Network card hardware function configuration method based on software definition

Abstract

The invention discloses a network card hardware function configuration method based on software definition, which belongs to the technical field of network security, and comprises the following steps: monitoring logic layer and physical layer characteristics generated when a network card processes a data stream, comparing the logic layer and physical layer characteristics with a normal behavior baseline, and triggering defense reconstruction when deviation occurs; an evolution reference sample set is generated according to the abnormal traffic, and initial hardware logic configuration is retrieved and combined from a hardware module library according to the threat type; iteratively optimizing and testing the configuration in an evolution sandbox isolated in the network card to generate a superior hardware logic configuration; extracting a dynamic session state from the current main path hardware and transferring the dynamic session state to a superior configuration; and during the operation period of the superior configuration, the idle programmable logic unit is driven to execute randomization calculation to generate coverage physical noise, so that adaptive hardware-level precise defense for unknown threats can be realized, the service continuity and the line speed processing performance are guaranteed, and meanwhile, the protection capability for bypass channel attacks is enhanced.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a software-defined network interface card (NIC) hardware function configuration method. Background Technology

[0002] With the rapid development of network technology, network security threats have become increasingly diverse, complex, and dynamic. Smart network interface cards (NICs), especially those based on Field-Programmable Gate Arrays (FPGAs), have become key components in building next-generation network infrastructure and security devices due to their high-performance data processing capabilities and reconfigurable hardware logic. They allow network and security functions originally handled by the host CPU to be offloaded to the NIC hardware, thereby freeing up CPU resources and enabling line-speed network packet processing.

[0003] Chinese patent publication number CN113965373A discloses a data exchange method based on a smart network interface card (NIC) and a server. The method includes: when the host machine sends data, it selects an encryption algorithm to encrypt the data; the encrypted data is divided into first encrypted data and second encrypted data, which are sent to a first smart NIC and a second smart NIC respectively; the first smart NIC sends a second key and a second random number generated by the second smart NIC to the server; the second smart NIC sends the first key and the first random number generated by the first smart NIC to the server; after receiving the data sent by the first and second smart NICs, the server decrypts and reassembles the data, and then decrypts it again using the encryption algorithm. This invention sends the two keys through different NIC links; the key of one NIC link is used to decrypt encrypted data on the other NIC link, and the key positions in the links are randomly assigned, greatly reducing the risk of key leakage.

[0004] In existing technologies, solutions for improving network security performance using smart network interface cards (NICs) typically focus on hardware acceleration. For example, fixed firewall rules, access control lists (ACLs), or partial signature matching logic for intrusion detection are embedded into FPGAs to improve the processing efficiency of specific security functions. Other solutions utilize software-defined networking (SDN) controllers to perform relatively static functional configurations on the NICs, such as outgoing flow table rules. While these methods improve performance to some extent, their hardware defense logic is usually pre-designed and compiled, resulting in relatively fixed functionality.

[0005] However, existing technical solutions have significant drawbacks. First, their hardware defense logic is static; once deployed, it is difficult to quickly adjust to cope with the constant emergence of new attacks or zero-day vulnerabilities, lacking adaptability to unknown threats. Second, when hardware functions need to be updated, it usually requires reprogramming the FPGA entirely or partially, a time-consuming process that often leads to network card downtime and service interruption. Finally, existing security measures mainly focus on the logical layer of network protocols and data content, lacking effective protection against physical layer side-channel attacks such as power consumption analysis and electromagnetic radiation analysis. Summary of the Invention

[0006] To address the aforementioned issues, this invention provides a software-defined network interface card (NIC) hardware function configuration method. This method employs real-time monitoring of logical and physical layer characteristics, generates hardware defense logic based on abnormal traffic evolution, and seamlessly migrates session states to the new logic for deployment. This approach enables adaptive, hardware-level, precise defense against unknown threats while ensuring line-speed processing capabilities and service continuity.

[0007] The above objectives can be achieved through the following approach: A software-defined network interface card (NIC) hardware function configuration method includes: Monitor the logical and physical layer characteristics generated when the network card processes network data streams, and generate real-time characteristic data; The real-time feature data is compared with the baseline model used to characterize normal network traffic behavior. When the real-time feature data deviates, the defense reconstruction process is triggered to generate an abnormal traffic mirror containing network data for that period. The abnormal traffic mirroring is processed using a software analysis model to generate an evolutionary reference sample set containing input data and expected defense action tags; Based on the characteristic deviation type that triggers the defense reconfiguration process, the initial hardware logic configuration is retrieved and combined from the hardware functional module library containing multiple basic functional units. The initial hardware logic configuration is loaded into the physically isolated evolution sandbox area inside the network card, and the initial hardware logic configuration is iteratively adjusted within the constraint space defined by electrical safety rules to generate the adjusted hardware logic configuration. The adjusted hardware logic configuration is functionally fitted using an evolutionary reference sample set until a superior hardware logic configuration that functionally meets the requirements of the evolutionary reference sample set is generated. Extract complete dynamic session state information from the main hardware logic that is currently processing business data; Migrate dynamic session state information to the superior hardware logic configuration and seamlessly switch business data flow from the main path hardware logic to the superior hardware logic configuration; During the processing of service data streams by the superior hardware logic configuration, unused programmable logic units within the driver network card perform randomized calculations to generate overlay physical noise.

[0008] Optionally, the monitoring of logical layer and physical layer features generated when the network interface card (NIC) processes network data streams to generate real-time feature data includes: using the protocol parsing engine inside the NIC to extract packet header information and traffic statistics in real time as the logical layer features, wherein the traffic statistics include at least packet forwarding rate and throughput; using on-chip sensors and ring oscillators embedded in the NIC chip to synchronously collect the dynamic power consumption value and critical path timing delay value of the NIC chip at the current moment as the physical layer features; based on a unified hardware clock source, synchronizing the collected logical layer features and physical layer features with a synchronization timestamp; and performing vectorized concatenation and normalization processing on the time-aligned logical layer features and physical layer features to generate the real-time feature data.

[0009] Optionally, the step of comparing the real-time feature data with a baseline model used to characterize normal network traffic behavior, and triggering a defense reconstruction process when the real-time feature data deviates, includes: continuously collecting the logical layer features and the physical layer features, and generating logical layer feature sequences and physical layer feature sequences respectively; generating an initial deviation signal when the logical layer feature sequence or the physical layer feature sequence deviates from the baseline model; performing a time-dimensional correlation analysis on the logical layer feature sequence and the physical layer feature sequence to evaluate the correlation strength between the initial deviation signals and generate a correlation score; and confirming the existence of a threat and triggering the defense reconstruction process when the correlation score exceeds a trigger threshold used to indicate a strong correlation.

