Data transmission method and device, computer device and medium

Abstract

The application relates to a data transmission method and device, computer equipment and medium. The method comprises the following steps: after initializing a DPDK driver system, receiving data packets from a bound network card in a polling mode based on a receiving thread, and distributing the data packets to a first lock-free queue; obtaining the data packets from the first lock-free queue based on a state detection thread, performing safety detection on the connection state of a gateway device for transmitting the data packets based on a state table to obtain a detection result, and distributing the data packets with a passed detection result to a second lock-free queue; performing encryption and decryption processing on the data packets in the second lock-free queue in an FPGA module based on an encryption and decryption thread to obtain processed data packets, and distributing the processed data packets to a third lock-free queue; and transmitting the processed data packets to be transmitted in the third lock-free queue through the bound network card based on a sending thread. The method can improve the efficiency and safety of data transmission.

Description

Technical Field

[0001] This application relates to the field of computer network information security technology, and in particular to a data transmission method, apparatus, computer equipment and medium. Background Technology

[0002] With the deepening of digital transformation, critical information infrastructures such as power systems and the industrial internet are placing higher demands on the real-time performance and security of data transmission.

[0003] Traditional technologies typically use the TCP / IP protocol stack for data transmission. Data processing in the traditional TCP / IP protocol stack requires multiple copies between kernel mode and user mode, resulting in high latency and low throughput. This makes it difficult to meet the needs of real-time cross-regional power business scenarios. Furthermore, traditional data encryption technologies perform poorly in resource-constrained environments, making it difficult to ensure the security of output transmission.

[0004] Therefore, how to transmit data in business scenarios such as cross-regional power transmission in order to improve the efficiency and security of data transmission is a problem that needs to be solved. Summary of the Invention

[0005] Therefore, it is necessary to provide a data transmission method, apparatus, computer equipment, and medium to address the aforementioned technical problems, so as to improve the efficiency and security of data transmission.

[0006] In a first aspect, this application provides a data transmission method applied to a DPDK driver system with an FPGA module deployed, comprising:

[0007] After initializing the DPDK driver system, the receiving thread receives data packets from the bound network card in a polling manner and distributes the data packets to the first lock-free queue.

[0008] The state detection thread retrieves the data packet from the first lock-free queue, performs security checks on the connection status of the gateway device transmitting the data packet based on the state table, obtains the detection result, and distributes the data packet with the detection result of passing to the second lock-free queue.

[0009] The data packets in the second lock-free queue are encrypted and decrypted in the FPGA module based on the encryption / decryption thread to obtain processed data packets, and the processed data packets are distributed to the third lock-free queue; the first lock-free queue, the second lock-free queue, and the third lock-free queue are different lock-free queues;

[0010] The sending thread sends the processed data packets to be sent in the third lock-free queue through the bound network card.

[0011] In one embodiment, distributing the data packet to the first lock-free queue includes:

[0012] The header of the data packet is parsed to obtain the 5-tuple information of the data packet;

[0013] Based on the hash value of the quintuple information, the data packet is distributed to the first lock-free queue corresponding to the hash value.

[0014] In one embodiment, the security detection of the connection status of the gateway device transmitting the data packet based on the status table to obtain the detection result includes:

[0015] The state information of the gateway device transmitting the data packet is obtained based on the finite state machine model. The state information includes at least two of the following: the protocol type of the gateway device, the source IP address, the destination IP address, the port number, the connection status, and the timestamp.

[0016] Based on the status information, the status table is queried to determine the detection result corresponding to the data packet. The status table is constructed based on the status information of the gateway device communicating with the DPDK driver system.

[0017] In one embodiment, the method further includes:

[0018] The status information during the data packet transmission process is monitored to obtain monitoring results;

[0019] The status table is updated based on the monitoring results to obtain the updated status table.

[0020] In one embodiment, the method further includes:

[0021] If the detection result indicates that the corresponding data packet has not passed, it will be blocked, and a blocking record information will be generated.

[0022] In one embodiment, the encryption / decryption thread includes an encryption thread and a decryption thread;

[0023] The step of encrypting and decrypting the data packets in the second lock-free queue using an encryption / decryption thread within the FPGA module to obtain processed data packets, and then distributing the processed data packets to the third lock-free queue, includes:

[0024] Based on the encryption thread, the header information of the data packet outgoing from the second lockless queue is encrypted in the FPGA module, and lightweight header information is added to obtain the processed outgoing data packet. The processed outgoing data packet is then distributed to the third lockless queue corresponding to the outgoing data.

