A cryptographic processing method and system based on SM2 and SM4 algorithms

Abstract

The application discloses a kind of based on SM2 algorithm and SM4 algorithm's password processing method and system, belong to computer information security technical field, comprising: the enhanced task control block including service index number and data amount is constructed;Based on historical performance data calculation processing coefficient, utilize double threshold hysteresis comparator decision serial or parallel mode, avoid mode frequent switching;Parallel mode is through load balancing weight function for subtask allocation IP core;Hardware synchronization control unit maintains three index tables being processing, blocking and having been processed, realizes the automatic blocking and wake-up of associated job package, and with service index number as address accesses key and intermediate state;Adopt interrupt aggregation and double buffering batch processing result;Based on sliding window adaptive calibration double threshold and dynamically adjusting weight coefficient.The application effectively reduces interrupt overhead, eliminates scheduling ping-pong effect, realizes hardware level job synchronization, improves load balancing and image encryption structure fidelity.

Description

Technical Field

[0001] This invention belongs to the field of computer information security technology, and in particular relates to a cryptographic processing method and system based on the SM2 and SM4 algorithms. Background Technology

[0002] With the widespread deployment of domestically developed cryptographic algorithms, SM2 (asymmetric encryption), SM3 (hashing), and SM4 (symmetric encryption) have become core components of information security systems. However, existing cryptographic processing methods based on SM2 / SM3 / SM4 still have several detailed technical defects in practical engineering applications, which restrict the overall performance and reliability of the system.

[0003] Firstly, regarding the implementation of hardware-software co-processing, the invention patent CN121151060A, entitled "A Hybrid Encryption Method and System for a Security Coprocessor Based on Domestic Cryptographic Algorithms SM2 / 3 / 4," proposes deploying heavy-load modules such as point multiplication and modular multiplication on hardware, while signature and mode control are handled by software. However, this method fails to address the latency issue in hardware-software interaction: after the hardware module completes its calculations, it frequently triggers interrupts, requiring the CPU to read the results via the bus. In high-frequency call scenarios (such as multiple modular multiplications in SM2 point multiplication), each operation triggers an interrupt, leading to significant accumulation of bus wait and interrupt response time. Interrupt overhead accounts for more than 30% of the total processing time, severely diminishing the actual benefits of hardware acceleration.

[0004] Secondly, in image encryption scenarios, the invention patent with publication number CN113452688B, entitled "An Image Encryption and Decryption Method and Device Based on SM4 and SM2 Algorithms," converts a color image into a single-channel grayscale image and flattens it into a one-dimensional data stream before performing SM4 block encryption. This preprocessing method loses the two-dimensional spatial structure information of pixels, and the image is only recovered based on length and width after decryption. When the data block contains padding identifiers, the decryption end cannot distinguish between padding data and real pixels, which easily leads to pixel misalignment or inconsistent restored dimensions, and lacks a mechanism to verify the original pixel arrangement order.

[0005] Third, in dynamic load scenarios such as unintentional transmission, the invention patent with publication number CN119341728B, entitled "Unintentional Transmission Method Based on SM2 and SM4 Cryptographic Algorithms," uses a processing coefficient to decide whether to process in parallel or serially. This coefficient depends on instantaneous extreme values, and the processing coefficient changes drastically when the system load fluctuates, leading to frequent switching of processing methods (i.e., the "ping-pong effect"). Furthermore, the decision threshold is fixed and cannot adapt to changes in different hardware environments and business characteristics.

[0006] In addition, existing solutions generally lack hardware-level synchronization mechanisms for associated job packets (such as subsequent groups in CBC mode), and usually rely on software locks or semaphores, resulting in complex programming and low reliability; they also lack intermediate state management at the granularity of business index number, and cannot efficiently support random cross-access in serial working mode; at the same time, in parallel mode, the load distribution among multiple algorithm IP cores lacks dynamic weight calculation, which can easily cause uneven load among cores.

[0007] Therefore, there is an urgent need for a cryptographic processing method and system based on the SM2 and SM4 algorithms to overcome the problems existing in the current technology. Summary of the Invention

[0008] The purpose of this invention is to provide a cryptographic processing method and system based on the SM2 and SM4 algorithms, overcoming the shortcomings of existing SM2 / SM4 cryptographic processing methods in terms of hardware and software interaction delays, loss of image encryption structural information, ping-pong effect in dynamic load scheduling, and synchronous management of associated job packages.