[0010] Optionally, the step of processing the abnormal traffic mirror using a software analysis model to generate an evolutionary reference sample set includes: performing deep behavioral analysis on the abnormal traffic mirror to identify and extract potential threat behavior patterns; converting the threat behavior patterns into a structured defense intent description set, which defines the behavioral characteristics to be dealt with and the corresponding handling logic; making judgments on the data in the abnormal traffic mirror according to the defense intent description set, labeling each data unit with the expected defense action tag, and finally forming the evolutionary reference sample set.

[0011] Optionally, the step of retrieving and combining an initial hardware logic configuration from a hardware function module library containing multiple basic functional units based on the feature deviation type that triggers the defense reconfiguration process includes: converting the feature deviation type into a defense function requirement vector; calculating the matching score between the defense function requirement vector and the functional description of each basic functional unit in the hardware function module library; selecting one or more basic functional units with the highest matching score, and connecting the selected basic functional units through a standard bus architecture to form the initial hardware logic configuration.

[0012] Optionally, loading the initial hardware logic configuration into a physically isolated evolution sandbox area within the network interface card (NIC) and iteratively adjusting the initial hardware logic configuration within a constraint space defined by electrical safety rules includes: copying the initial hardware logic configuration and loading it into the evolution sandbox area so that it runs without participating in business data processing; adjusting the logical structure parameters and resource allocation parameters of the initial hardware logic configuration round by round within the evolution sandbox area, and performing functional compliance testing and performance evaluation on the adjusted hardware logic configuration after each round of adjustment; during the iterative adjustment process, constraining the power consumption, timing, and resource usage of the hardware logic configuration according to the electrical safety rules, eliminating hardware logic configurations that do not meet the electrical safety rules, thereby generating an adjusted hardware logic configuration that meets the safety constraints.

[0013] Optionally, the step of using the evolutionary reference sample set to perform a functional fit test on the adjusted hardware logic configuration includes: feeding input data from the evolutionary reference sample set into the adjusted hardware logic configuration to obtain its actual output results; comparing the actual output results with the expected defense action labels in the evolutionary reference sample set to calculate a functional compliance score; and combining the functional compliance score with the processing performance index obtained through time series analysis to generate a comprehensive fitness value, which is used to guide the next round of iterative adjustments.

[0014] Optionally, extracting complete dynamic session state information from the main path hardware logic currently processing business data includes: sending a pause command to the main path hardware logic to stop receiving new session establishment requests, thereby obtaining a static session state snapshot; performing a hardware-level atomic copy operation on the connection state table inside the main path hardware logic used to store all active connection contexts, thereby obtaining a complete copy of the connection state table; and using the complete copy of the connection state table obtained through the atomic copy operation as the dynamic session state information.

[0015] Optionally, the step of migrating the dynamic session state information to the superior hardware logic configuration and seamlessly switching the service data stream from the main path hardware logic to the superior hardware logic configuration includes: parsing the dynamic session state information, mapping it, and writing it into the corresponding register file and on-chip memory block inside the superior hardware logic configuration to complete state recovery; after the state recovery is completed, activating the input buffer queue located at the front end of the data path to temporarily store the service data packets arriving at this moment to prevent data loss; sending a switching signal to the data path selector to point the exit of the data stream to the input port of the superior hardware logic configuration; and releasing the service data packets temporarily stored in the input buffer queue to the superior hardware logic configuration to complete the seamless switching of the service data stream.

[0016] Optionally, the unused programmable logic unit within the network card performs randomized calculations to generate overlay physical noise, including: after the service data stream switch, initiating a periodic logic obfuscation operation on the winning hardware logic configuration to continuously change its physical characteristics; loading a noise generator circuit for generating pseudo-random sequences into the unused programmable logic unit within the network card; activating the noise generator circuit to generate high-frequency randomized calculations, thereby generating the overlay physical noise.

[0017] Optionally, the periodic logic obfuscation operation on the winning hardware logic configuration includes: identifying auxiliary logic paths in the winning hardware logic configuration that do not directly affect its final defense judgment result; and periodically adjusting the contents of the lookup table or the physical routing path of the signal in the auxiliary logic path according to the obfuscation strategy, so as to change its power consumption characteristics while maintaining functional equivalence.

[0018] Compared with the prior art, the present invention has the following advantages: This invention achieves closed-loop adaptive response to threats at the network interface card (NIC) hardware level. It can monitor specific attack characteristics in real time, dynamically generate and deploy highly customized hardware defense logic, and overcome the limitations of traditional general defense strategies. It realizes precise targeted defense against new or variant attacks, and improves the flexibility of the network security system and its ability to respond to unknown threats.

[0019] This invention integrates the entire process of hardware function generation, testing, and deployment into the network interface card (NIC), enabling line-speed updates and switching of defense capabilities. Through a seamless state transition mechanism, it ensures uninterrupted business data flow during defense logic upgrades, solving the performance bottlenecks caused by data path detours in traditional software security solutions and service interruptions during hardware updates. It guarantees service continuity in high-throughput and low-latency network environments.

[0020] This invention proposes a defense-in-depth strategy that considers both the logic and physical layers. By fusing logic layer traffic characteristics and physical layer chip characteristics for threat assessment, the accuracy of anomaly detection is improved and the false alarm rate is reduced. Furthermore, after deploying new defense logic, it proactively utilizes idle hardware resources to generate comprehensive physical noise, actively strengthening the physical security of the hardware. This enables it to resist attacks based on power consumption, electromagnetic radiation, and other bypass channels, thus constructing a more comprehensive security barrier. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a schematic diagram of the method flow of the present invention; Figure 2 This is a schematic diagram illustrating the feature monitoring and baseline deviation trend of the present invention; Figure 3 This is a schematic diagram illustrating the fitness trend of the hardware logic iterative optimization in this invention. Figure 4 This is a schematic diagram illustrating the trend of physical noise generation and coverage effect in this invention. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] A software-defined network interface card (NIC) hardware function configuration method includes: Monitor the logical and physical layer characteristics generated when the network card processes network data streams, and generate real-time characteristic data; The real-time feature data is compared with the baseline model used to characterize normal network traffic behavior. When the real-time feature data deviates, the defense reconstruction process is triggered to generate an abnormal traffic mirror containing network data for that period. The abnormal traffic mirroring is processed using a software analysis model to generate an evolutionary reference sample set containing input data and expected defense action tags; Based on the characteristic deviation type that triggers the defense reconfiguration process, the initial hardware logic configuration is retrieved and combined from the hardware functional module library containing multiple basic functional units. The initial hardware logic configuration is loaded into the physically isolated evolution sandbox area inside the network card, and the initial hardware logic configuration is iteratively adjusted within the constraint space defined by electrical safety rules to generate the adjusted hardware logic configuration. The adjusted hardware logic configuration is functionally fitted using an evolutionary reference sample set until a superior hardware logic configuration that functionally meets the requirements of the evolutionary reference sample set is generated. Extract complete dynamic session state information from the main hardware logic that is currently processing business data; Migrate dynamic session state information to the superior hardware logic configuration and seamlessly switch business data flow from the main path hardware logic to the superior hardware logic configuration; During the processing of service data streams by the superior hardware logic configuration, unused programmable logic units within the driver network card perform randomized calculations to generate overlay physical noise.