[0025] Based on the decryption thread, the header information of the data packets entering the second lock-free queue is verified in the FPGA module, and the verified data packets are decrypted to obtain processed data packets. The processed data packets are then distributed to the third lock-free queue corresponding to the inbound data.

[0026] The processed data packets include the processed outbound data packets and the processed inbound data packets, and the third lock-free queue includes the third lock-free queue corresponding to the outbound data and the third lock-free queue corresponding to the inbound data.

[0027] In one embodiment, the step of sending the processed data packets to be sent in the third lock-free queue via the bound network interface card by the sending thread includes:

[0028] Based on the sending thread, the processed outbound data packet is obtained from the third lock-free queue corresponding to the outbound data, and the integrity of the processed outbound data packet is checked to obtain the check result.

[0029] The processed outbound data packets with a successful verification result are sent via the bound network card.

[0030] Secondly, this application also provides a data transmission device applied in a DPDK driver system with an FPGA module deployed, comprising:

[0031] The data receiving module is used to receive data packets from the bound network card in a polling manner based on the receiving thread after the DPDK driver system is initialized, and to distribute the data packets to the first lock-free queue.

[0032] The status detection module is used to obtain the data packet from the first lock-free queue based on the status detection thread, perform security detection on the connection status of the gateway device transmitting the data packet based on the status table, obtain the detection result, and distribute the data packet with the detection result of passing to the second lock-free queue.

[0033] An encryption / decryption module is used to perform encryption / decryption processing on the data packets in the second lock-free queue in the FPGA module based on an encryption / decryption thread, to obtain processed data packets, and to distribute the processed data packets to a third lock-free queue; the first lock-free queue, the second lock-free queue, and the third lock-free queue are different lock-free queues;

[0034] The data sending module is used to send the processed data packets to be sent in the third lock-free queue through the bound network card based on the sending thread.

[0035] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the data transmission method in any of the above embodiments.

[0036] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the data transmission method in any of the above embodiments.

[0037] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the data transmission method in any of the above embodiments.

[0038] In the above implementation, the receiving thread receives data packets from the bound network card using the DPDK architecture in a polling manner, distributing the received data packets to the first lock-free queue. Then, the state detection thread performs security checks on the data packets in the first lock-free queue based on a state table, transmitting packets that pass the checks to the second lock-free queue. The encryption / decryption thread performs encryption and decryption operations on the data packets in the second lock-free queue in the FPGA module, obtaining processed data packets, which are then transmitted to the third lock-free queue. This utilizes the FPGA module for accelerated processing; the parallel processing capability of the FPGA module significantly improves encryption / decryption throughput while reducing CPU load. Finally, the sending thread transmits the data packets to be sent from the third lock-free queue through the bound network card. The DPDK architecture and FPGA module achieve microsecond-level latency and high throughput. By directly operating the network card to receive and send data packets through the polling mode of DPDK, zero-copy data transmission is achieved, thereby improving data transmission efficiency. Data packet encryption and decryption are performed in the FPGA module, ensuring data transmission security while improving data transmission efficiency. Direct memory access (DMA) technology is used to achieve efficient data transmission between host memory and FPGA, avoiding memory copy overhead. Multiple worker threads process data packet encryption and decryption operations in parallel, and tasks are distributed through a load balancing strategy. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 This is a schematic diagram of the structure of a data transmission system provided in an embodiment of this application;

[0041] Figure 2 This is a flowchart of a data transmission method provided in an embodiment of this application;

[0042] Figure 3 This is a schematic diagram of a data packet status detection provided in an embodiment of this application;

[0043] Figure 4 This is a schematic diagram of a lightweight packaging provided in an embodiment of this application;

[0044] Figure 5 This is a schematic diagram of the structure of a data transmission device provided in an embodiment of this application;

[0045] Figure 6 This is an internal structural diagram of a computer device provided in an embodiment of this application. Detailed Implementation

[0046] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0047] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0048] The data transmission method provided in this application embodiment can be applied to, for example... Figure 1 In the data transmission system shown, Figure 1 This is a schematic diagram of the structure of a data transmission system provided in an embodiment of this application. Figure 1 The data transmission system shown is a DPDK driver system deployed with an FPGA module. This system also includes a lightweight ESP encryption module. The application layer connects to the state-aware filtering engine via DPDK, the FPGA module, and the lightweight ESP encryption module. The state-aware engine connects to the infrastructure layer. Specifically, the infrastructure layer includes network interfaces, a server platform, and vertical network security devices. In a power system, this application layer can be a real-time cross-regional power service or an industrial control system.