[0009] To achieve the above objectives, this invention provides a cryptographic processing method based on the SM2 and SM4 algorithms, comprising the following steps: Step S1: Receive the original cryptographic task and construct an enhanced task control block (TCB). The TCB includes at least the business index number (BIN) and the current task data volume. ; Step S2: Receive the TCB output from step S1 as input, calculate the processing coefficients based on historical performance data, and decide on serial or parallel mode based on a dual-threshold hysteresis comparator. If parallel mode is selected, the load balancing weight function is used. Assign specific algorithm IP cores to subtasks, forming an allocation list that records the correspondence between subtasks and IP cores. Input the TCB, mode, and allocation list as output to step S3; process the coefficients. The calculation expression is: ; in, The current task data volume, The processing time of the previous task. This represents the maximum resource usage of the previous task. This represents the maximum channel utilization rate of the previous task. , These are the scheduling coefficients representing the maximum resource consumption and the maximum channel utilization of the previous task, respectively. and All values ​​are dimensionless values ​​that have been linearly normalized to the interval [0, 1]. The weighting coefficient for speed is... The weighting coefficients for the remaining capacity weights. For speed weighting, Weights for remaining capacity; Step S3: Receive the TCB, mode, and allocation list output from step S2 as input, and maintain the index table being processed via the hardware synchronization control unit. Blocking index table and processed index table Automatic blocking and waking of associated job packages are achieved. The key and intermediate state memory KSM with BIN as the address is used to read the corresponding key and intermediate state according to the BIN of each subtask, load the required data for the subtask, and send the subtask that has undergone the above synchronization process and has loaded the key and intermediate state as the synchronized subtask to step S4. Step S4: Using the synchronized subtask output in step S3 as input, the hardware cryptographic engine executes the subtask, uses interrupt aggregation to batch process the execution parameters, and displays the measured performance data of this task. Deposit into TCB; Step S5: Using the TCB containing the measured performance data from Step S4 as input, update the performance history array, and use the most recent performance data as the data required for the next task, Step S2. After processing a preset number of tasks or after a preset time interval, the dual thresholds are calibrated based on the sliding window average and the load balancing weight coefficients are dynamically adjusted. The calibrated dual thresholds and adjusted weight coefficients are then used as outputs for the next task's step S2.

[0010] Preferably, the decision-making method for the dual-threshold hysteresis comparator is: when the processing coefficient... When the threshold is higher than the maximum, the system switches to or remains in parallel mode; when When the threshold is below a certain level, the system switches to or remains in serial mode; when When the value falls between two thresholds (including the endpoints), the system maintains the decision result from the previous moment and does not make any switch.

[0011] Preferably, the TCB in step S1 also includes a data type identifier. ,when It embeds 10 bytes of structured metadata, which includes channel identifier, height, width, row offset mapping start value, and padding flags.

[0012] Preferably, in the load balancing weight function of step S2, the speed weight is... Remaining capacity weight ,in The time for an IP core to process a unit job packet. These represent the slowest and fastest processing times within the cluster, respectively. This represents the remaining capacity of the task queue. The total capacity of the queue. ,in, The weighting coefficient for speed is... The weighting coefficients for the remaining capacity weights.

[0013] Preferably, the workflow of the hardware synchronization control unit in step S3 is as follows: When the subtask is in serial mode, query the index table ITr that is being processed. If BIN already exists, send it to the blocking queue and record it in the blocking index table ITb. Otherwise, send it to the processing queue and add BIN to ITr. Once a subtask is completed, its BIN is added to the processed index table ITf. The blocking query module scans ITf, and if the same BIN is found in ITb, it retrieves the subsequent subtask from the blocking queue and sends it to the processing queue, deletes the corresponding entries in ITb and ITf, and finally deletes the BIN from ITr.

[0014] Preferably, in step S3, the key and intermediate state memory KSM uses BIN as the address, and each address unit stores the key, initialization vector IV and intermediate state of the corresponding service; before the subtask is executed, the required data is read according to BIN, and if there is a subsequent job packet after execution, the intermediate state is written back.

