An FPGA national secret algorithm online dynamic configuration method, device and equipment

Abstract

The application provides an FPGA national secret algorithm online dynamic configuration method, device and equipment, and the method comprises the following steps: receiving a password operation request; the password operation request is disassembled to obtain at least one atomic password task; the at least one atomic password task is added to the national secret algorithm task queue; according to the real-time load of the plurality of national secret algorithm task queues, a capacity demand vector is obtained; when the switching trigger condition is met, the capacity demand vector is matched with each capacity configuration version in the preset capacity configuration version library to determine a target capacity configuration version; the target capacity configuration version is configured in the FPGA to obtain a configuration result; according to the configuration result, the password operation request is processed according to the capacity configuration version configured in the FPGA. The scheme of the application can divide the FPGA logic area into a plurality of interface standardized reconfigurable slots, and dynamically adjust the algorithm engine distribution of the slots according to the real-time load.

Description

Technical Field

[0001] This invention relates to the field of computer information technology processing technology, and in particular to an online dynamic configuration method, apparatus and equipment for FPGA national cryptographic algorithms. Background Technology

[0002] Network cryptographic devices, cryptographic cards, security gateways, VPN (Virtual Private Network) gateways, server cryptographic machines, and data encryption devices typically need to simultaneously handle SM2 (Chinese national cryptographic algorithm) signature / verification or key exchange, SM3 (Chinese national cryptographic algorithm) digest calculation, and SM4 (Chinese national cryptographic algorithm) data encryption and decryption. FPGA (Field-Programmable Gate Array) can accelerate cryptographic algorithms in a pipelining and parallel manner, but the resources of a single FPGA, including lookup tables, flip-flops, block memory, DSP (Digital Signal Processor), on-chip interconnects, and high-speed interfaces, are limited.

[0003] Traditional implementations typically allocate hardware resources for each algorithm at a fixed stage of design, such as deploying one SM2 engine, two SM3 engines, and several SM4 pipelines. This resource allocation remains constant during device operation, and even if actual business needs vary significantly at different times, it is impossible to quickly convert temporarily idle algorithm resources into processing capacity for currently popular algorithms. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide an online dynamic configuration method, device and equipment for FPGA national cryptographic algorithms, which can divide the FPGA logic area into multiple interface-standardized reconfigurable slots and dynamically adjust the algorithm engine allocation of the slots according to the real-time load.

[0005] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows: A method for online dynamic configuration of national cryptographic algorithms on an FPGA, wherein the FPGA is divided into a static region and a reconfigurable region containing multiple homogeneous algorithm processing unit (APU) slots, the method comprising: Receive cryptographic operation requests, wherein the cryptographic operation requests include operation requests for at least one national cryptographic algorithm; The operation request of at least one national cryptographic algorithm included in the cryptographic operation request is decomposed to obtain at least one atomic cryptographic task; Add the at least one atomic cryptographic task to the national cryptographic algorithm task queue corresponding to the national cryptographic algorithm of the atomic cryptographic task; Based on the real-time load of multiple national cryptographic algorithm task queues, a capacity demand vector is obtained, which describes the capacity demand of each national cryptographic algorithm at the current moment. When the switching trigger condition is met, the capacity demand vector is matched with each capacity configuration version in the preset capacity configuration version library to determine the target capacity configuration version; the capacity configuration version defines the number of engines, target slot allocation and total power consumption for each national cryptographic algorithm; Configure the target capacity configuration version in the FPGA to obtain the configuration result; Based on the configuration results, the cryptographic operation request is processed according to the capacity configuration version configured in the FPGA.

[0006] Optionally, a capacity demand vector is obtained based on the real-time load of multiple national cryptographic algorithm task queues, including: Obtain the task arrival rate and queue depth of each national cryptographic algorithm task queue, and smooth the task arrival rate and queue depth to obtain smoothed arrival rate and smoothed queue depth; Based on the smooth arrival rate and smooth queue depth, as well as the preset nominal processing rate of the FPGA single engine and the preset maximum allowed queue depth, the equivalent load factor is obtained. Based on the equivalent load factor, the number of engines required for the national cryptographic algorithm corresponding to the national cryptographic algorithm task queue is obtained; Obtain the waiting delay of historical tasks that have been processed in the national cryptographic algorithm task queue, and adjust the number of engine instances according to the waiting delay to obtain the adjusted number of engines; Obtain the preset first threshold and second threshold; The corrected number of engines is compared with the first threshold and the second threshold to determine the target number of engines required by the national cryptographic algorithm corresponding to the national cryptographic algorithm task queue. The capacity requirement vector is obtained based on the number of target engines required for each national cryptographic algorithm.