[0025] Specifically, refer to Figure 1 As shown, by integrating the logical layer characteristics of network data flow with the physical layer characteristics of hardware operation, a multi-dimensional real-time perception capability for the network interface card (NIC) operating status is established. When the monitored real-time status deviates from the preset normal behavior baseline, a dynamic reconstruction process is automatically triggered. This process performs in-depth offline analysis of abnormal traffic to generate a "target blueprint" that defines the expected defense behavior, i.e., an evolutionary reference sample set. Then, based on the threat type, hardware defense logic is initially combined from the module library and placed in a secure hardware sandbox environment for iterative evolution. By repeatedly using the aforementioned "target blueprint," the evolving hardware logic is functionally fitted and screened until a superior hardware logic configuration that fully matches the defense requirements is generated. Finally, through seamless state transition and data flow switching technology, the newly generated hardware defense logic is put into actual use, and during its operation, idle hardware resources are used to generate physical noise, completing a complete closed loop from threat perception to hardware self-evolution generation, and then to security deployment and physical layer hardening.

[0026] By enabling autonomous threat perception, analysis, hardware logic generation, and deployment within the network interface card (NIC) hardware, highly customized hardware defense functions can be dynamically generated and deployed to address specific threats appearing in the current network. This achieves a shift from general defense to precise targeted defense, enhancing the ability to respond to unknown attacks and zero-day vulnerabilities. The entire defense reconstruction and switching process is completed at high speed at the NIC hardware level, avoiding the performance bottlenecks caused by data path detours in traditional software-defined security solutions. This ensures line-speed performance and extremely low latency for business processing. At the same time, its seamless switching mechanism ensures that existing network connections and business services are not interrupted during the upgrade and replacement of the defense system, guaranteeing business continuity. Furthermore, by actively generating overlay physical noise, it provides a physical security barrier for the defense logic, improving the ability to resist advanced physical attacks such as bypass channel analysis.

[0027] Optionally, the monitoring of logical layer and physical layer features generated when the network interface card (NIC) processes network data streams to generate real-time feature data includes: using the protocol parsing engine inside the NIC to extract packet header information and traffic statistics in real time as the logical layer features, wherein the traffic statistics include at least packet forwarding rate and throughput; using on-chip sensors and ring oscillators embedded in the NIC chip to synchronously collect the dynamic power consumption value and critical path timing delay value of the NIC chip at the current moment as the physical layer features; based on a unified hardware clock source, synchronizing the collected logical layer features and physical layer features with a synchronization timestamp; and performing vectorized concatenation and normalization processing on the time-aligned logical layer features and physical layer features to generate the real-time feature data.

[0028] Specifically, by constructing a time-synchronized and multimodal real-time feature data vector, this vector can accurately characterize the overall operating status of the network interface card (NIC) when processing network data streams. Through parallel extraction of logical layer features, the protocol parsing engine integrated within the NIC examines network data packet by packet at linear speed, parsing key packet header information such as source and destination IP addresses, port numbers, and protocol types. Simultaneously, traffic statistics are accumulated and calculated within a preset statistical period, such as 10 to 100 milliseconds, forming a logical layer feature set including packet forwarding rate and throughput. At the same time, physical layer features are collected synchronously. Multiple on-chip sensor arrays and a ring oscillator network embedded in the NIC chip are polled at high frequency, with sampling frequencies typically set between 500 kHz and 5 MHz, to capture the chip's instantaneous dynamic power consumption and timing delays on critical signal paths. These raw readings collectively constitute the physical layer feature set. To ensure absolute alignment between logical layer features and physical layer features in the time dimension, a unified hardware clock source is used. This clock source drives a high-precision timestamp counter. Whenever a logical layer feature statistical period ends or a physical layer feature sampling is completed, the current timestamp counter value is immediately appended to the corresponding feature set, marking the synchronization timestamp. In the subsequent data processing stage, logical layer features and physical layer features are aligned and merged based on the synchronization timestamp. Specifically, frequently sampled physical layer features are aggregated within the logical layer statistical period (e.g., by taking the average or maximum value), and then vectorized and concatenated with the logical layer features within that period. To eliminate the influence of different feature dimensions, the concatenated original feature vector is normalized to generate the final real-time feature data. The normalization process can use the min-max normalization algorithm, and its calculation formula is as follows: in, F norm Represents the normalized eigenvalues. F raw These are the original eigenvalues ​​in the concatenated vector. F min and F max These represent the minimum and maximum values ​​recorded during the normal operation calibration phase of that dimension feature, respectively, and are called as fixed scaling reference parameters.

[0029] Optionally, the step of comparing real-time feature data with a baseline model used to characterize normal network traffic behavior, and triggering a defense reconstruction process when the real-time feature data deviates, includes: continuously collecting the logical layer features and the physical layer features, and generating logical layer feature sequences and physical layer feature sequences respectively; generating an initial deviation signal when the logical layer feature sequence or the physical layer feature sequence deviates from the baseline model; performing a time-dimensional correlation analysis on the logical layer feature sequence and the physical layer feature sequence to evaluate the correlation strength between the initial deviation signals and generate a correlation score; and confirming the existence of a threat and triggering the defense reconstruction process when the correlation score exceeds a trigger threshold used to indicate a strong correlation.