[0015] Preferably, the interrupt aggregation execution parameters in step S4 include: event queue depth. Timeout threshold The time ranges from 50μs to 200μs, and a double-buffered input register is used to achieve overlap between the software and hardware data pipelines.

[0016] Preferably, the method for dynamically adjusting the load balancing weight coefficient in step S5 is as follows: Calculate the actual utilization rate of each IP core; if the utilization rate of a certain IP core is lower than a preset utilization threshold for N consecutive sampling periods, then increase the weight coefficient of the remaining capacity weight. Conversely, increase the weighting coefficient of the speed weight. .

[0017] This invention also provides a cryptographic processing system based on the SM2 and SM4 algorithms, comprising: Initialization and preprocessing module: Its input is used to receive the original cryptographic task, and its output is connected to the first input of the hysteresis scheduler; it is used to perform the function of step S1, generate the enhanced TCB, and output the TCB to the hysteresis scheduler. Hysteresis scheduler: Its first input is connected to the output of the initialization and preprocessing module, its second input is connected to the first output of the feedback and adaptation module, and its output is connected to the first input of the hardware synchronization control unit; it is used to perform the function of step S2, and has a built-in dual-threshold hysteresis comparator and load balancing weight calculation unit. It receives TCB from the initialization and preprocessing module and historical performance data from the feedback and adaptation module, and outputs TCB, mode and allocation list to the hardware synchronization control unit, wherein the mode is serial mode or parallel mode; Hardware synchronization control unit: Its first input is connected to the output of the hysteresis scheduler, its second input is connected to the first output of the key and intermediate state memory, and its output is connected to the scheduling input of the hardware cryptographic engine array; it is used to perform the synchronization control of the associated job packets in step S3, and maintain the processing index table ITr, the blocked index table ITb, and the processed index table ITf; according to the received TCB, mode, and allocation list, this unit reads the corresponding key and intermediate state by outputting the BIN address to the key and intermediate state memory, and outputs the subtask with loaded key and intermediate state as synchronized subtask to the hardware cryptographic engine array; Key and intermediate state memory: Its address input is connected to the BIN output of the hardware synchronization control unit, its data output is connected to the data input of the hardware cryptographic engine array, and its data input is connected to the intermediate state output of the hardware cryptographic engine array; used to access the key and intermediate state using BIN as the address. Hardware cryptographic engine array: Its scheduling input is connected to the output of the hardware synchronization control unit, its data output is connected to the input of the performance monitoring unit, its interrupt request output is connected to the CPU's interrupt controller, and its intermediate status output is connected to the data input of the key and intermediate status memory; it contains multiple SM2, SM3, and SM4 IP cores, each engine is equipped with an event queue and an aggregated interrupt controller, and uses double-buffered input registers to implement the overlap of software and hardware data pipelines for executing the hardware execution part of step S4; Performance monitoring unit: Its input is connected to the data output of the hardware cryptographic engine array, and its output is connected to the second input of the feedback and adaptive module; used for data acquisition. The TCB containing performance data is then output to the feedback and adaptive module. Feedback and Adaptive Module: Its input is connected to the output of the performance monitoring unit, and its output is connected to the second input of the hysteresis scheduler; it is used to perform the function of step S5, maintain the performance history array, calibrate the double thresholds and dynamically adjust the load balancing weight coefficients based on the sliding window average, and send the calibrated double thresholds, adjusted weight coefficients and the most recent performance data back to the hysteresis scheduler as historical performance data.

[0018] Preferably, the hysteresis scheduler also receives a data type identifier from the initialization and preprocessing module. ,when Temporarily lower the low threshold of the dual-threshold hysteresis comparator to enhance the parallelism of image tasks; the feedback and adaptive module dynamically adjusts the weight coefficients of the load balancing weights based on the actual utilization of each IP core. .

[0019] Therefore, the cryptographic processing method and system based on the SM2 and SM4 algorithms described above have the following beneficial effects: (1) By aggregating interrupts through the event queue, multiple completed events are merged to trigger interrupts, which greatly reduces the number of interrupt responses, effectively releases CPU resources, fully taps the acceleration potential of the hardware cryptographic engine, and improves the overall processing throughput.