[0007] Optionally, the corrected number of engines is compared with the first threshold and the second threshold to determine the number of target engines required for the national cryptographic algorithm corresponding to the national cryptographic algorithm task queue, including: When the corrected number of engines is greater than or equal to the first threshold, the corrected number of engines is rounded up to obtain the target number of engines required by the national cryptographic algorithm corresponding to the national cryptographic algorithm task queue. If the corrected number of engines is less than or equal to the second threshold, the corrected number of engines is rounded down to obtain the target number of engines required by the national cryptographic algorithm corresponding to the national cryptographic algorithm task queue. When the corrected number of engines is greater than the second threshold and less than the first threshold, the number of engines currently configured in the national cryptographic algorithm in the FPGA is taken as the target number of engines.

[0008] Optionally, the capacity demand vector is matched with each capacity configuration version in a preset capacity configuration version library to determine the target capacity configuration version, including: Obtain the capacity vector for each capacity configuration version in the preset capacity configuration version library; The capacity requirement vector is compared with each dimension of the capacity vector to obtain a candidate version set; When the candidate version set is not empty, the version with the smallest total number of surplus engines in the candidate version set is taken as the target capacity configuration version; When the candidate version set is empty, determine the total effective coverage and the maximum gap dimension coverage of each capacity configuration version in the preset capacity configuration version library, and determine the target capacity configuration version based on the total effective coverage and the maximum gap dimension coverage.

[0009] Optionally, the capacity demand vector is compared with each dimension of the capacity vector to obtain a candidate version set, including: The capacity demand vector With the capacity vector In comparison, among them The number of target engines required for the i-th national cryptographic algorithm, Configure the capacity vector for version p of the capacity. The number of engines for the i-th national cryptographic algorithm provided for capacity configuration version p, where n is a positive integer; When i takes any value from 1 to n, the formula When all conditions are met, the capacity configuration version p is used as a candidate version to obtain a candidate version set.

[0010] Optionally, the target capacity configuration version is configured in the FPGA to obtain the configuration result, including: Upon receiving a capacity configuration version reconfiguration instruction, pause the delivery of atomic cryptographic tasks to the reconfigurable area and clear any unfinished atomic cryptographic tasks in the reconfigurable area; Turn off the output valid signal of the reconfigurable region, confirm that the reconfigurable region is idle, and reset the region; Load the target capacity configuration version, and load the national cryptographic algorithm atomic images contained in the target capacity configuration version into the target APU slot in the reconfigurable region to obtain the loading result; Once the target capacity configuration version is loaded, verification is performed to obtain the verification result; The configuration result is obtained based on the loading result and the verification result.

[0011] Optionally, based on the configuration result, the cryptographic operation request is processed according to the capacity configuration version configured in the FPGA, including: When the configuration result is passed, the target capacity configuration version is successfully configured in the FPGA, and each atomic cryptographic task in the cryptographic operation request is encrypted according to the target number of national cryptographic algorithms specified in the target capacity configuration version. If the configuration result is unsuccessful, the target capacity configuration version configuration fails, and the stable version before the FPGA reconfiguration is rolled back. The atomic cryptographic tasks in the cryptographic operation request are encrypted according to the target number of national cryptographic algorithms specified in the stable version.

[0012] This invention also provides an online dynamic configuration device for FPGA national cryptographic algorithms, comprising: The acquisition module is used to receive cryptographic operation requests, wherein the cryptographic operation requests include operation requests for at least one national cryptographic algorithm; The processing module is configured to decompose the operation request of at least one national cryptographic algorithm included in the cryptographic operation request to obtain at least one atomic cryptographic task; add the at least one atomic cryptographic task to the national cryptographic algorithm task queue corresponding to the national cryptographic algorithm of the atomic cryptographic task; obtain a capacity demand vector based on the real-time load of multiple national cryptographic algorithm task queues, wherein the capacity demand vector describes the capacity demand of each national cryptographic algorithm at the current moment; when the switching trigger condition is met, match the capacity demand vector with each capacity configuration version in the preset capacity configuration version library to determine the target capacity configuration version; wherein the capacity configuration version defines the number of engines, target slot allocation and total power consumption of each national cryptographic algorithm; configure the target capacity configuration version in the FPGA to obtain the configuration result; and process the cryptographic operation request according to the capacity configuration version configured in the FPGA based on the configuration result.

