High-performance password processing architecture and system based on multi-dimensional resource scheduling

Abstract

The invention discloses a high-performance password processing architecture and system based on multi-dimensional resource scheduling, and relates to the technical field of information security, the high-performance password processing architecture comprises a front-end management module, a password operation module and a main control module; according to the method, the working process is statically bound to the exclusive CPU core, cache failure and context switching overhead caused by cross-core scheduling are remarkably reduced, the competition bottleneck of a statistical module based on a lock mechanism under multi-thread concurrence is eliminated through the design of the lock-free atomic counter for cache alignment, and the service life of the statistical module is prolonged. Efficient updating of the counter is achieved through the atomic instruction, pseudo sharing and lock competition are avoided, transaction statistics can accurately feed back the system state in real time, and reliable data support is provided for scheduling decision making; meanwhile, by introducing a multi-listening socket technology, the performance limitation of a single-socket network model is broken through, and by configuring a plurality of listening sockets and optimizing buffer area and queue parameters, timely response and efficient processing of massive short connection requests are ensured.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to a high-performance cryptographic processing architecture and system based on multi-dimensional resource scheduling. It particularly focuses on achieving a performance leap in cryptographic processing devices under high-concurrency scenarios through techniques such as multi-process CPU core binding, cache-aligned lockless atomic counters, and multi-listening sockets. Background Technology

[0002] In critical sectors such as financial transactions, communication transmission, and energy dispatch, cryptographic processing equipment is a core component for ensuring data security, undertaking important responsibilities such as data encryption, authentication, and integrity verification. With the rapid development of the digital economy, the volume of business data is growing exponentially, placing stringent demands on the computing power density, concurrency capabilities, and response speed of cryptographic processing equipment. Traditional cryptographic processing equipment is gradually revealing various performance bottlenecks when dealing with high-load business. Inefficient CPU resource utilization: While some existing cryptographic processing devices employ a multi-process architecture, they lack a fine-grained binding mechanism between processes and CPU cores. Frequent switching between CPU cores during process execution leads to cache invalidation and a surge in context switching overhead, severely restricting the effective release of CPU computing power and making it difficult to meet the demands of high-density cryptographic operations. The transaction statistics module is inefficient: Traditional statistics modules generally use lock-based counters to count business volume. In multi-threaded concurrent scenarios, the resource consumption caused by lock contention becomes a performance bottleneck, making it impossible to provide real-time and accurate feedback on business processing status and affecting the efficiency of system scheduling decisions. Network service architecture bottleneck: Most cryptographic processing devices adopt a single listening socket network model. When faced with massive concurrent connections (especially short connection requests), request queuing and processing delays are likely to occur, which becomes a key bottleneck restricting the data interaction between the device and external systems.

[0003] To address the aforementioned technical deficiencies, a solution is proposed. Summary of the Invention

[0004] The purpose of this invention is to provide a high-performance cryptographic processing optimization scheme and system based on multi-process CPU core binding, cache-aligned lock-free atomic counters, and multi-listening sockets. This solution addresses the performance shortcomings of existing devices in terms of CPU resource utilization, business statistics efficiency, and network communication capabilities, thereby improving the computing throughput, concurrent processing capabilities, and real-time response speed of cryptographic processing devices and meeting the needs of key fields for high-density cryptographic operations.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: a high-performance cryptographic processing architecture and system based on multi-dimensional resource scheduling, including a front-end management module, a cryptographic operation module, and a main control module; The front-end management module is the core interface for user interaction. It is operated through a management page accessible by a browser and is responsible for system configuration, status monitoring and switching. It also has a dual-state management mechanism, including management state and working state, and provides device status visualization monitoring function. The cryptographic operation module is responsible for performing various cryptographic operations. It achieves efficient startup and operation through multi-process CPU core binding, cache-aligned lock-free atomic counters, and multi-listening socket technology. The main control module is responsible for coordinating the collaborative work of various modules to ensure the overall stable operation of the system. Its functions include key shared memory creation, message queue creation, algorithm detection, starting the key management module, starting the log module, starting the cryptographic operation module, and switching working states.

[0006] Furthermore, this system also includes a key management module and a log module; The key management module is responsible for the entire lifecycle management of keys, and its functions include key generation, key storage, key query, and key deletion. The logging module is responsible for recording all system operations and events to ensure traceability and security. Its core functions include logging, logging export, and logging query.

[0007] Furthermore, the management state is the default state entered after the system starts up, supporting all management operations, including network interface settings, access policy configuration, and key import. The working state is manually entered through the running state switch on the management page. Once entered, all management operations are frozen, and only the permission to view the system status is retained to prevent accidental changes to the configuration during operation and to ensure the stability of the encrypted environment.