[0020] (2) The processing coefficient is calculated based on historical performance data, and a dual-threshold hysteresis comparator is introduced to decide between serial or parallel modes, avoiding frequent mode switching caused by instantaneous load fluctuations, enhancing the smoothness and stability of scheduling decisions, and improving the dynamic adaptability of the system.

[0021] (3) By maintaining three index tables for processing, blocking and processing, and using the business index number as the association key, the blocking and waking of multiple groups of the same business can be completed automatically, completely eliminating the synchronization errors and performance loss caused by software locks, and ensuring data consistency and reliability.

[0022] (4) Combine speed weight and remaining capacity weight to construct a comprehensive load balancing function, and adaptively adjust the weight coefficient according to the actual utilization of each IP core to continuously optimize the distribution of tasks among multiple cryptographic engines, thereby improving resource utilization and overall system processing efficiency.

[0023] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0024] Figure 1 This is an overall flowchart of a cryptographic processing method based on the SM2 and SM4 algorithms according to an embodiment of the present invention. Figure 2 This is a schematic diagram of the structure of a cryptographic processing system based on the SM2 and SM4 algorithms according to an embodiment of the present invention. Detailed Implementation

[0025] The following detailed description of embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0026] Example 1 This embodiment provides a cryptographic processing system based on the SM2 and SM4 algorithms. The system uses an XCZU9EG as its hardware platform, with all hardware modules implemented in FPGA logic. It runs Linux kernel drivers and applications on an ARM Cortex-A53 processor. The system clock frequency is 200 MHz.

[0027] I. Hardware configuration and parameters are shown in Table 1: Table 1: Hardware Configuration and Parameters

[0028] II. System Connection Relationships: (e.g.) Figure 2 As shown, the initialization and preprocessing module receives the raw cryptographic task from the host via the high-speed PCIe expansion bus and outputs the TCB to the hysteresis scheduler. The hysteresis scheduler, based on historical performance data provided by the feedback and adaptation module, outputs the TCB, mode, and allocation list to the hardware synchronization control unit. The hardware synchronization control unit accesses the KSM via the BIN address to read the key and intermediate state, and sends the synchronized subtasks to the hardware cryptographic engine array. The hardware cryptographic engine array performs SM2 / SM4 operations, writing its intermediate state back to the key and intermediate state memory KSM. The operation results are reported to the feedback and adaptation module via the performance monitoring unit. The feedback and adaptation module periodically calibrates the dual thresholds and weighting coefficients and sends them back to the hysteresis scheduler.

[0029] like Figure 1 As shown, this embodiment describes the complete workflow of the method of the present invention in conjunction with a specific SSL VPN session scenario (a specific application scenario of password processing for a complete user connection process in virtual private network communication based on the SSL protocol). It is assumed that the system has been started and has processed several tasks, and the historical performance array has been initialized; the specific process is as follows: Step S1: Receive the original cryptographic task and construct an enhanced TCB: The host driver receives encryption requests for 256 concurrent SSL sessions from the network protocol stack. Each request corresponds to a business index number BIN (0~255). For each request, the driver constructs an enhanced task control block (TCB). The TCB includes at least: BIN, current task data size S (in bytes), and data type identifier. (Ordinary data) =0). In this embodiment, S is randomly distributed between 64 and 1500 bytes. All are 0.

[0030] Step S2: Calculate processing coefficients, decide on serial or parallel mode, and allocate IP cores: The hysteresis scheduler receives the TCB output from step S1 and obtains historical performance data of the previous task from the feedback and adaptation module. , (Normalization) (Normalization), scheduling coefficient , Calculate the processing coefficient according to the formula. : ; by For example, byte: .

[0031] Current dual thresholds: low threshold High threshold .because The hysteresis comparator outputs in parallel mode. If the previous output was in serial mode and... If the value is between 0.25 and 0.75, the previous mode is maintained to avoid the ping-pong effect.