[0049] In one exemplary embodiment, the method is applied to a DPDK driver system with an FPGA module deployed. Figure 2This is a flowchart of a data transmission method provided in an embodiment of this application, in which the method is applied... Figure 1 Taking the data transmission system in China as an example, for instance... Figure 2 As shown, the method may include the following steps:

[0050] Step 201: After initializing the DPDK driver system, the receiving thread receives data packets from the bound network card in a polling manner and distributes the data packets to the first lock-free queue.

[0051] For example, system initialization is performed in a DPDK driver system with an FPGA module deployed. During initialization, the DPDK environment is started, the network card is bound, and the memory pool and descriptor ring are allocated. The FPGA bitstream is loaded, the encryption / decryption engine is initialized, and a state table for dynamic connections is created. When the first data packet (such as a TCP SYN packet) arrives, a new record is created based on the five-tuple information of the data packet, including the source IP address, destination IP address, source port, destination port, and protocol type. Then, a state tracking engine is initialized to track the connection's state (such as NEW, ESTABLISHED, RELATED), creation time, data packet and byte count statistics, etc. When subsequent data packets arrive, instead of matching static rules one by one through a traditional packet filtering firewall, the state table is directly queried to verify whether the data packet belongs to a known and legitimate connection. Processing threads are then started, and lock-free queues are established.

[0052] Specifically, each processing thread can include a status receiving thread, a status detection thread, an encryption / decryption thread, and a sending thread.

[0053] After the DPDK driver system is initialized, data packets can be received from the bound network card in a polling manner according to the receiving thread, and the received data packets are distributed to the first lock-free queue. Thus, the network card can be directly operated to receive data packets through the polling mode driver (PMD) of DPDK, realizing zero-copy data transmission.

[0054] Step 202: The state detection thread retrieves data packets from the first lock-free queue, performs security checks on the connection status of the gateway device transmitting the data packets based on the state table, obtains the detection results, and distributes data packets with the detection result of "passed" to the second lock-free queue.

[0055] Furthermore, the state inspection thread retrieves data packets from the first lock-free queue and, based on the connection status and reverse lookup of the gateway device transmitting the data packets in the state table, specifically determines whether the five-tuple information of the retrieved data packet corresponds to the five-tuple information recorded in the state table, thus obtaining the inspection result. Data packets with a pass inspection result, meaning the five-tuple information of the retrieved data packet corresponds to the five-tuple information recorded in the state table, are distributed to the second lock-free queue, thereby effectively cleaning up mismatched connections.

[0056] Step 203: Based on the encryption / decryption thread, the data packets in the second lock-free queue are encrypted and decrypted in the FPGA module to obtain the processed data packets, and then the processed data packets are distributed to the third lock-free queue.

[0057] Among them, the first lock-free queue, the second lock-free queue, and the third lock-free queue are different lock-free queues.

[0058] Furthermore, the encryption / decryption thread retrieves data packets from the second lock-free queue and performs encryption / decryption processing on the retrieved data packets within the FPGA module. Specifically, the national standard SM4 algorithm can be used for encryption / decryption to obtain the processed data packets, which are then distributed to the third lock-free queue.

[0059] As an example, an encryption / decryption thread can include an encryption thread and a decryption thread; correspondingly, the encryption / decryption operation can include encryption and decryption operations. For outbound data packets, the encryption thread can use the Chinese national standard SM4 algorithm for encryption to obtain encrypted data packets; for inbound data packets, the decryption thread can use the Chinese national standard SM4 algorithm for decryption to obtain decrypted data packets. The processed data packets can include both encrypted and decrypted data packets. Furthermore, the encryption thread distributes the encrypted data packets to the corresponding third lock-free queue, and the decryption thread distributes the decrypted data packets to the corresponding third lock-free queue.

[0060] Furthermore, the first lock-free queue, the second lock-free queue, and the third lock-free queue are different lock-free queues. The third lock-free queue corresponding to the encrypted data packet and the third lock-free queue corresponding to the decrypted data packet are different lock-free queues.