[0008] Furthermore, the device status visualization monitoring function is used to display the system status in real time on the management page and present data information in the form of charts.

[0009] Furthermore, the startup and workflow of the cryptographic operation module are as follows: S11. The main process first connects to the key-shared memory and creates multiple listening sockets. S12. The main process creates a corresponding number of worker processes based on the number of CPU cores. S13. The worker process is bound to the specified CPU core, and a thread pool is created; S14. The worker processes listen for new connection requests from different listening sockets; S15. When a new connection request is detected, add it to the EPOLL listening queue, resolve the business IP, and bind it to a lock-free atomic counter structure in the hash bucket of the transaction statistics module. S16. When a business request is received, the business IP is parsed, and the corresponding cryptographic operation is performed according to the message header information. The corresponding lockless atomic counter structure in the hash bucket is found through the business IP, and the transaction information is recorded. Finally, the operation result is returned as a response.

[0010] Furthermore, the multi-process CPU core binding is used to adopt a process-core static binding strategy: for the core business of cryptographic operations, worker processes are dynamically created according to the number of CPU cores in the device, and each worker process is bound to a dedicated CPU core through system calls.

[0011] Furthermore, the cache-aligned lock-free atomic counter is used to design a cache-aligned lock-free counter structure using lock-free atomic operation technology. Each counter is size-aligned with the CPU cache through padding, and the counter value is atomically updated through atomic instructions, avoiding lock contention between threads or processes.

[0012] Furthermore, the multi-listening socket technology is used in high-performance cryptographic systems. The cryptographic module creates multiple listening sockets, configures reasonable receive buffer sizes and connection queue lengths, and optimizes socket performance. The worker process receives new connection requests through different listening sockets, ensuring that short connection requests are processed promptly and efficiently, effectively overcoming the performance bottleneck of single-socket listening and significantly improving network communication performance.

[0013] Furthermore, the hash bucket is used to store the lock-free counter structure. Each structure corresponds to a client IP information. A hash algorithm is used to perform hash calculation on the transaction system IP to determine its storage location in the hash bucket.

[0014] Furthermore, the transaction statistics module is used to locate the corresponding hash bucket and lock-free counter based on the client IP using a hash algorithm when a transaction occurs, and to update the counter by incrementing or decrementing it using atomic operations, thereby realizing real-time statistics of transaction data.

[0015] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are: This high-performance cryptographic processing architecture and system based on multi-dimensional resource scheduling significantly reduces cache invalidation and context switching overhead caused by cross-core scheduling by statically binding worker processes to dedicated CPU cores, thereby maximizing the utilization efficiency of CPU computing power and the throughput of cryptographic operations. Furthermore, through a cache-aligned lock-free atomic counter design, the bottleneck of competition in multi-threaded concurrency of the statistics module based on the lock mechanism is eliminated. The efficient updating of the counter is achieved through atomic instructions, avoiding false sharing and lock contention, enabling transaction statistics to provide real-time and accurate feedback on the system status, providing reliable data support for scheduling decisions. At the same time, by introducing multi-listening socket technology, the performance limitations of the single-socket network model are broken. By configuring multiple listening sockets and optimizing buffer and queue parameters, timely response and efficient processing of massive short connection requests are ensured, greatly improving the system's network communication concurrency capability and overall response speed. These technologies work together to affect all key aspects of the cryptographic processing architecture, not only significantly enhancing the stability and reliability of the system under high load scenarios, but also comprehensively improving computing density, concurrency processing capability, and real-time performance. Attached Figure Description

[0016] Figure 1 A schematic diagram of the system of the present invention is shown; Figure 2 The flowchart of the cryptographic operation module of the present invention is shown; Figure 3 The system startup flowchart of the present invention is shown. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Example: like Figure 1-3 As shown, a high-performance cryptographic processing architecture and system based on multi-dimensional resource scheduling is presented. First, the main control module is responsible for coordinating the collaborative work of various modules to ensure the overall stable operation of the system. Its functions include key shared memory creation, message queue creation, algorithm detection, starting the key management module, starting the log module, starting the cryptographic operation module, and switching working states.

[0019] Then, the cryptographic operation module is responsible for performing various cryptographic operations. It achieves efficient startup and operation through multi-process CPU core binding, cache-aligned lock-free atomic counters, and multi-listening socket technology. It should be noted that the multi-process CPU core binding uses a static process-core binding strategy: for the core business of cryptographic operations, worker processes are dynamically created based on the number of CPU cores on the device. Each worker process is bound to a dedicated CPU core through system calls (such as `sched_setaffinity` in Linux). This mechanism reduces cache thrashing caused by cross-core scheduling, improves L1 / L2 cache hit rate, and maximizes single-core computing power utilization.