[0032] After determining the parallel mode, the load balancing weight calculation unit calculates the overall weight for each available IP core: ; Among them, the speed weight Remaining capacity weight In this embodiment, four SM4IP cores... The corresponding values ​​are 2.1 μs / KB, 2.3 μs / KB, 2.0 μs / KB, and 2.4 μs / KB, respectively. , Current remaining capacity of each core task queue The total queue capacity is 8, 6, 10, and 5 respectively. .Pick , Calculate each core The values ​​are 0.65, 0.51, 0.83, and 0.42 respectively. The current subtask is assigned to the IP core with the highest weight (here, the third core). After forming the assignment list, the TCB, parallel mode, and assignment list are sent to step S3.

[0033] Step S3: The hardware synchronization control unit automatically blocks and wakes up associated job packets, and loads keys and intermediate states. The hardware synchronization control unit receives the TCB, mode, and allocation list. First, it queries the currently processed index table ITr: if the BIN of the current subtask already exists in ITr, it means that the preceding packets of the same service have not yet been processed. The subtask is then sent to the blocking queue, and its BIN is recorded in the blocking index table ITb; otherwise, the subtask is sent to the processing queue, and its BIN is added to ITr.

[0034] In this embodiment, it is assumed that when the first packet with BIN=5 arrives, ITR is empty, so it is directly sent to the processing queue. Subsequently, when the second packet with BIN=5 arrives, it is found that ITR already contains BIN=5, so it is sent to the blocking queue and ITb[5]=true is recorded.

[0035] For a subtask sent to the processing queue, the hardware synchronization control unit sends a read request to the KSM using its BIN as the address. The KSM returns the SM4 key (16 bytes), the initialization vector IV (16 bytes), and the previously saved intermediate state (such as the previous block ciphertext in CBC mode) corresponding to the service. This data is appended to the subtask to form a "synchronized subtask," which is then sent to the scheduling input of the hardware cryptographic engine array.

[0036] Once a subtask is completed, the hardware cryptographic engine array sends a completion signal, along with its BIN, to the hardware synchronization control unit. The hardware synchronization control unit adds this BIN to the processed index table ITf. The blocking query module periodically scans ITf. If a matching BIN is found in ITb (i.e., a blocked subsequent subtask exists), the subsequent subtask is retrieved from the blocking queue, sent to the processing queue, and the corresponding entry is deleted from both ITb and ITf. Finally, the BIN is deleted from ITr. This achieves automatic hardware-level synchronization between multiple packets of the same service without the need for software locks.

[0037] Step S4: Hardware executes subtasks, using interrupt aggregation to batch process results: After receiving the synchronized subtask, the SM4 IP core in the hardware cryptographic engine array begins executing CBC mode encryption. After each block encryption is completed, the result does not immediately trigger an interrupt; instead, it is stored in an event queue. Event queue depth. Timeout threshold When four completed events accumulate in the event queue, or when the timer starts counting from the first event enqueued... At this time, the aggregated interrupt controller sends an interrupt request to the CPU. Simultaneously, the double-buffered input register allows the software to prefetch input data for the next batch of tasks while issuing the current batch, enabling overlap between the software and hardware data pipelines.

[0038] In this embodiment, processing 1000 SM4 packets from 256 concurrent sessions, after employing interrupt aggregation, the number of interrupts is reduced from 1000 to no more than 250 (ideally, one interrupt every 4 packets). The CPU's interrupt handler only needs to read the batch results once and update the measured performance data in the TCB. , , According to actual measurements, The average processing time for this task was 1250 μs. The maximum resource usage is 0.48. The maximum channel utilization is 0.35.

[0039] Step S5: Update the performance history array, adaptively calibrating thresholds and weights. The performance monitoring unit will include , , The TCB is sent to the feedback and adaptation module. The feedback and adaptation module maintains a performance history array of length 10 (sliding window size), using the most recent performance data as the basis for the next task. , , After processing 10 tasks or after every 10 ms, the feedback and adaptation module recalculates the dual thresholds based on the average value within the sliding window (e.g., the low threshold = 0.5 times the average CL, the high threshold = 1.5 times the average CL, and the amplitude is limited to the range [0.1, 0.9]), and sends the calibrated dual thresholds back to the hysteresis scheduler.

