embodiment of this specification.

[0112] Based on the foregoing description of the relevant methods and apparatus embodiments, this disclosure also provides a computer-readable storage medium that, when the instructions in the computer-readable storage medium are executed by the processor of a computer device, enables the computer device to implement the cryptographic card data processing method as described in any embodiment of this disclosure.

[0113] Based on the foregoing description of the relevant methods and apparatus embodiments, this disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the password card data processing method described in any embodiment of this specification.

[0114] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on its differences from other embodiments. In particular, hardware + program embodiments are relatively simple in description because they are fundamentally similar to method embodiments; relevant parts can be referred to the descriptions in the method embodiments.

[0115] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0116] It should be noted that the apparatus, computer equipment, storage medium, and computer program products described above may also include other implementation methods according to the description of the method embodiments. Specific implementation methods can be found in the description of the relevant method embodiments. Furthermore, new embodiments formed by combinations of features from various methods, apparatuses, devices, and server embodiments still fall within the scope of this disclosure and will not be elaborated upon here.

[0117] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, when implementing one or more of these specifications, the functions of each module can be implemented in the same or different software and / or hardware, or a module that performs the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are merely illustrative. For example, the division of modules or units is only a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling and communication connections between the devices or units shown or described can be implemented through direct and / or indirect coupling / connection, through standard or custom interfaces or protocols, and can be implemented electrically, mechanically, or in other forms.

[0118] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the following claims.

[0119] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope.

Claims

1. A cryptographic card data processing method, characterized by, The method applied to a host chip comprises: establishing a high-speed serial computer expansion bus standard link connection with a field programmable gate array chip, configuring a base address register of the field programmable gate array chip, initializing a direct memory access engine of the field programmable gate array chip, and initializing a scheduling acceleration module of a quantum-resistant algorithm system on the field programmable gate array chip; constructing a descriptor table configured to cooperate with the scheduling acceleration module to perform operations of the quantum-resistant algorithm system; parsing the descriptor table by the scheduling acceleration module, calling the quantum-resistant algorithm system to perform calculation, and outputting a calculation result to a target address.

2. The method of claim 1, wherein, The method of establishing a high-speed serial computer expansion bus standard link connection with a field programmable gate array chip comprises: setting a device type, a data transmission rate, and a channel number of the high-speed serial computer expansion bus standard when power supply and clock of the host chip and the field programmable gate array chip reach a stable state; after resetting the field programmable gate array chip, initiating a link connection request with the field programmable gate array chip; if it is detected that the link connection with the field programmable gate array chip is normal, determining that the connection is correct and continuing to run; otherwise, terminating the link connection process.

3. The method of claim 2, wherein, The method of configuring a base address register of the field programmable gate array chip, initializing a direct memory access engine of the field programmable gate array chip, and initializing a scheduling acceleration module of a quantum-resistant algorithm system on the field programmable gate array chip comprises: under the condition that the link connection is normal, configuring the base address register of the field programmable gate array chip, setting an address conversion unit address, and mapping a direct memory access configuration space and a quantum-resistant algorithm system address space; performing register initialization operations on the direct memory access engine and the scheduling acceleration module of the quantum-resistant algorithm system mapped by the base address register through the high-speed serial computer expansion bus standard link.

4. The method of claim 1, wherein, The method of constructing a descriptor table comprises: initializing descriptor table data in a storage space, the descriptor table data comprising input symbol table data and output symbol table data; calling the direct memory access engine to transmit the input symbol table data to the scheduling acceleration module, and determining a calculation completion state by reading a scheduling acceleration module register; if the calculation completion state is that the calculation is completed, calling the direct memory access engine to transmit the output symbol table data to the storage space.

5. The method of claim 4, wherein, The input symbol table data comprises 4 bytes of control data, 4 bytes of data length information, 8 bytes of identification data, and algorithm input parameter data; The output symbol table data comprises 8 bytes of identification data and algorithm output result data.

6. The method of claim 4, wherein, The method of parsing the descriptor table by the scheduling acceleration module, calling the quantum-resistant algorithm system to perform calculation, and outputting a calculation result to a target address comprises: parsing the input symbol table data by the scheduling acceleration module, and transmitting data required by the algorithm to the quantum-resistant algorithm system; The output completion signal transmitted by the anti-quantum algorithm system is received, and the calculation result output by the scheduling acceleration module after updating the state register is output to a target address.

7. A cryptographic card data processing apparatus, characterized by comprising: The device comprises: A link connection module is configured to establish a high-speed serial computer expansion bus standard link connection with a field programmable gate array chip, configure a base address register of the field programmable gate array chip, initialize a direct memory access engine of the field programmable gate array chip, and initialize and set a scheduling acceleration module of an anti-quantum algorithm system on the field programmable gate array chip; A symbol table construction module is configured to construct a descriptor table configured to cooperate with the scheduling acceleration module to execute operations of the anti-quantum algorithm system; A processing module is configured to parse the descriptor table by the scheduling acceleration module, call the anti-quantum algorithm system to execute calculation, and output a calculation result to a target address.

8. A computer device, comprising: A memory stores a computer program, and a processor executes the computer program to implement the steps of the method in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, A computer program is stored thereon, and the computer program is executed by a processor to implement the steps of the method in any one of claims 1 to 6.

10. A computer program product, characterised in that, A computer program is stored thereon, and the computer program is executed by a processor to implement the steps of the method in any one of claims 1 to 6.

Images