[0013] The present invention also provides a computing device, comprising: a processor and a memory storing a computer program, wherein the computer program, when executed by the processor, performs the method described above.

[0014] The present invention also provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the method described above.

[0015] The above-described solution of the present invention has at least the following beneficial effects: The above-described solution of the present invention involves receiving a cryptographic operation request, which includes an operation request for at least one national cryptographic algorithm; decomposing the operation request for at least one national cryptographic algorithm to obtain at least one atomic cryptographic task; adding the at least one atomic cryptographic task to a national cryptographic algorithm task queue corresponding to the national cryptographic algorithm of the atomic cryptographic task; obtaining a capacity demand vector based on the real-time load of multiple national cryptographic algorithm task queues, the capacity demand vector describing the capacity demand of each national cryptographic algorithm at the current moment; when a switching trigger condition is met, matching the capacity demand vector with each capacity configuration version in a preset capacity configuration version library to determine a target capacity configuration version; the capacity configuration version defining the number of engines, target slot allocation, and total power consumption for each national cryptographic algorithm; configuring the target capacity configuration version in the FPGA to obtain a configuration result; and processing the cryptographic operation request according to the capacity configuration version configured in the FPGA based on the configuration result. This allows the FPGA logic area to be divided into multiple interface-standardized reconfigurable slots, and the algorithm engine allocation of the slots to be dynamically adjusted according to the real-time load. Attached Figure Description

[0016] Figure 1 This is a flowchart of the FPGA national cryptographic algorithm online dynamic configuration method according to an embodiment of the present invention; Figure 2 This is a block diagram of the FPGA national cryptographic algorithm online dynamic configuration method according to an embodiment of the present invention; Figure 3 This is a structural diagram of the FPGA national cryptographic algorithm online dynamic configuration device according to an embodiment of the present invention. Detailed Implementation

[0017] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this invention will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

[0018] like Figure 1 As shown, an embodiment of the present invention proposes an online dynamic configuration method for FPGA national cryptographic algorithms. The FPGA is divided into a static region and a reconfigurable region containing multiple homogeneous algorithm processing unit (APU) slots. The method includes: Step 11: Receive a cryptographic operation request, which includes an operation request for at least one national cryptographic algorithm. The cryptographic operation request is a raw task instruction issued by the upper-layer software, such as "Please encrypt this data using SM4" or "Please sign this digest using SM2". Each cryptographic operation request may contain one algorithm or multiple algorithms simultaneously, i.e., a composite algorithm request.

[0019] Step 12: Decompose the operation request of at least one national cryptographic algorithm included in the cryptographic operation request to obtain at least one atomic cryptographic task; the atomic cryptographic task is an indivisible minimum hardware computing unit. For example, a cryptographic operation request of "please sign this digest using SM2" can be decomposed into atomic cryptographic task A: SM3 hash calculation and atomic cryptographic task B: SM2 signature calculation.

[0020] Step 13: Add the at least one atomic cryptographic task to the national cryptographic algorithm task queue corresponding to the national cryptographic algorithm of the atomic cryptographic task. In this embodiment, preferably, the system maintains three independent national cryptographic algorithm task queues, namely the SM2 task queue, the SM3 task queue, and the SM4 task queue, corresponding to the three national cryptographic algorithms SM2, SM3, and SM4, respectively. For the split atomic cryptographic task, add it to the national cryptographic algorithm task queue of the corresponding national cryptographic algorithm.

[0021] Step 14: Based on the real-time load of multiple national cryptographic algorithm task queues, obtain a capacity demand vector. This vector describes the capacity requirement of each national cryptographic algorithm at the current moment. The real-time load includes the task arrival rate and queue depth. By statistically analyzing the real-time load, quantify the task waiting status of the current national cryptographic algorithm task queues and abstract it into a capacity demand vector. In other words, based on the real-time status of the current task, determine the hardware resources required to complete the current task. For SM2, SM3, and SM4 task queues, the capacity demand vector can be represented as follows: ,in The number of target engines required for the second national cryptographic algorithm SM2, The number of target engines required for the third national cryptographic algorithm SM3, This represents the number of target engines required for the fourth national cryptographic algorithm, SM4.