[0040] Simultaneously, the feedback and adaptive module calculates the actual utilization rate of each IP core. If the utilization rate of a certain IP core is lower than a preset threshold (e.g., 30%) for three consecutive sampling periods, the weighting coefficient of the remaining capacity weight is increased. (For example, increasing from 0.4 to 0.6), while decreasing (Reducing from 0.6 to 0.4) makes subsequent tasks more likely to be allocated to idle cores; conversely, if the utilization of a core remains above 80%, the value is increased. This prioritizes assigning tasks to faster cores. (After adjustment) Always maintain this.

[0041] This embodiment was compared with a hybrid encryption method using a security coprocessor that deploys heavy-load modules such as point arithmetic and modular arithmetic in hardware, while signature and mode control are performed in software (hereinafter referred to as "existing scheme A") on the same hardware platform. The test load consisted of 1000 randomly sized SM4-CBC encryption tasks (mixed from 64B to 1500B). The results are shown in Table 2 below: Table 2: Comparison Table

[0042] As shown in Table 2, under the same test conditions, this invention exhibits significant performance advantages over existing solution A. Specifically, the number of interrupts decreased from 1000 to 237, a reduction of 76.3%, and the interrupt handling time percentage decreased from 32% to 5.8%, an improvement of 81.9%. This is attributed to the event queue aggregation interrupt mechanism and double-buffered pipeline design of this invention. Regarding scheduling stability, this invention reduces the parallel / serial mode switching frequency from 15 times per second to 2 times per second, a reduction of 86.7%, effectively overcoming the "ping-pong effect" caused by load fluctuations. Furthermore, the standard deviation of each IP core utilization decreased from 0.35 to 0.07, an improvement of 80%, demonstrating the effectiveness of the dynamic load balancing weights of this invention. Finally, the synchronization error rate of subsequent groups within the same BIN decreased from 0.1% to 0%, completely eliminating the synchronization risks associated with software locks. In summary, the data in Table 2 fully validates the superiority of this invention in terms of interrupt latency, scheduling robustness, load balancing, and hardware synchronization.

[0043] Example 2 This embodiment demonstrates the special optimizations of the present invention in processing image data. The hardware platform is the same as in Embodiment 1, except for the data type identification. The specific process is as follows: Step S1: The host driver acquires a 1920×1080 RGB image frame from the camera and sets the data type identifier when constructing the TCB. The TCB embeds 10 bytes of structured metadata, including: channel identifier (0x01), height (1080), width (1920), row offset mapping start value (0), and padding flag (0). This metadata is used to accurately recover the two-dimensional spatial structure of the image during subsequent decryption.

[0044] Step S2: The hysteresis scheduler receives the data type identifier. Then, the low threshold of the dual-threshold hysteresis comparator is temporarily lowered (e.g., from 0.25 to 0.10) to improve the parallelism of the image task, thereby speeding up the image encryption.

[0045] Step S3: The hardware synchronization control unit divides the image data into multiple subtasks by line or by macroblock. Each subtask is encrypted independently, but since the metadata of the same image is the same, all subtasks share the same BIN. The synchronization mechanism ensures that image encryption is marked as complete only after all subtasks are completed.

[0046] Step S4: The SM4 IP core links each subtask with ciphertext blocks and CBC encryption, and the aggregated interrupt mechanism also applies.

[0047] Step S5: Performance data update and adaptive adjustment are the same as in Example 1.

[0048] Therefore, this invention employs a cryptographic processing method and system based on the SM2 and SM4 algorithms. By constructing an enhanced task control block (TCB) containing the service index number (BIN) and data volume (S), and calculating the processing coefficient (CL) using historical performance data, a dual-threshold hysteresis comparator is used to determine whether to use serial or parallel mode. This effectively overcomes the frequent mode switching caused by load fluctuations, making scheduling decisions more stable. In parallel mode, a dynamic load balancing function based on speed weight and remaining capacity weight allocates IP cores to subtasks, achieving balanced utilization of multi-core processing capabilities and avoiding the imbalance phenomenon where some cores are overloaded while others are idle. The hardware synchronization control unit maintains the currently processing index table (ITr), the blocked index table (ITb), and the processed index table (ITf). Using BIN as the association key, it automatically completes the blocking and waking of multiple groups of the same service, completely eliminating synchronization errors caused by software locks and supporting random cross-access to the serial working mode. The key and intermediate state memory (KSM) with BIN as the address allows each service to independently save its context, facilitating task switching. During hardware execution, event queues are used to aggregate interrupts and a double-buffered pipeline, significantly reducing the number of interrupt triggers, lowering CPU wait overhead, and making hardware-software collaboration more efficient. Finally, adaptive calibration of the dual thresholds using a sliding window average and dynamic adjustment of the weighting coefficients enable the system to continuously adapt to changing load environments, thereby improving the overall throughput and real-time performance of the cryptographic processing system.