[0020] Cache-aligned lock-free atomic counters are used to implement lock-free atomic operations. A cache-aligned lock-free counter structure is designed where each counter is size-aligned with the CPU cache through padding, avoiding cross-cache line accesses and eliminating false sharing. Atomic updates of the counter values ​​are achieved through atomic instructions, avoiding lock contention between threads or processes.

[0021] Multi-listening socket technology is used in high-performance cryptographic systems. The cryptographic module creates multiple listening sockets, configuring appropriate receive buffer sizes and connection queue lengths to optimize socket performance. Worker processes receive new connection requests through different listening sockets, ensuring that short connection requests are processed promptly and efficiently. This effectively overcomes the performance bottleneck of single-socket listening and significantly improves network communication performance.

[0022] The startup and workflow of the cryptographic operation module are as follows: S11. The main process first connects to the key-shared memory and creates multiple listening sockets. S12. The main process creates a corresponding number of worker processes based on the number of CPU cores. S13. The worker process is bound to the specified CPU core, and a thread pool is created; S14. The worker processes listen for new connection requests from different listening sockets; S15. When a new connection request is detected, it is added to the EPOLL listening queue, the business IP is resolved, and it is bound to a lock-free atomic counter structure in the hash bucket of the transaction statistics module. It should be noted that the EPOLL mechanism is a high-efficiency I / O event notification mechanism provided by the Linux kernel, designed specifically for high-concurrency network applications. It achieves asynchronous event notification by monitoring the state changes of multiple file descriptors (such as sockets), avoiding the performance bottleneck of traditional polling methods (such as SELECT / POLL).

[0023] The role of the listening queue: In the cryptographic module, the EPOLL listening queue is used to centrally manage all connection events occurring on the listening sockets (such as new connection arrivals, data readability, etc.). When a worker process receives a new connection request through a listening socket, it adds the request to the EPOLL queue. The kernel is responsible for monitoring the status changes of these events and notifying the worker process to handle them when they occur. S16. Upon receiving a business request, the system parses the business IP and performs corresponding cryptographic operations based on the message header information. It locates the corresponding lock-free atomic counter structure in the hash bucket using the business IP, records the transaction information, and finally returns the operation result as a response. The hash bucket stores the lock-free counter structures, with each structure corresponding to a client IP. An efficient hash algorithm is used to hash the transaction system IP to determine its storage location in the hash bucket, enabling fast lookup and access to the counter. The transaction statistics module, when a transaction occurs, locates the corresponding hash bucket and lock-free counter based on the client IP using a hash algorithm. Atomic operations are used to increment or decrement the counter, achieving real-time transaction data statistics. Due to the lock-free design, multiple threads or processes can operate on different counters simultaneously, significantly improving the concurrency performance of transaction statistics. Finally, the key management module is responsible for the entire key lifecycle management, including key generation, key storage, key query, and key deletion.

[0024] Finally, the core interface for user interaction via the front-end management module is accessed through a browser-based management page. This page handles system configuration, status monitoring, and switching, and features a dual-state management mechanism: management state and working state, providing visualized device status monitoring. The management state is the default state upon system startup, supporting all management operations, including network port settings, access policy configuration, and key import. The working state is manually entered via the running status switch in the management page. Once in the working state, all management operations are frozen, retaining only access to view system status (e.g., CPU utilization, memory usage) to prevent accidental configuration changes and ensure the stability of the encrypted environment. The visualized device status monitoring function displays the system status (e.g., "Management State" or "Working State") in real-time on the management page, presenting data information (e.g., CPU utilization, memory usage) in chart format. Furthermore, the log module is responsible for recording all system operations and events, ensuring traceability and security. Core functions include log recording, log export, and log querying.

[0025] This invention significantly reduces cache invalidation and context switching overhead caused by cross-core scheduling by statically binding the working process to a dedicated CPU core, thereby maximizing the utilization efficiency of CPU computing power and the throughput of cryptographic operations. Furthermore, through a cache-aligned lock-free atomic counter design, the bottleneck of competition in multi-threaded concurrency is eliminated by the lock-based statistics module. The efficient updating of the counter is achieved through atomic instructions, avoiding false sharing and lock contention, enabling transaction statistics to provide real-time and accurate feedback on system status, providing reliable data support for scheduling decisions. At the same time, by introducing multi-listening socket technology, the performance limitations of the single-socket network model are broken. By configuring multiple listening sockets and optimizing buffer and queue parameters, timely response and efficient processing of massive short connection requests are ensured, greatly improving the system's network communication concurrency capability and overall response speed. These technical means work together to affect all key aspects of the cryptographic processing architecture, not only significantly enhancing the stability and reliability of the system under high load scenarios, but also comprehensively improving computing density, concurrency processing capability, and real-time performance.