[0061] Step 204: The sending thread sends the processed data packets to be sent in the third lock-free queue through the bound network card.

[0062] Furthermore, the sending thread uses the bound network interface card (NIC) to send the processed data packets awaiting transmission in the third lock-free queue. Specifically, the sending thread uses the bound NIC to obtain the encrypted data packets and then sends them.

[0063] In the above implementation, the receiving thread receives data packets from the bound network card using the DPDK architecture in a polling manner, distributing the received data packets to the first lock-free queue. Then, the state detection thread performs security checks on the data packets in the first lock-free queue based on a state table, transmitting packets that pass the checks to the second lock-free queue. The encryption / decryption thread performs encryption and decryption operations on the data packets in the second lock-free queue in the FPGA module, obtaining processed data packets, which are then transmitted to the third lock-free queue. This utilizes the FPGA module for accelerated processing; the parallel processing capability of the FPGA module significantly improves encryption / decryption throughput while reducing CPU load. Finally, the sending thread transmits the data packets to be sent from the third lock-free queue through the bound network card. By leveraging the DPDK architecture and FPGA modules, microsecond-level latency and high throughput are achieved. DPDK's polling mode directly manipulates the network interface card (NIC) to receive and send data packets, enabling zero-copy data transmission and thus improving data transmission efficiency. Data packet encryption and decryption are performed within the FPGA module, ensuring data transmission security while improving efficiency. Direct Memory Access (DMA) technology is employed for efficient data transfer between host memory and the FPGA, avoiding memory copy overhead. Multiple worker threads process data packet encryption and decryption operations in parallel, and a load balancing strategy distributes tasks. Data is exchanged between threads using lock-free queues, preventing performance degradation caused by lock contention.

[0064] In one embodiment, distributing data packets to a first lock-free queue may include the following steps:

[0065] Step 1: Parse the header of the data packet to obtain the 5-tuple information of the data packet.

[0066] Step 2: Based on the hash value of the 5-tuple information, distribute the data packet to the first lock-free queue corresponding to the hash value.

[0067] For example, after the receiving thread obtains the data packet, it parses the header information of the obtained data packet to obtain the five-tuple information of the corresponding data packet. The five-tuple information includes the source IP address, the destination IP address, the source port number, the destination port number, and the transmission protocol.

[0068] Furthermore, based on the hash value of the quintuple information, the data packets are allocated, that is, the data packets are distributed to the first lock-free queue corresponding to the hash value of the quintuple, thereby realizing the allocation of received data packets.

[0069] In the above implementation process, the received data packets are distributed to the first lock-free queue that matches the hash value of the five-tuple information in the header, which facilitates the subsequent processing of data packets in the same first lock-free queue.

[0070] In one embodiment, performing security checks on the connection status of the gateway device transmitting data packets based on a status table to obtain the check results may include the following steps:

[0071] Step 1: Obtain the state information of the gateway device transmitting data packets based on the finite state machine model.

[0072] The status information includes at least two of the following: the gateway device's protocol type, source IP address, destination IP address, port number, connection status, and timestamp.

[0073] Step 2: Based on the status information, query the status table to determine the detection result corresponding to the data packet.

[0074] The status table is constructed based on the status information of the gateway device that communicates with the DPDK driver system.

[0075] For example, the state information of a gateway device transmitting data packets can be based on a finite state machine model. Specifically, this state information may include at least two of the following: the gateway device's protocol type, source IP address, destination IP address, port number, connection status, and timestamp. In this embodiment, the state information including the gateway device's protocol type, source IP address, destination IP address, port number, connection status, and timestamp is used as an example.

[0076] Furthermore, the status table is queried based on the acquired status information, and the detection result corresponding to the data packet is then confirmed based on the query result. Specifically, this status table is constructed based on the status information of the gateway device communicating with the DPDK driver system during data packet transmission.

[0077] In the above implementation process, the state information of the gateway device transmitting data packets is obtained through a finite state machine model, and the state table is queried based on the state information. This enables the DPDK driver system to accurately realize state awareness and filtering during data packet transmission, thereby further improving the security of data transmission.

[0078] In one embodiment, the method further includes the following steps:

[0079] Step 1: Monitor the status information during data packet transmission and obtain the monitoring results.

[0080] Step 2: Update the status table based on the monitoring results to obtain the updated status table.