[0049] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A cryptographic processing method based on the SM2 and SM4 algorithms, characterized in that, Includes the following steps: Step S1: Receive the original cryptographic task and construct an enhanced task control block (TCB). The TCB includes at least the business index number (BIN) and the current task data volume. ; Step S2: Receive the TCB output from step S1 as input, calculate the processing coefficients based on historical performance data, and decide on serial or parallel mode based on a dual-threshold hysteresis comparator. If parallel mode is selected, the load balancing weight function is used. Assign specific algorithm IP cores to subtasks, forming an allocation list that records the correspondence between subtasks and IP cores. Input the TCB, mode, and allocation list as output to step S3; process the coefficients. The calculation expression is: ； in, The current task data volume, The processing time of the previous task. This represents the maximum resource usage of the previous task. This represents the maximum channel utilization rate of the previous task. , These are the scheduling coefficients representing the maximum resource consumption and the maximum channel utilization of the previous task, respectively. The weighting coefficient for speed is... The weighting coefficients for the remaining capacity weights. For speed weighting, Weights for remaining capacity; Step S3: Receive the TCB, mode, and allocation list output from step S2 as input, and maintain the index table being processed via the hardware synchronization control unit. Blocking index table and processed index table Automatic blocking and waking of associated job packages are achieved. The key and intermediate state memory KSM with BIN as the address is used to read the corresponding key and intermediate state according to the BIN of each subtask, load the required data for the subtask, and send the processed subtask with loaded key and intermediate state as synchronized subtask to step S4. Step S4: Using the synchronized subtask output in step S3 as input, the hardware cryptographic engine executes the subtask, uses interrupt aggregation to batch process the execution parameters, and displays the measured performance data of this task. Deposit into TCB; Step S5: Using the TCB containing the measured performance data from Step S4 as input, update the performance history array, and use the most recent performance data as the data required for the next task, Step S2. After processing a preset number of tasks or after a preset time interval, the dual thresholds are calibrated based on the sliding window average and the load balancing weight coefficients are dynamically adjusted. The calibrated dual thresholds and adjusted weight coefficients are then used as outputs for the next task's step S2.

2. The cryptographic processing method based on the SM2 and SM4 algorithms according to claim 1, characterized in that: The TCB in step S1 also includes a data type identifier. ,when It embeds 10 bytes of structured metadata, which includes channel identifier, height, width, row offset mapping start value, and padding flags.

3. The cryptographic processing method based on the SM2 and SM4 algorithms according to claim 2, characterized in that: In the load balancing weight function of step S2, the speed weight is... Remaining capacity weight ,in The time for an IP core to process a unit job packet. These represent the slowest and fastest processing times within the cluster, respectively. This represents the remaining capacity of the task queue. The total capacity of the queue. ,in, The weighting coefficient for speed is... The weighting coefficients for the remaining capacity weights.

4. The cryptographic processing method based on the SM2 and SM4 algorithms according to claim 3, characterized in that, The workflow of the hardware synchronization control unit in step S3 is as follows: When the subtask is in serial mode, query the index table ITr that is being processed. If BIN already exists, send it to the blocking queue and record it in the blocking index table ITb. Otherwise, send it to the processing queue and add BIN to ITr. Once a subtask is completed, its BIN is added to the processed index table ITf. The blocking query module scans ITf, and if the same BIN is found in ITb, it retrieves the subsequent subtask from the blocking queue and sends it to the processing queue, deletes the corresponding entries in ITb and ITf, and finally deletes the BIN from ITr.