[0030] Specifically, refer to Figure 2 As shown, by analyzing the anomalies in the logical and physical layers of network data streams, misjudgments caused by single-dimensional data disturbances are avoided. Within a preset sliding time window, such as a window containing 128 consecutive sampling points, real-time feature data generated in the preceding steps needs to be continuously collected to simultaneously construct logical and physical layer feature sequences. These two sequences are time-series vectors of equal length, providing a foundation for subsequent correlation analysis. These two feature sequences are then input into their respective baseline models for comparison. The baseline model is a multivariate Gaussian mixture model pre-established through long-term learning of normal network traffic behavior. It defines the distribution center and covariance of feature vectors under normal conditions. The baseline model is a behavioral representation model built by learning from historical data under normal network operation conditions. It is used to characterize the statistical relationship between logical layer features and physical layer features under normal conditions. The baseline model can be a statistical model or a machine learning model, and it at least includes a set of parameters describing the joint distribution of the logical layer features and physical layer features. In this embodiment, the baseline model can be constructed using a multivariate Gaussian mixture model. The construction process of the baseline model includes: normalizing the collected feature data and determining model parameters to describe the normal operation state based on the processed feature data. In subsequent operation, the model parameters can be updated based on newly added feature data that has been determined to be normal, but this invention is not limited to this. When the Mahalanobis distance of the logical layer feature sequence or physical layer feature sequence within a certain time window exceeds the confidence boundary of its corresponding model, for example, three times the standard deviation, an initial deviation signal is generated, marking that this dimension is abnormal. Upon detecting any initial deviation signal, a time-dimensional correlation analysis will be immediately initiated to confirm the root cause of the anomaly rather than transient noise. This analysis quantifies the coupling strength between the logic layer characteristic sequence and the physical layer characteristic sequence within the same time window, and a normalized cross-correlation function can be used to calculate the correlation score. This calculation process evaluates the impact of introducing a time offset on the two sequences. Similarity after The value range is typically between -5 and +5 sampling periods, used to capture the minute time difference between the logical and physical manifestations of attack behavior. The formula for calculating the correlation score S is as follows: in, Represents the time offset, while It is a logical layer feature sequence L With physical layer feature sequence P The cross-correlation function between the two sequences is calculated and normalized by calculating the covariance of the two sequences at different time offsets, resulting in a dimensionless correlation coefficient. Finally, the calculated correlation score is used to... S The correlation score is compared to a preset trigger threshold, which is set based on empirical security strategies and is typically between 0.75 and 0.9. S Exceeding this trigger threshold indicates a strong correlation between the abnormal phenomena in the logical layer and the physical layer, which is determined to be a real security threat and formally triggers the defense reconstruction process to initiate subsequent dynamic adjustments to hardware functions.

[0031] Optionally, the step of processing the abnormal traffic mirror using a software analysis model to generate an evolutionary reference sample set includes: performing deep behavioral analysis on the abnormal traffic mirror to identify and extract potential threat behavior patterns; converting the threat behavior patterns into a structured defense intent description set, which defines the behavioral characteristics to be dealt with and the corresponding handling logic; making judgments on the data in the abnormal traffic mirror according to the defense intent description set, labeling each data unit with the expected defense action tag, and finally forming the evolutionary reference sample set.

[0032] Specifically, the captured raw anomalous traffic is transformed into a structured and clearly instructive hardware functional verification dataset, namely the evolutionary reference sample set. This dataset provides quantifiable targets and evaluation benchmarks for subsequent hardware logic configuration iterations. Offline deep behavioral analysis is then performed on the generated anomalous traffic image by offloading it from the network interface card (NIC) to a software analysis model in the upper-layer control plane. This software analysis model typically consists of a signature matching engine and a behavioral anomaly detection algorithm library, such as a time-series anomaly detection model based on recurrent neural networks. The model reassembles and decodes the protocols of each data stream in the anomalous traffic image, identifying and extracting potential threat behavior patterns through multi-dimensional feature comparison, such as traffic surge patterns in distributed denial-of-service attacks or vulnerability exploitation fingerprints of specific application-layer protocols. These identified threat behavior patterns are then automatically translated into a structured defense intent description set, which is a machine-readable set of rules, where each rule explicitly defines the behavioral characteristics to be addressed and the expected handling logic. For example, a threat behavior pattern might be transformed into a defensive intent, defined by the behavioral characteristics of "target port UDP 53 and source IP address dispersion exceeding threshold N," with the corresponding handling logic being "dropping packets matching this characteristic." This transformation process concretizes the abstract attack identification result into an executable hardware processing strategy. Using this generated set of defensive intent descriptions as the basis for judgment, each data unit in the abnormal traffic image, typically a single data packet, is iterated and matched one by one. If a data unit matches a rule in the description set, it is labeled with the expected defensive action tag defined by that rule, such as "DROP" or "RATE_LIMIT." Background traffic that does not match any rule is labeled "PASS." After this round of automated labeling, the original abnormal traffic image is processed into an evolutionary reference sample set consisting of pairs of input data and expected defensive action tags, with the structure (data unit i, expected defensive action tag i), providing precise input and expected output for subsequent functional fitting tests of the hardware logic.

[0033] Optionally, the step of retrieving and combining an initial hardware logic configuration from a hardware function module library containing multiple basic functional units based on the feature deviation type that triggers the defense reconfiguration process includes: converting the feature deviation type into a defense function requirement vector; calculating the matching score between the defense function requirement vector and the functional description of each basic functional unit in the hardware function module library; selecting one or more basic functional units with the highest matching score, and connecting the selected basic functional units through a standard bus architecture to form the initial hardware logic configuration.

[0034] Specifically, based on identified threat types, a highly relevant initial hardware logic configuration is quickly and automatically generated from a pre-built hardware functional module library, serving as the baseline for subsequent iterative optimization. First, the feature deviation type that triggers the defense refactoring process is analyzed. This type is a symbolic label representing attack behavior, such as "UDP_FLOOD" or "SYN_SCAN". Using a pre-defined mapping table or a simple rule engine, this symbolic label is converted into a standardized defense function requirement vector. Each dimension of this vector corresponds to a basic defense capability, such as protocol field matching, traffic rate control, or state tracking. Its value, ranging from 0 to 1, represents the degree of demand for that capability. Then, each basic functional unit in the hardware functional module library is traversed. The hardware functional module library contains a collection of pre-verified, reusable hardware IP cores, and each basic functional unit is pre-labeled with a function description vector matching its function. A cosine similarity algorithm is used to calculate the matching score between the defense function requirement vector and each function description vector. M Its calculation formula is: , in, V req It is the defense function requirement vector generated in the previous step. V req It is the functional description vector of the basic functional unit currently being evaluated, and the symbol • represents the vector dot product. Let Euclidean norm represent the vector. This formula calculates... M The value is a dimensionless scalar between 0 and 1, with a value closer to 1 indicating a higher degree of functional matching. All basic functional units are sorted based on the calculated matching score, and one or more basic functional units with scores higher than a preset selection threshold, such as 0.8, are selected. These selected basic functional units are then cascaded using a standard bus architecture, such as the AXI-Stream bus, to form a data processing pipeline. This combined hardware logic entity constitutes the initial hardware logic configuration.