[0081] For example, during the state detection process, the state detection thread can also monitor the state information during data packet transmission, thereby obtaining monitoring results and updating the state table based on these results. In other words, updating the state table is achieved by tracking the connection state of data packets, thus enabling full lifecycle monitoring of the state table in the DPDK driver system. This facilitates effective identification of abnormal connections and improves system security.

[0082] For example, for the TCP protocol, the three-way handshake and four-way handshake processes of the TCP protocol standard are tracked; for connectionless protocols such as UDP and ICMP, the virtual connection state is inferred based on the message exchange pattern. That is, state transition rules are defined according to the protocol specification, which facilitates real-time updates to the connection state table.

[0083] In the above implementation process, by monitoring the state information during data packet transmission and updating the state table based on the monitoring results, the full lifecycle monitoring of the state table in the DPDK driver system is effectively realized, thereby improving the system's security.

[0084] In one embodiment, the method further includes: blocking the corresponding data packet whose detection result is not passed, and generating blocking record information.

[0085] For example, during the detection of data packets, if the status information of the gateway device corresponding to the transmitted data packet is inconsistent with the status information in the status table, the detection result of the corresponding data packet is determined to be unsuccessful, and the unsuccessful data packet is blocked, and a corresponding blocking record is generated.

[0086] Specifically, abnormal behavior can be identified based on the connection status and characteristics of data packets. Detection rules include, but are not limited to: illegal state transitions (such as going directly from SYN_SENT to FIN_WAIT), abnormal jumps in packet sequence numbers, and protocol format violations. When an anomaly is detected, blocking rules are automatically generated and corresponding blocking records are created.

[0087] As an example, Figure 3 This is a schematic diagram of a data packet status detection provided in an embodiment of this application, such as... Figure 3As shown, the system retrieves the 5-tuple information from the received data packets. This 5-tuple information is dynamically linked to a state table, which is dynamically updated. This state table is a hash-based dynamic connection state table that records the entire lifecycle state of TCP, UDP, and ICMP protocol connections. Each entry in the table includes fields such as source / destination IP address, port number, protocol type, connection state (e.g., SYN_SENT, ESTABLISHED, FIN_WAIT), and timeout. The state table uses an LRU eviction policy to automatically clean up inactive connections. Furthermore, the system queries the state table based on received data packets, retrieves the connection state of the gateway device transmitting the corresponding data packet based on the hash value in the data packet, performs a timeout check based on the connection state, and updates the dynamic connection state table based on the check results. The state table can also be used to determine the transition state of data packets. Specifically, it performs protocol type analysis and legality authentication based on the current transition state to check for illegal transitions and updates the state table with the check results. Additionally, it can identify abnormal behavior during transition judgment. Specific abnormal behaviors can include illegal state transitions, abnormal sequence numbers, incorrect protocol formats, and connection timeouts. The state table is then updated based on the anomaly identification results. Furthermore, risk assessments can be performed. Data packets that pass the risk assessment are forwarded normally, while data packets that fail the risk assessment are blocked, connections are reset, and traffic alarms are triggered. In addition, log auditing and timeout management can be performed based on the state table, and normal data packets are forwarded while the state table is updated.

[0088] In the above implementation process, the data packet transmission process is monitored through a status table, that is, the transition status is judged and anomalies are identified. This can effectively identify and block abnormal connections, thereby effectively improving the security of data transmission in the DPDK driver system.

[0089] In one embodiment, the encryption / decryption thread includes an encryption thread and a decryption thread; the encryption / decryption thread performs encryption / decryption processing on the data packets in the second lock-free queue in the FPGA module to obtain processed data packets, and distributes the processed data packets to the third lock-free queue, which may include the following steps:

[0090] Step 1: Based on the encryption thread, encrypt the header information of the outbound data packets in the second lock-free queue in the FPGA module, and add lightweight header information to obtain the processed outbound data packets. Distribute the processed outbound data packets to the third lock-free queue corresponding to the outbound data.

[0091] Step 2: Based on the decryption thread, verify the header information of the data packets entering the second lock-free queue in the FPGA module, and decrypt the data packets that pass the verification to obtain the processed data packets. Distribute the processed data packets to the third lock-free queue corresponding to the data packets entering the queue.

[0092] The processed data packets include processed outbound data packets and processed inbound data packets. The third lock-free queue includes the third lock-free queue corresponding to outbound data and the third lock-free queue corresponding to inbound data.