5. A cryptographic processing method based on the SM2 and SM4 algorithms according to claim 4, characterized in that: In step S3, the key and intermediate state storage KSM uses BIN as the address, and each address unit stores the key, initialization vector IV and intermediate state of the corresponding service. Before executing a subtask, read the required data based on the BIN. After execution, if there is a subsequent job package, write back the intermediate state.

6. The cryptographic processing method based on the SM2 and SM4 algorithms according to claim 5, characterized in that: The interrupt aggregation execution parameters in step S4 include: event queue depth. Timeout threshold The data flow rate is 50μs-200μs, and a double-buffered input register is used to achieve overlap between the software and hardware data pipelines.

7. A cryptographic processing method based on the SM2 and SM4 algorithms according to claim 6, characterized in that: The method for dynamically adjusting the load balancing weight coefficient in step S5 is as follows: The actual utilization rate of each IP core is calculated. If the utilization rate of a certain IP core is lower than the preset utilization threshold for N consecutive sampling periods, the weight coefficient of the remaining capacity weight is increased. Conversely, increase the weighting coefficient of the speed weight. .

8. A cryptographic processing system based on the SM2 and SM4 algorithms, applied to the cryptographic processing method based on the SM2 and SM4 algorithms as described in any one of claims 1-7, characterized in that, include: Initialization and preprocessing module: Its input is used to receive the raw cryptographic task, and its output is connected to the first input of the hysteresis scheduler; The function used to perform step S1 is to generate an enhanced TCB and output the TCB to the hysteresis scheduler. Hysteresis scheduler: Its second input is connected to the first output of the feedback and adaptive module, and its output is connected to the first input of the hardware synchronization control unit; The function used to execute step S2 includes a built-in dual threshold hysteresis comparator and a load balancing weight calculation unit. It receives TCB from the initialization and preprocessing module and historical performance data from the feedback and adaptive module, and outputs TCB, mode and allocation list to the hardware synchronization control unit. The mode is either serial mode or parallel mode. Hardware synchronization control unit: Its second input terminal is connected to the first output terminal of the key and intermediate state memory, and its output terminal is connected to the scheduling input terminal of the hardware cryptographic engine array; it is used to perform synchronization control of the associated job packets in step S3, and maintain the processing index table ITr, the blocked index table ITb, and the processed index table ITf; according to the received TCB, mode, and allocation list, this unit reads the corresponding key and intermediate state by outputting the BIN address to the key and intermediate state memory, and outputs the subtask with loaded key and intermediate state as synchronized subtask to the hardware cryptographic engine array; Key and intermediate state memory: Its address input is connected to the BIN output of the hardware synchronization control unit, its data output is connected to the data input of the hardware cryptographic engine array, and its data input is connected to the intermediate state output of the hardware cryptographic engine array; used to access the key and intermediate state using BIN as the address. Hardware cryptographic engine array: Its scheduling input is connected to the output of the hardware synchronization control unit, its data output is connected to the input of the performance monitoring unit, its interrupt request output is connected to the CPU's interrupt controller, and its intermediate status output is connected to the data input of the key and intermediate status memory; it contains multiple SM2, SM3, and SM4 IP cores, each engine is equipped with an event queue and an aggregated interrupt controller, and uses double-buffered input registers to implement the overlap of software and hardware data pipelines for executing the hardware execution part of step S4; Performance monitoring unit: Its output is connected to the second input of the feedback and adaptive module; used for data acquisition. The TCB containing performance data is then output to the feedback and adaptive module. Feedback and Adaptation Module: This module performs the function of step S5, maintains the performance history array, calibrates the dual thresholds based on the sliding window average and dynamically adjusts the load balancing weight coefficients, and sends the calibrated dual thresholds, adjusted weight coefficients, and the most recent performance data back to the hysteresis scheduler as historical performance data.

9. A cryptographic processing system based on the SM2 and SM4 algorithms according to claim 8, characterized in that, The hysteresis scheduler also receives data type identifiers from the initialization and preprocessing modules. ,when The low threshold of the dual-threshold hysteresis comparator is temporarily lowered to improve the parallelism of image tasks; the feedback and adaptive module dynamically adjusts the weight coefficient of the load balancing weight according to the actual utilization of each IP core.

Images