[0035] Optionally, loading the initial hardware logic configuration into a physically isolated evolution sandbox area within the network interface card (NIC) and iteratively adjusting the initial hardware logic configuration within a constraint space defined by electrical safety rules includes: copying the initial hardware logic configuration and loading it into the evolution sandbox area so that it runs without participating in business data processing; adjusting the logical structure parameters and resource allocation parameters of the initial hardware logic configuration round by round within the evolution sandbox area, and performing functional compliance testing and performance evaluation on the adjusted hardware logic configuration after each round of adjustment; during the iterative adjustment process, constraining the power consumption, timing, and resource usage of the hardware logic configuration according to the electrical safety rules, eliminating hardware logic configurations that do not meet the electrical safety rules, thereby generating an adjusted hardware logic configuration that meets the safety constraints.

[0036] Specifically, loading the initial hardware logic configuration into a physically isolated evolution sandbox area within the network interface card (NIC) refers to copying the current hardware logic configuration used for service processing and loading it into an independent hardware execution area located within the NIC. This evolution sandbox area is isolated from the main path logic carrying the service data flow in terms of both hardware resources and data paths. Its operation does not participate in the actual forwarding and processing of service data, thereby avoiding impact on normal services during defense reconstruction. Within the evolution sandbox area, the logical structure parameters and resource allocation parameters of the initial hardware logic configuration are iteratively adjusted. The logical structure parameters at least include the functional module connection relationships and processing flow structure, and the resource allocation parameters at least include the allocation methods for logical units, storage units, and interface resources. After each round of iterative adjustments, the adjusted hardware logic configuration undergoes functional compliance testing and performance evaluation. Based on pre-defined electrical safety rules, the power consumption, timing characteristics, and resource usage of the hardware logic configuration are constrained and judged. Hardware logic configurations that do not meet the safe operating conditions are eliminated, and adjusted hardware logic configurations that meet the electrical safety constraints are generated. The electrical safety rules are used to limit the safe operating conditions of the hardware logic configuration at the physical implementation level, and they include at least power consumption constraints, timing constraints, and hardware resource usage constraints. During the iterative adjustment of the hardware logic configuration, each generated hardware logic configuration is tested according to the aforementioned electrical safety rules. Hardware logic configurations that do not meet the safe operating conditions are not included in subsequent adjustment processes. For example, in a specific implementation scenario, the initial hardware logic configuration is a combination of logical functions currently used for packet parsing and forwarding. First, this initial hardware logic configuration is completely copied and loaded into the evolution sandbox area, allowing it to run in an independent hardware environment. Subsequently, multiple rounds of iterative adjustments are performed on the hardware logic configuration within the evolution sandbox area. In some iterations, the connection order of defense-related functional modules is adjusted, and in others, the allocation ratio of logical units and storage resources is adjusted. After each round of adjustments, the adjusted hardware logic configuration undergoes functional testing to confirm its ability to still perform the intended data processing functions. Simultaneously, performance evaluations are conducted on processing latency and resource consumption. (Refer to...) Figure 3 As shown, if the hardware logic configuration adjusted in a certain round exceeds the preset electrical safety threshold in terms of power consumption or timing characteristics, the hardware logic configuration is determined to be non-compliant with the safety constraints and is eliminated; if it meets the electrical safety rules, it is retained for further adjustments in subsequent rounds or as a candidate adjusted hardware logic configuration.

[0037] Optionally, the step of using the evolutionary reference sample set to perform a functional fit test on the adjusted hardware logic configuration includes: feeding input data from the evolutionary reference sample set into the adjusted hardware logic configuration to obtain its actual output results; comparing the actual output results with the expected defense action labels in the evolutionary reference sample set to calculate a functional compliance score; and combining the functional compliance score with the processing performance index obtained through time series analysis to generate a comprehensive fitness value, which is used to guide the next round of iterative adjustments.

[0038] Specifically, the engineering objective of this embodiment is to quantitatively evaluate the hardware logic configuration after each iteration, and to generate a comprehensive fitness value to guide the optimization direction of the next round. This value integrates the correctness of the defense function and the performance overhead of hardware execution. To this end, a functional fit test is first performed. Input data from the evolutionary reference sample set is continuously fed into the adjusted hardware logic configuration deployed in the evolutionary sandbox through a test stimulus generator using standard interface formats such as AXI-Stream. The hardware logic configuration processes this data at line speed, and the actual output results, such as the decision signal for the disposal of each data packet, are recorded by a result capture module.

[0039] Next, the captured actual output sequence is aligned and compared one by one with the pre-labeled expected defensive action sequences in the evolutionary reference sample set. The functional conformity score is calculated by counting the number of samples that perfectly match. S func The calculation formula is in, N c It is the total number of samples whose actual output matches the expected labels, while N t This represents the total number of samples in the evolutionary reference sample set used in this test. This score is a dimensionless value between 0 and 1, directly reflecting the functional accuracy of the current hardware logic configuration. Simultaneously with the functional evaluation, key processing performance metrics, such as end-to-end latency and the highest achievable clock frequency, are obtained using static timing analysis tools within the FPGA or performance monitors embedded in the test, thereby deriving the throughput. These metrics are normalized to form a performance component. Finally, based on a preset optimization strategy, the functional compliance score and processing performance metrics are weighted and fused to generate a comprehensive fitness value. S adapt The calculation formula is as follows: , in, P norm This represents the normalized overall performance index, while and These are two non-negative weighting coefficients that sum to 1, for example... It can be set to 0.7. Set to 0.3, this value balances the importance of functional correctness and performance. This calculated overall fitness value serves as a feedback signal to the genetic algorithm or reinforcement learning engine driving the iterative adjustments, evaluating the quality of the current solution and determining whether to retain, mutate, or discard the hardware logic configuration in the next iteration.

[0040] Optionally, extracting complete dynamic session state information from the main path hardware logic currently processing business data includes: sending a pause command to the main path hardware logic to stop receiving new session establishment requests, thereby obtaining a static session state snapshot; performing a hardware-level atomic copy operation on the connection state table inside the main path hardware logic used to store all active connection contexts, thereby obtaining a complete copy of the connection state table; and using the complete copy of the connection state table obtained through the atomic copy operation as the dynamic session state information.

[0041] Specifically, to capture the complete context of all active network connections in the current main path hardware logic without interruption, ensuring session continuity during subsequent handover, the control plane sends a precisely timed pause command to the main path hardware logic processing service data. This command is written to the hardware trigger register via a dedicated control bus, causing its internal session management module to immediately stop accepting any new session establishment requests, such as SYN packets in the TCP protocol or the first packet of UDP. This freezes the dynamically changing connection state table into a static session state snapshot within a very short time window, typically 50 to 200 nanoseconds. During this snapshot stabilization period, a hardware-level atomic copy operation is immediately triggered on the connection state table within the main path hardware logic. This connection state table is a dedicated storage block, typically implemented using on-chip BlockRAM, recording the five-tuple information, sequence number, status flags, and other context of all active connections. The atomic copy operation is performed by a built-in micro DMA controller, which reads the entire contents of the storage block within a single clock cycle and writes it to a dedicated dual-port intermediate buffer, thus ensuring absolute temporal consistency and integrity of the copied data. Once this operation is complete, the complete copy of the connection state table obtained from the intermediate cache is formally defined as the dynamic session state information required for this migration and is ready to be sent to the winning hardware logic configuration for state recovery.