[0093] For example, the encryption / decryption thread includes an encryption thread and a decryption thread. The encryption thread is used to encrypt outbound data packets. The decryption thread is used to decrypt inbound data packets.

[0094] Specifically, the encryption thread uses the FPGA-accelerated SM4 algorithm to accelerate the encryption of the header information of outbound data packets in the second lock-free queue, and adds lightweight ESP header information to obtain the processed outbound data packets. These processed data packets are then distributed to the corresponding third lock-free queue. As an example, during the process of adding lightweight ESP header information to the data packets, the ESP header sequence number field can be compressed to 4 bytes, thereby halving the header overhead, improving transmission throughput, and reducing latency. A unique identifier is still assigned to each data packet using 32 bits to prevent data packet tampering or forgery. The unique identifier is used to monitor the secure connection status, achieving state lifecycle management to ensure its effectiveness. This design is adapted to FPGA hardware acceleration, simplifying parsing logic, reducing resource consumption, and helping the lightweight ESP protocol adapt to edge resource-constrained devices. Simultaneously, it is linked with state-aware filtering, ensuring security through hardware and software dual verification, and reserving standard interfaces for compatibility with existing network security facilities, balancing performance, security, and practicality.

[0095] The decryption thread verifies the header information of inbound data packets in the second lock-free queue within the FPGA module. As an example, a Message Authentication Code (HMAC) can be generated based on the SM4 algorithm to verify data integrity and obtain the processed inbound data packets. Furthermore, the checksum calculation is also accelerated through the FPGA module to ensure no impact on data transmission performance. The processed inbound data packets are then distributed to the corresponding third lock-free queue.

[0096] The processed data packets can include processed outbound data packets and processed inbound data packets. The third lock-free queue includes the third lock-free queue corresponding to outbound data and the third lock-free queue corresponding to inbound data. During the transmission of processed data packets to the corresponding third lock-free queue, large data packets can be fragmented and reassembled at the receiving end. The sending end dynamically adjusts the fragment size according to the path MTU, and the receiving end reassembles the original message based on the fragment identifier and offset. The fragmentation process adopts an asynchronous processing mechanism to avoid blocking the encryption pipeline.

[0097] As an example, Figure 4 This is a schematic diagram of a lightweight packaging provided in an embodiment of this application, as shown below. Figure 4 As shown, after acquiring the original data packet, the header of the original data packet is parsed to obtain the corresponding five-tuple information of the data packet. Then, information such as SPI and sequence number are added according to the five-tuple information in the header, thereby realizing header encapsulation. Further, the added header information is encrypted and decrypted. Specifically, outbound data packets are encrypted using SM4 to obtain the ciphertext data, and inbound data packets are decrypted to obtain the plaintext data, finally obtaining the processed data. Further, the processed data undergoes integrity verification. Specifically, a message authentication code (HMAC) can be generated using the SM4 hash algorithm to verify data integrity. During the integrity verification process, the length of the next header is padded, and ESP tail encapsulation is performed to obtain ESP encapsulated data.

[0098] In the above implementation process, the SM4 algorithm is used for encryption and decryption operations in hardware that combines the DPDK user-space architecture with FPGA modules. This effectively achieves low-latency, high-throughput encrypted data transmission and ensures interoperability with existing network security infrastructure. Furthermore, it is encapsulated using a lightweight ESP protocol, making it suitable for deployment in high-performance network security devices as well as resource-constrained edge computing environments, meeting the needs of various scenarios such as real-time cross-regional power services.

[0099] In one embodiment, based on the sending thread sending the processed data packets to be sent in the third lock-free queue through the bound network card, the following steps may also be included:

[0100] Step 1: Based on the sending thread, retrieve the processed outbound data packet from the third lock-free queue corresponding to the outbound data, and perform integrity verification on the processed outbound data packet to obtain the verification result.

[0101] Step 2: Send outbound data packets with a successful verification result through the bound network card.

[0102] For example, after retrieving the processed data packet from the third lock-free queue corresponding to the occurring data, the sending thread performs integrity verification on the data packet. Specifically, the SM4 hash algorithm can be used to generate a message authentication code (HMAC) to verify data integrity and obtain the verification result. Further, the sending thread sends the processed data packet with the verified result through the bound network card, thereby ensuring the integrity of the sent data packet.

[0103] In the above implementation process, by performing integrity verification on outbound data packets and sending outbound data packets that pass the verification, the integrity of the sent data packets can be effectively ensured.