[0022] In this invention, the engine is a running hardware logic instance formed in the FPGA after loading and running atomic images from the capacity configuration version of the APU slot. The capacity configuration version is a system-level policy recipe that specifies, in the form of metadata, "which atomic images should be loaded onto which APU slots to cope with a specific business load scenario," thus forming a complete algorithm processing resource combination scheme. The APU slot is the smallest physically independent logic unit in the reconfigurable area of ​​the FPGA. Each slot has identical physical interfaces (clock, reset, data bus width, control signals), independent power gating, and independent reset control, serving as the "physical slot" carrying the algorithm engine. In this invention, each APU slot in the reconfigurable area is physically isomorphic, therefore any slot can load an atomic image of any algorithm. The static area in the FPGA remains operational during dynamic configuration, maintaining board-level interfaces, PCIe / Ethernet / AXI interfaces, DMA, task queues, data buffers, key indexes, status monitoring, configuration control, isolation control, and exception bypass. The reconfigurable region is divided into several independent APU slots, each following a unified logical interface specification, including task input interface, result output interface, key or key handle interface, status interface, error interface, and version identifier interface. The interface width, handshake timing, and reset behavior of the APU slots are compatible with those of the static region.

[0023] Step 15: When the switching trigger condition is met, the capacity demand vector is matched with each capacity configuration version in the preset capacity configuration version library to determine the target capacity configuration version; the capacity configuration version defines the number of engines, target slot allocation and total power consumption for each national cryptographic algorithm. The switching triggering conditions include: The queue depth of any algorithm exceeds the upper threshold for multiple consecutive sampling periods; If the processing latency or timeout rate of any algorithm continuously exceeds the service class threshold; Predict that a certain algorithmic service will reach its capacity limit within a preset time window in the future; A preset time strategy is implemented, such as SM4 enhancement during the day and batch SM3 summary enhancement at night; The upper-level management platform issues capacity adjustment policies or emergency priority policies; The current algorithm engine is malfunctioning or experiencing performance degradation, requiring a switch to a redundant version; Meet the hysteresis condition and minimum dwell time to avoid repeated switching in short cycles.

[0024] When any of the above switching trigger conditions are met, the preset capacity configuration version library is queried, and the configuration is matched against multiple stored capacity configuration versions. The capacity configuration version that best meets the current load requirements is selected for reconfiguration. The capacity configuration versions include, but are not limited to, the following: P0 Baseline Hybrid Version: This version has basic capacity for SM2, SM3 and SM4, and is suitable for daily mixed services. P1SM2 Enhanced Edition: This version increases the number of SM2 dot multiplication, signature or verification engines, and reduces some SM4 or SM3 resources. It is suitable for sudden business scenarios such as certificate authentication, key negotiation or signature. P2SM3 Enhanced Edition adds SM3 compression function pipelines or parallel digest channels, suitable for file verification, integrity verification or batch digest scenarios; P3SM4 Enhanced Edition adds SM4 encryption / decryption pipeline, parallel channel or mode processing unit, and is suitable for high-volume data encryption / decryption scenarios. P4 Hybrid High Concurrency Edition optimizes the parallel instance ratio of multiple algorithms within resource constraints, making it suitable for scenarios with frequent overlap of business types and high load. The P5 security downgrade version retains only the minimum necessary algorithms and diagnostic interfaces, and is suitable for scenarios such as loading failure, abnormal temperature or power supply, or resource failure.

[0025] Metadata for each capacity configuration version includes: configuration version number, build time, target FPGA model, static region interface version and compatible version range; number of SM2, SM3, and SM4 engine instances, number of parallel channels, pipeline depth, nominal throughput, nominal latency, and maximum queue capacity; logic resources, storage resources, DSP resources, clock resources, and power consumption estimates; configuration file length, digest value, digital signature, encryption attributes, authorization attributes, and anti-replay serial number; previous version, allowed source switching, corresponding cleanup files, rollback version, and maximum configuration duration; post-load self-test vector, expected results, interface probe values, and health check thresholds, etc.

[0026] Step 16: Configure the target capacity configuration version in the FPGA to obtain the configuration result. Here, the algorithm atomic image of the matched target capacity configuration version is loaded into the corresponding APU slot to form each algorithm engine instance. The configured capacity configuration version is then subjected to integrity verification to obtain a configuration result that is either successful (configuration passed) or unsuccessful (configuration failed).