[0042] Optionally, the step of migrating the dynamic session state information to the superior hardware logic configuration and seamlessly switching the service data stream from the main path hardware logic to the superior hardware logic configuration includes: parsing the dynamic session state information, mapping it, and writing it into the corresponding register file and on-chip memory block inside the superior hardware logic configuration to complete state recovery; after the state recovery is completed, activating the input buffer queue located at the front end of the data path to temporarily store the service data packets arriving at this moment to prevent data loss; sending a switching signal to the data path selector to point the exit of the data stream to the input port of the superior hardware logic configuration; and releasing the service data packets temporarily stored in the input buffer queue to the superior hardware logic configuration to complete the seamless switching of the service data stream.

[0043] Specifically, by performing a zero-packet-loss service data flow switchover, network traffic is smoothly migrated from the original main path hardware logic to the newly generated superior hardware logic configuration. To achieve this, state recovery is performed first. The control plane parses the dynamic session state information extracted in the previous step, which is essentially a data mirror of the connection state table. According to the address mapping rules of the internal storage structure of the superior hardware logic configuration, each parsed session context is precisely written into its corresponding register file and on-chip memory block via the configuration bus. This writing process is batched and parallel to ensure that state recovery is completed within microseconds. At the instant the state recovery operation is about to complete, to prevent data loss at the critical point of the switchover, an input buffer queue located at the front end of the data path is actively activated. This queue, usually implemented by an on-chip FIFO, begins to temporarily store newly arriving service data packets. Its depth is typically designed to accommodate several maximum transmission unit (MTU) sizes of data to cope with minor delays that may occur during the switchover. Once state recovery is confirmed to be complete, the control plane immediately sends a switchover signal to the data path selector. This data path selector is a high-speed multiplexer hardware module. Upon receiving a switching signal, within one clock cycle, it switches the route of its output port from the input terminal pointing to the main path hardware logic to the input port of the winning hardware logic configuration. Finally, it sends a release command to the input buffer queue, and all service data packets temporarily stored in the queue are immediately read out in sequence and sent to the winning hardware logic configuration, which has completed its state loading and become the new main path, for processing. This series of closely linked actions together completes the seamless switching of service data streams.

[0044] Optionally, the unused programmable logic unit within the network card performs randomized calculations to generate overlay physical noise, including: after the service data stream switch, initiating a periodic logic obfuscation operation on the winning hardware logic configuration to continuously change its physical characteristics; loading a noise generator circuit for generating pseudo-random sequences into the unused programmable logic unit within the network card; activating the noise generator circuit to generate high-frequency randomized calculations, thereby generating the overlay physical noise.

[0045] Specifically, by generating a dynamic and high-entropy physical noise background, the deterministic physical characteristics of the winning hardware logic configuration when processing real business data streams are actively obfuscated and masked, thereby combating bypass attacks based on power consumption or electromagnetic radiation. To achieve this, two parallel physical layer defense actions are immediately initiated after the seamless switching of business data streams. The first is to initiate periodic logic obfuscation operations on the winning hardware logic configuration currently carrying the business. This operation, driven by the control plane at a preset time interval, such as 10 to 500 milliseconds, continuously fine-tunes the non-critical paths within the hardware logic according to a specific obfuscation strategy, so as to continuously change its subtle power consumption and timing characteristics without affecting its core defense functions.

[0046] The second action focuses on generating high-intensity noise using redundant hardware resources. A pre-designed noise generator circuit, typically a high-efficiency linear feedback shift register (LFSR) or a similar pseudo-random sequence generator, is loaded into programmable logic unit areas within the network interface card (NIC) FPGA chip that are not occupied by the superior hardware logic configuration, using dynamic partial reconfiguration technology. These areas are idle during service processing. Once loaded, the noise generator circuit is immediately activated, provided with a high-frequency independent clock source. After activation, its internal logic gates and flip-flops begin performing meaningless but energy-intensive randomization calculations at extremely high frequencies—that is, rapid state transitions. This large-scale, high-frequency logic transition generates significant and irregular power consumption fluctuations and electromagnetic radiation at the chip's physical layer, forming the aforementioned overlay physical noise. This noise is physically superimposed on the logic-obfuscated service processing signal, reducing the signal-to-noise ratio for a bypass attacker to extract effective feature signals, thereby achieving proactive physical layer security hardening.

[0047] Optionally, the periodic logic obfuscation operation on the winning hardware logic configuration includes: identifying auxiliary logic paths in the winning hardware logic configuration that do not directly affect its final defense judgment result; and periodically adjusting the contents of the lookup table or the physical routing path of the signal in the auxiliary logic path according to the obfuscation strategy, so as to change its power consumption characteristics while maintaining functional equivalence.

[0048] Specifically, while maintaining absolute equivalence of core defense functions, the winning hardware logic configuration undergoes dynamic internal structural adjustments, resulting in nondeterministic changes in its physical characteristics such as power consumption and timing to counter side-channel attacks based on physical feature analysis. This process performs sub-static logic analysis on the synthesized netlist file of the winning hardware logic configuration. This analysis, ending with the output signal carrying the final defense judgment result, performs reverse logic analysis to accurately identify all critical logic paths that directly or indirectly affect the final judgment result. All circuits outside this logic cone, such as those used for internal state statistics, debugging interfaces, or redundancy backups, are identified and marked as auxiliary logic paths. Subsequently, a periodic obfuscation controller performs adjustments according to a preset obfuscation strategy. This obfuscation strategy defines the adjustment frequency, such as each random time interval between 10 and 100 milliseconds, and the range of each adjustment, such as randomly selecting 5% to 15% of auxiliary logic paths. For the selected auxiliary logic path, the controller performs one of two adjustments: one is to adjust the contents of the lookup table in the path, for example, replacing one lookup table implementing a specific Boolean function input with another equivalent lookup table implementing the exact same function but with different internal transistor switching modes; the other is to adjust the physical routing path of the signal, that is, to modify the internal wiring resource configuration of the field-programmable gate array through instructions, forcing each signal to switch from a short path to a functionally equivalent but longer physical path. Both adjustments ensure complete equivalence of logic function, but due to changes in capacitive load and transistor switching activity, their power consumption and timing characteristics will undergo measurable changes, as shown in the reference. Figure 4 As shown, this achieves proactive and continuous obfuscation of the hardware physical fingerprint without affecting the defense effect.