[0104] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0105] Based on the same inventive concept, this application also provides a data transmission apparatus for implementing the data transmission method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, specific limitations in one or more data transmission apparatus embodiments provided below can be found in the limitations of the data transmission method described above, and will not be repeated here.

[0106] In one exemplary embodiment, Figure 5 This is a schematic diagram of a data transmission device provided in an embodiment of this application. This data transmission device can be applied to a DPDK driver system with an FPGA module deployed, such as... Figure 5 As shown, the data transmission device includes:

[0107] The data receiving module 501 is used to receive data packets from the bound network card in a polling manner based on the receiving thread after the DPDK driver system is initialized, and to distribute the data packets to the first lock-free queue.

[0108] The status detection module 502 is used to obtain data packets from the first lock-free queue based on the status detection thread, perform security detection on the connection status of the gateway device transmitting the data packets based on the status table, obtain the detection result, and distribute the data packets with the detection result of passing to the second lock-free queue.

[0109] The encryption / decryption module 503 is used to perform encryption / decryption processing on the data packets in the second lock-free queue in the FPGA module based on the encryption / decryption thread, obtain the processed data packets, and distribute the processed data packets to the third lock-free queue; the first lock-free queue, the second lock-free queue, and the third lock-free queue are different lock-free queues.

[0110] The data sending module 504 is used to send the processed data packets to be sent in the third lockless queue through the bound network card based on the sending thread.

[0111] In one embodiment, the data receiving module 501 is specifically used for:

[0112] Parse the header of the data packet to obtain the 5-tuple information of the data packet;

[0113] Based on the hash value of the 5-tuple information, the data packet is distributed to the first lock-free queue corresponding to the hash value.

[0114] In one embodiment, the state detection module 502 is specifically used for:

[0115] The state information of the gateway device transmitting data packets is obtained based on the finite state machine model. The state information includes at least two of the following: the protocol type of the gateway device, the source IP address, the destination IP address, the port number, the connection status, and the timestamp.

[0116] Based on the status information, the status table is queried to determine the detection result corresponding to the data packet. The status table is constructed based on the status information of the gateway device communicating with the DPDK driver system.

[0117] In one embodiment, the state detection module 502 is further configured to:

[0118] The status information during data packet transmission is monitored, and the monitoring results are obtained.

[0119] The status table is updated based on the monitoring results to obtain the updated status table.

[0120] In one embodiment, the state detection module 502 is further configured to:

[0121] If the detection result indicates that the corresponding data packet has failed, it will be blocked, and a blocking record information will be generated.

[0122] In one embodiment, the encryption / decryption thread includes an encryption thread and a decryption thread; the encryption / decryption module 503 is specifically used for:

[0123] The encryption / decryption thread performs encryption / decryption processing on the data packets in the second lock-free queue within the FPGA module to obtain processed data packets, which are then distributed to the third lock-free queue. This includes:

[0124] Based on the encrypted thread, the header information of the outbound data packets in the second lock-free queue is encrypted in the FPGA module, and lightweight header information is added to obtain the processed outbound data packets. The processed outbound data packets are then distributed to the third lock-free queue corresponding to the outbound data.

[0125] Based on the decryption thread, the header information of the data packets entering the second lock-free queue is verified in the FPGA module, and the verified data packets are decrypted to obtain the processed data packets. The processed data packets are then distributed to the third lock-free queue corresponding to the data packets entering the queue.

[0126] The processed data packets include processed outbound data packets and processed inbound data packets. The third lock-free queue includes the third lock-free queue corresponding to outbound data and the third lock-free queue corresponding to inbound data.

[0127] In one embodiment, the data sending module 504 is specifically used for:

[0128] Based on the sending thread, the processed outbound data packets are obtained from the third lock-free queue corresponding to the outbound data, and the integrity of the processed outbound data packets is checked to obtain the check result.

[0129] The network interface card (NIC) is used to send outbound data packets that have passed the verification process.

[0130] Each module in the aforementioned data transmission device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0131] In one exemplary embodiment, a computer device is provided, which may be a server. Figure 6 This is an internal structural diagram of a computer device provided in an embodiment of this application, such as... Figure 6As shown, the computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores real-time business data across regions. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a data transmission method.

[0132] Those skilled in the art will understand that Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0133] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the data transmission method in any of the above embodiments.