[0027] Step 17: Based on the configuration results, process the cryptographic operation requests according to the capacity configuration version configured in the FPGA. When the configuration is successful, process each algorithm request according to the reconfigured target capacity configuration version; when the configuration fails, revert to the previous stable version before reconfiguration and generate alarms and audit records.

[0028] In this invention, the reconfigurable area of ​​the FPGA is divided into multiple homogeneous algorithm processing unit slots, forming a unified hardware resource pool. A standardized slot interface protocol ensures that any atomic image can be loaded into any slot and work collaboratively. Based on the capacity demand vector generated by real-time business load, the target capacity configuration scheme that best meets the current needs is matched from a preset capacity configuration version library, and atomic image distribution and loading are executed. Thus, while the FPGA remains powered on, limited hardware resources are dynamically concentrated on SM2, SM3, or SM4 algorithm processing according to business needs. This invention's online dynamic configuration method for FPGA national cryptographic algorithms breaks through the limitations of traditional fixed resource allocation or simply switching algorithm types. It achieves fine-grained elastic adjustment of algorithm capacity through a two-layer abstraction of "atomic image + system configuration." A complete online switching state machine (task suspension, in-transit emptying, interface isolation, atomic loading, security verification, self-test recovery, and automatic rollback) ensures lossless business operations and configuration security during the switching process, ultimately achieving a dual improvement in hardware resource utilization and cryptographic processing capacity.

[0029] In an optional embodiment of the present invention, step 14, obtaining the capacity demand vector based on the real-time load of multiple national cryptographic algorithm task queues, may include: Step 141: Obtain the task arrival rate and queue depth of each national cryptographic algorithm task queue, and smooth the task arrival rate and queue depth to obtain smoothed arrival rate and smoothed queue depth. The arrival rate of the task is denoted as The queue depth is denoted as The smoothing formula is:

[0030]

[0031] in, To smooth the arrival rate, The smooth arrival rate at time t-1 For the filter coefficients, the preferred ones are... . To smooth queue depth, Let be the smooth queue depth at time t-1. and The initial value is the arithmetic mean of the most recent 10 sampling periods.

[0032] Step 142: Based on the smooth arrival rate and smooth queue depth, as well as the preset nominal processing rate of the FPGA single engine and the preset maximum allowable queue depth, obtain the equivalent load factor. The nominal processing speed of the FPGA single engine is denoted as... This is obtained by reading from the currently loaded atomic image metadata. The maximum allowed queue depth is denoted as... The equivalent load factor ,in The preferred sensitivity coefficient for queue backlog is... The equivalent load factor, taking into account steady-state pressure, introduces a backlog penalty term. This introduces the additional emptying pressure caused by queue backlog into the capacity demand vector.

[0033] Step 143: Based on the equivalent load factor, obtain the number of engines required for the national cryptographic algorithm corresponding to the national cryptographic algorithm task queue. Since the physical meaning of the equivalent load factor is: under current business pressure, in order to maintain queue stability and avoid continuous backlog, the actual number of standard engine instances the system needs to deploy relative to the nominal processing capacity of a single engine, this multiple can be directly quantified as the number of engines required for the current national cryptographic algorithm. ,in The number of engines required for the national cryptographic algorithm, for example, if the current national cryptographic algorithm task queue is the SM2 task queue, then the number is calculated based on the real-time load of that queue. This represents the number of engines required for the SM2 national cryptographic algorithm.

[0034] Step 144: Obtain the waiting delay of historical tasks that have been processed in the national cryptographic algorithm task queue, and correct the number of engine instances according to the waiting delay to obtain the corrected number of engines. Here, the waiting latency of historical tasks is statistically analyzed, and the 95th percentile value of the waiting latency is calculated. This means that the waiting latency of 95% of the tasks is less than this percentile value, and only 5% of the tasks have a waiting latency greater than this percentile value. When the 95th percentile value exceeds a preset threshold, an emergency increment of 0.5 is added to the number of engines calculated in step 143, serving as the corrected number of engines. When the 95th percentile value does not exceed the preset threshold, no emergency increment is added.

[0035] Step 145: Obtain a preset first threshold and a second threshold; the first threshold is the upper threshold, and the second threshold is the lower threshold. To avoid frequent switching of the number of engines near the critical value, this embodiment introduces a dual threshold mechanism. Preferably, the value of the first threshold is equal to the current actual number of engines plus 0.7, and the value of the second threshold is equal to the current actual number of engines minus 0.5. That is... , ,in For the first threshold, This is the second threshold.