[0049] In this embodiment, the present invention is applied to a high-performance smart network interface card (NIC) deployed at the entrance of a financial data center. This smart NIC is responsible for handling the massive network traffic entering and leaving the data center server cluster. Its protection objective is to defend against various network threats, including distributed denial-of-service (DDoS) attacks, while ensuring line-speed processing and low latency for normal financial transactions.

[0050] This test aims to simulate a low-rate, highly stealthy TCPSYNFlood attack to verify the end-to-end response capability of this invention, from threat perception and hardware reconstruction to seamless switching.

[0051] Before the testing began, the smart network interface card (NIC) operated under normal business traffic for 72 hours to establish a stable and reliable baseline model. During this period, logical and physical layer characteristics were continuously monitored.

[0052] Statistics were collected by the protocol parsing engine at 100-millisecond intervals. The average packet forwarding rate (PPS) during normal business hours was 5.2 MPPS, and the average throughput was 8.5 Gbps, with TCP SYN packets accounting for an average of 1.5%.

[0053] The on-chip sensor samples at a frequency of 1MHz, the network card chip's dynamic power consumption is stable at 12.5W when processing normal services, and the average timing delay of critical data paths is 95 nanoseconds.

[0054] The collected data, after being synchronized and normalized, was used to train a multivariate Gaussian mixture model, which defines the distribution center and confidence boundary of the feature vectors under normal conditions (set to 3 times the standard deviation).

[0055] The test begins with a 10-minute low-rate TCPSYNFlood attack injected via a traffic generator. The attack traffic slowly increases the percentage of TCPSYN packets on the target server from 1.5% to 7%.

[0056] The detection showed that the proportion of TCPSYN packets in the logic layer feature sequence began to deviate continuously from the baseline model. At 35 seconds after the attack began, its Mahalanobis distance first exceeded three standard deviations, generating the initial logic layer deviation signal. However, at this time, the packet forwarding rate and throughput were still within the normal fluctuation range, and traditional detection methods based on traffic thresholds could not detect this anomaly. At 36 seconds after the attack began, in the physical layer feature sequence, the chip's dynamic power consumption showed a small but continuous increase of 0.8W, and the timing delay increased by 5 nanoseconds, also exceeding the confidence boundary of the physical layer baseline model, generating the initial physical layer deviation signal.

[0057] Upon receiving two initial deviation signals, a temporal correlation analysis was immediately performed on the logical and physical layer feature sequences of the most recent 128 sampling points (12.8 milliseconds). By calculating the normalized cross-correlation function, the correlation score between the two sequences was found to be 0.87, significantly exceeding the preset strong correlation trigger threshold of 0.80. Based on this, it was determined that the anomalies in the logical and physical layers were strongly correlated, confirming a genuine network attack event, and the defense reconstruction process was immediately triggered. Simultaneously, 500MB of network data, including attack traffic, was captured during this period, generating an abnormal traffic mirror.

[0058]

[0059] The abnormal traffic mirroring was sent to the software analysis model for processing. The model identified the attack pattern as "a flood of SYN packets originating from a large number of spoofed source IP addresses targeting a specific port (TCP / 443)." This pattern was translated into a defensive intent: "Perform source IP verification and connection frequency limiting on all SYN packets sent to TCP / 443, and drop packets that do not conform to the policy." Based on this intent, 1,250,000 packets in the abnormal traffic mirroring were individually labeled to form an evolutionary reference sample set.

[0060] The feature deviation type was identified as "SYN_FLOOD" and converted into a defensive function requirement vector. This vector had the highest matching score (0.92 and 0.89, respectively) with the "State Connection Tracking Module" and "Programmable Rate Limiting Module" in the hardware function module library. These two modules were cascaded via the AXI-Stream bus to form the initial hardware logic configuration.

[0061] The initial hardware logic configuration is loaded into the evolutionary sandbox region, and functional fit testing and iterative adjustments are performed using the evolutionary reference sample set.

[0062]

[0063] After 18 rounds of iteration (total time approximately 800 milliseconds), a winning hardware logic configuration with a comprehensive fitness value of 0.9836 was generated. This configuration can accurately filter 99.8% of attack traffic with a latency of less than 120 nanoseconds, meeting deployment requirements.

[0064] A pause command is sent to the main path hardware logic handling normal business. Through hardware atomic copying, the complete extraction of the connection state table (12MB in size) containing 850,000 active sessions is completed within 180 nanoseconds. This copying process is performed by the hardware logic within the network card. This copying is a parallel data state replication operation, rather than a software copying process executed byte-by-byte by the processor, thus enabling the overall migration of a large volume of state data in a short time. This dynamic session state information is completely written into the superior hardware logic configuration within 6 microseconds. At the critical point of switching, the front-end input buffer queue temporarily stores 15 data packets. Subsequently, the data path selector completes the switch within one clock cycle. The entire switchover process is imperceptible to business traffic, achieving zero packet loss.

[0065] After the switchover is complete, the winning hardware logic configuration immediately initiates periodic logic obfuscation (adjusting the routing of the auxiliary logic path every 200 milliseconds). Simultaneously, it utilizes 25% of the unused programmable logic units on the network card's FPGA to load and activate the noise generator circuit, increasing the random noise floor of the network card's overall power consumption by approximately 180mW, thus increasing the difficulty of bypass channel attacks.

[0066]

[0067] In summary, the data from this embodiment clearly demonstrates that the present invention, when facing covert network attacks, can achieve rapid and accurate detection, automated and efficient hardware defense logic generation, seamless deployment without impacting business operations, and proactive physical layer security hardening after deployment. Compared with traditional security devices, its response time is reduced from minutes to seconds, its defense strategy is upgraded from general rules to targeted hardware logic, and business continuity is fully guaranteed, demonstrating significant technical effectiveness.

[0068] It should be noted that the electrical connections between the various units described above do not necessarily represent direct or indirect connections. Any indirect connection method can be applied to the embodiments of the present invention as long as it achieves the purpose of the present invention. The above are merely exemplary embodiments of the present invention and should not be construed as limiting the scope of the present invention.

[0069] All equivalent changes and modifications made in accordance with the teachings of this invention are still within the scope of this invention. Those skilled in the art will readily conceive of other embodiments of this invention upon considering the specification and the disclosure of practical truth. This application is intended to cover any variations, uses, or adaptations of this invention that follow the general principles of this invention and include common knowledge or conventional techniques in the art not described herein.