[0134] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the data transmission method of any of the above embodiments.

[0135] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0136] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0137] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0138] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A data transmission method, characterized in that, The method, applied in a DPDK driver system with an FPGA module deployed, includes: After initializing the DPDK driver system, the receiving thread receives data packets from the bound network card in a polling manner and distributes the data packets to the first lock-free queue. The state detection thread retrieves the data packet from the first lock-free queue, performs security checks on the connection status of the gateway device transmitting the data packet based on the state table, obtains the detection result, and distributes the data packet with the detection result of passing to the second lock-free queue. The data packets in the second lock-free queue are encrypted and decrypted in the FPGA module based on the encryption / decryption thread to obtain processed data packets, and the processed data packets are distributed to the third lock-free queue; the first lock-free queue, the second lock-free queue, and the third lock-free queue are different lock-free queues; The sending thread sends the processed data packets to be sent in the third lock-free queue through the bound network card.

2. The method according to claim 1, characterized in that, The step of distributing the data packet to the first lock-free queue includes: The header of the data packet is parsed to obtain the 5-tuple information of the data packet; Based on the hash value of the quintuple information, the data packet is distributed to the first lock-free queue corresponding to the hash value.

3. The method according to claim 1, characterized in that, The connection status of the gateway device transmitting the data packet is checked based on the status table to obtain the detection result, including: The state information of the gateway device transmitting the data packet is obtained based on the finite state machine model. The state information includes at least two of the following: the protocol type of the gateway device, the source IP address, the destination IP address, the port number, the connection status, and the timestamp. Based on the status information, the status table is queried to determine the detection result corresponding to the data packet. The status table is constructed based on the status information of the gateway device communicating with the DPDK driver system.

4. The method according to claim 3, characterized in that, The method further includes: The status information during the data packet transmission process is monitored to obtain monitoring results; The status table is updated based on the monitoring results to obtain the updated status table.

5. The method according to any one of claims 1-4, characterized in that, The method further includes: If the detection result indicates that the corresponding data packet has not passed, it will be blocked, and a blocking record information will be generated.

6. The method according to claim 1, characterized in that, The encryption / decryption thread includes an encryption thread and a decryption thread; The step of encrypting and decrypting the data packets in the second lock-free queue using an encryption / decryption thread within the FPGA module to obtain processed data packets, and then distributing the processed data packets to the third lock-free queue, includes: Based on the encryption thread, the header information of the data packet outgoing from the second lockless queue is encrypted in the FPGA module, and lightweight header information is added to obtain the processed outgoing data packet. The processed outgoing data packet is then distributed to the third lockless queue corresponding to the outgoing data. Based on the decryption thread, the header information of the data packets entering the second lock-free queue is verified in the FPGA module, and the verified data packets are decrypted to obtain processed data packets. The processed data packets are then distributed to the third lock-free queue corresponding to the inbound data. The processed data packets include the processed outbound data packets and the processed inbound data packets, and the third lock-free queue includes the third lock-free queue corresponding to the outbound data and the third lock-free queue corresponding to the inbound data.

7. The method according to claim 6, characterized in that, The step of sending the processed data packets to be sent in the third lock-free queue via the bound network card by the sending thread includes: Based on the sending thread, the processed outbound data packet is obtained from the third lock-free queue corresponding to the outbound data, and the integrity of the processed outbound data packet is checked to obtain the check result. The processed outbound data packets with a successful verification result are sent via the bound network card.

8. A data transmission device, characterized in that, The device, used in a DPDK driver system with an FPGA module deployed, comprises: The data receiving module is used to receive data packets from the bound network card in a polling manner based on the receiving thread after the DPDK driver system is initialized, and to distribute the data packets to the first lock-free queue. The status detection module is used to obtain the data packet from the first lock-free queue based on the status detection thread, perform security detection on the connection status of the gateway device transmitting the data packet based on the status table, obtain the detection result, and distribute the data packet with the detection result of passing to the second lock-free queue. An encryption / decryption module is used to perform encryption / decryption processing on the data packets in the second lock-free queue in the FPGA module based on an encryption / decryption thread, to obtain processed data packets, and to distribute the processed data packets to a third lock-free queue; the first lock-free queue, the second lock-free queue, and the third lock-free queue are different lock-free queues; The data sending module is used to send the processed data packets to be sent in the third lock-free queue through the bound network card based on the sending thread.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images