[0026] The size of the interval and threshold is set to facilitate comparison. The size of the threshold depends on the amount of sample data and the number of bases set by those skilled in the art for each set of sample data; as long as it does not affect the ratio between the parameter and the quantized value.

[0027] The above formulas are all dimensionless calculations. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters in the formulas are set by those skilled in the art according to the actual situation. The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A high-performance cryptographic processing architecture and system based on multi-dimensional resource scheduling, characterized in that, It includes a front-end management module, a cryptographic operation module, and a main control module; The front-end management module is the core interface for user interaction. It is operated through a management page accessible by a browser and is responsible for system configuration, status monitoring and switching. It also has a dual-state management mechanism, including management state and working state, and provides device status visualization monitoring function. The cryptographic operation module is responsible for performing various cryptographic operations. It achieves efficient startup and operation through multi-process CPU core binding, cache-aligned lock-free atomic counters, and multi-listening socket technology. The main control module is responsible for coordinating the collaborative work of various modules to ensure the overall stable operation of the system. Its functions include key shared memory creation, message queue creation, algorithm detection, starting the key management module, starting the log module, starting the cryptographic operation module, and switching working states.

2. The high-performance cryptographic processing architecture and system based on multi-dimensional resource scheduling according to claim 1, characterized in that, This system also includes a key management module and a log module; The key management module is responsible for the entire lifecycle management of keys, and its functions include key generation, key storage, key query, and key deletion. The logging module is responsible for recording all system operations and events to ensure traceability and security. Its core functions include logging, logging export, and logging query.

3. The high-performance cryptographic processing architecture and system based on multi-dimensional resource scheduling according to claim 1, characterized in that, The management state is the default state entered after system startup, supporting all management operations, including network interface settings, access policy configuration, and key import. The working state is manually entered through the running state switch on the management page. Once entered, all management operations are frozen, and only the permission to view the system status is retained to prevent accidental changes to the configuration during operation and to ensure the stability of the encrypted environment.

4. The high-performance cryptographic processing architecture and system based on multi-dimensional resource scheduling according to claim 1, characterized in that, The device status visualization monitoring function is used to display the system status in real time on the management page and present data information in the form of charts.

5. The high-performance cryptographic processing architecture and system based on multi-dimensional resource scheduling according to claim 1, characterized in that, The startup and workflow of the cryptographic operation module are as follows: S11. The main process first connects to the key-shared memory and creates multiple listening sockets. S12. The main process creates a corresponding number of worker processes based on the number of CPU cores. S13. The worker process is bound to the specified CPU core, and a thread pool is created; S14. The worker processes listen for new connection requests from different listening sockets; S15. When a new connection request is detected, add it to the EPOLL listening queue, resolve the business IP, and bind it to a lock-free atomic counter structure in the hash bucket of the transaction statistics module. S16. When a business request is received, the business IP is parsed, and the corresponding cryptographic operation is performed according to the message header information. The corresponding lockless atomic counter structure in the hash bucket is found through the business IP, and the transaction information is recorded. Finally, the operation result is returned as a response.

6. The high-performance cryptographic processing architecture and system based on multi-dimensional resource scheduling according to claim 1, characterized in that, The multi-process CPU core binding is used to adopt a process-core static binding strategy: for the core business of cryptographic operations, worker processes are dynamically created according to the number of CPU cores in the device, and each worker process is bound to a dedicated CPU core through system calls.

7. A high-performance cryptographic processing architecture and system based on multi-dimensional resource scheduling according to claim 1, characterized in that, The cache-aligned lock-free atomic counter is designed using lock-free atomic operation technology. Each counter is aligned to the CPU cache size by padding, and the counter value is atomically updated through atomic instructions, avoiding lock contention between threads or processes.

8. The high-performance cryptographic processing architecture and system based on multi-dimensional resource scheduling according to claim 1, characterized in that, The multi-listening socket technology is used in high-performance cryptographic systems. The cryptographic module creates multiple listening sockets, configures appropriate receive buffer sizes and connection queue lengths, and optimizes socket performance. The worker process receives new connection requests through different listening sockets, ensuring that short connection requests are processed promptly and efficiently, effectively overcoming the performance bottleneck of single-socket listening and significantly improving network communication performance.

9. A high-performance cryptographic processing architecture and system based on multi-dimensional resource scheduling according to claim 5, characterized in that, The hash bucket is used to store the lock-free counter structure. Each structure corresponds to a client IP information. The transaction system IP is hashed using a hash algorithm to determine its storage location in the hash bucket.

10. A high-performance cryptographic processing architecture and system based on multi-dimensional resource scheduling according to claim 5, characterized in that, The transaction statistics module is used to locate the corresponding hash bucket and lock-free counter based on the client IP when a transaction occurs, and to update the counter by incrementing or decrementing it using atomic operations, so as to realize real-time statistics of transaction data.

Images