Claims

1. A method for configuring network interface card (NIC) hardware functions based on software definition, characterized in that, include: Monitor the logical and physical layer characteristics generated when the network card processes network data streams, and generate real-time characteristic data; The real-time feature data is compared with the baseline model used to characterize normal network traffic behavior. When the real-time feature data deviates, the defense reconstruction process is triggered to generate an abnormal traffic mirror containing network data for that period. The abnormal traffic mirroring is processed using a software analysis model to generate an evolutionary reference sample set containing input data and expected defense action tags; Based on the characteristic deviation type that triggers the defense reconfiguration process, the initial hardware logic configuration is retrieved and combined from the hardware functional module library containing multiple basic functional units. The initial hardware logic configuration is loaded into the physically isolated evolution sandbox area inside the network card, and the initial hardware logic configuration is iteratively adjusted within the constraint space defined by electrical safety rules to generate the adjusted hardware logic configuration. The adjusted hardware logic configuration is functionally fitted using an evolutionary reference sample set until a superior hardware logic configuration that functionally meets the requirements of the evolutionary reference sample set is generated. Extract complete dynamic session state information from the main hardware logic that is currently processing business data; Migrate dynamic session state information to the superior hardware logic configuration and seamlessly switch business data flow from the main path hardware logic to the superior hardware logic configuration; During the processing of service data streams by the superior hardware logic configuration, unused programmable logic units within the driver network card perform randomized calculations to generate overlay physical noise.

2. A method for configuring network interface card (NIC) hardware functions based on software definition according to claim 1, characterized in that, The monitoring involves logical layer and physical layer characteristics generated when the network interface card (NIC) processes network data streams. Generating real-time feature data includes: using the protocol parsing engine inside the network interface card (NIC) to extract packet header information and traffic statistics in real time as the logical layer features, wherein the traffic statistics include at least packet forwarding rate and throughput; using on-chip sensors and ring oscillators embedded in the NIC chip to synchronously collect the dynamic power consumption value and critical path timing delay value of the NIC chip at the current moment as the physical layer features; based on a unified hardware clock source, synchronizing the collected logical layer features and physical layer features with timestamps; and performing vectorized concatenation and normalization processing on the time-aligned logical layer features and physical layer features to generate the real-time feature data.

3. A method for configuring network interface card (NIC) hardware functions based on software definition according to claim 1, characterized in that, The process of comparing the real-time feature data with a baseline model used to characterize normal network traffic behavior, and triggering a defense reconstruction process when the real-time feature data deviates, includes: continuously collecting the logical layer features and the physical layer features, and generating logical layer feature sequences and physical layer feature sequences respectively; generating an initial deviation signal when the logical layer feature sequence or the physical layer feature sequence deviates from the baseline model; performing a time-dimensional correlation analysis on the logical layer feature sequence and the physical layer feature sequence to evaluate the correlation strength between the initial deviation signals and generating a correlation score; and confirming the existence of a threat and triggering the defense reconstruction process when the correlation score exceeds a trigger threshold used to indicate a strong correlation.

4. A method for configuring network interface card (NIC) hardware functions based on software definition according to claim 1, characterized in that, The process of using a software analysis model to process the abnormal traffic mirror to generate an evolutionary reference sample set includes: performing deep behavioral analysis on the abnormal traffic mirror to identify and extract potential threat behavior patterns; converting the threat behavior patterns into a structured defense intent description set, which defines the behavioral characteristics to be dealt with and the corresponding handling logic; making judgments on the data in the abnormal traffic mirror according to the defense intent description set, labeling each data unit with the expected defense action tag, and finally forming the evolutionary reference sample set.

5. A method for configuring network interface card (NIC) hardware functions based on software definition according to claim 1, characterized in that, The step of retrieving and combining an initial hardware logic configuration from a hardware function module library containing multiple basic functional units based on the feature deviation type that triggers the defense reconfiguration process includes: converting the feature deviation type into a defense function requirement vector; calculating the matching degree score between the defense function requirement vector and the function description of each basic functional unit in the hardware function module library; selecting one or more basic functional units with the highest matching degree score, and connecting the selected basic functional units through a standard bus architecture to form the initial hardware logic configuration.

6. A method for configuring network interface card (NIC) hardware functions based on software definition according to claim 1, characterized in that, The step of performing a functional fit test on the adjusted hardware logic configuration using the evolutionary reference sample set includes: feeding input data from the evolutionary reference sample set into the adjusted hardware logic configuration to obtain its actual output results; comparing the actual output results with the expected defense action labels in the evolutionary reference sample set to calculate a functional compliance score; and combining the functional compliance score with the processing performance index obtained through time series analysis to generate a comprehensive fitness value, which is used to guide the next round of iterative adjustments.

7. A method for configuring network interface card (NIC) hardware functions based on software definition according to claim 1, characterized in that, Extracting complete dynamic session state information from the main channel hardware logic currently processing business data includes: sending a pause command to the main channel hardware logic to stop receiving new session establishment requests, thereby obtaining a static session state snapshot; performing a hardware-level atomic copy operation on the connection state table inside the main channel hardware logic used to store all active connection contexts, thereby obtaining a complete copy of the connection state table; and using the complete copy of the connection state table obtained through the atomic copy operation as the dynamic session state information.

8. A method for configuring network interface card hardware functions based on software definition according to claim 1, characterized in that, The process of migrating dynamic session state information to the superior hardware logic configuration and seamlessly switching the service data stream from the main path hardware logic to the superior hardware logic configuration includes: parsing the dynamic session state information, mapping it, and writing it into the corresponding register file and on-chip memory block inside the superior hardware logic configuration to complete state recovery; after state recovery is completed, activating the input buffer queue located at the front end of the data path to temporarily store the service data packets arriving at this moment to prevent data loss; sending a switching signal to the data path selector to point the exit of the data stream to the input port of the superior hardware logic configuration; and releasing the service data packets temporarily stored in the input buffer queue to the superior hardware logic configuration to complete the seamless switching of the service data stream.

9. A method for configuring network interface card (NIC) hardware functions based on software definition according to claim 1, characterized in that, The unused programmable logic unit within the network card performs randomized calculations to generate overlay physical noise, including: after the service data stream switch, initiating a periodic logic obfuscation operation on the winning hardware logic configuration to continuously change its physical characteristics; loading a noise generator circuit for generating pseudo-random sequences into the unused programmable logic unit within the network card; activating the noise generator circuit to generate high-frequency randomized calculations, thereby generating the overlay physical noise.

10. A method for configuring network interface card (NIC) hardware functions based on software definition according to claim 9, characterized in that, The periodic logic obfuscation operation for the winning hardware logic configuration includes: identifying auxiliary logic paths in the winning hardware logic configuration that do not directly affect its final defense judgment result; and periodically adjusting the contents of the lookup table or the physical routing path of the signal in the auxiliary logic path according to the obfuscation strategy, so as to change its power consumption characteristics while maintaining functional equivalence.

Images