[0036] Step 146: Compare the corrected number of engines with the first threshold and the second threshold to determine the number of target engines required for the national cryptographic algorithm corresponding to the national cryptographic algorithm task queue; specifically, step 146 may include: Step 1461: When the corrected number of engines is greater than or equal to the first threshold, the corrected number of engines is rounded up to obtain the target number of engines required by the national cryptographic algorithm corresponding to the national cryptographic algorithm task queue; that is, when Then Round up. This represents the corrected number of engines. For example, If the 95th percentile of the waiting delay exceeds the preset threshold, then The current actual number of engines is 2. , Then Rounding up, the required number of target engines is 3.

[0037] Step 1462: When the corrected number of engines is less than or equal to the second threshold, the corrected number of engines is rounded down to obtain the target number of engines required by the national cryptographic algorithm corresponding to the national cryptographic algorithm task queue; that is, when Then Round down to the floor for the target number of engines. For example, If the 95th percentile of the waiting delay does not exceed the preset threshold, then The current actual number of engines is 3. , Then Rounded down to 0, since the system's minimum guaranteed value is 1, the required number of target engines is 1.

[0038] Step 1463: When the corrected number of engines is greater than the second threshold and less than the first threshold, the number of engines currently configured in the FPGA using the national cryptographic algorithm is taken as the target number of engines. That is, when... Then the target number of engines is equal to the current actual number of engines. For example, If the 95th percentile of the waiting delay does not exceed the preset threshold, then The current actual number of engines is 2. , .but Therefore, the required number of target engines is 2.

[0039] Step 147: Obtain the capacity requirement vector based on the number of target engines required for each national cryptographic algorithm. Combine the required number of target engines calculated for each national cryptographic algorithm task queue to obtain the capacity requirement vector. Taking the SM2, SM3, and SM4 national cryptographic algorithm task queues as an example, the capacity requirement vector is expressed as follows: .

[0040] In an optional embodiment of the present invention, step 15, matching the capacity demand vector with each capacity configuration version in a preset capacity configuration version library to determine the target capacity configuration version, may include: Step 151: Obtain the capacity vector for each capacity configuration version in the preset capacity configuration version library; the capacity vector is represented as... ,in Configure the capacity vector for version p of the capacity. The number of engines for the i-th national cryptographic algorithm provided for capacity configuration version p, where n is a positive integer; taking the three national cryptographic algorithms SM2, SM3, and SM4 as examples, the capacity vector is represented as follows: ,in The number of engines for the second national cryptographic algorithm SM2 provided for capacity configuration version p, The number of engines providing the third national cryptographic algorithm SM3 for capacity configuration version p, The number of engines for the fourth national cryptographic algorithm SM4 provided for capacity configuration version p.

[0041] Step 152: Compare the capacity demand vector with each dimension of the capacity vector to obtain a candidate version set; Specifically, step 152 may include: Step 1521, the capacity demand vector With the capacity vector In comparison, among them The number of target engines required for the i-th national cryptographic algorithm, Configure the capacity vector for version p of the capacity. The number of engines for the i-th national cryptographic algorithm provided for capacity configuration version p, where n is a positive integer; Step 1522, when i takes any value from 1 to n, the formula... When all conditions are met, the capacity configuration version p is used as a candidate version to obtain a candidate version set.

[0042] The initial screening process uses a hard condition that the number of engines for each national cryptographic algorithm provided by the capacity configuration version must be greater than the number of engines required for that national cryptographic algorithm in the capacity demand vector. Versions that pass this initial screening are then added to the candidate version set. In other words, for a given capacity demand vector... For a candidate capacity version p in the candidate version set, its capacity vector is... Must be satisfied , , .

[0043] Step 153: When the candidate version set is not empty, the version with the smallest total number of surplus engines in the candidate version set is taken as the target capacity configuration version. When there is exactly one candidate capacity configuration version in the candidate version set, that candidate capacity configuration version is directly used as the target capacity configuration version. When there are multiple candidate capacity configuration versions in the candidate version set, that is, multiple candidate capacity configuration versions can satisfy the requirements. Then, the total number of surplus engines for each candidate capacity configuration version is calculated, and the total number of surplus engines... Select the total number of surplus engines The smallest version is selected as the target capacity configuration version. It should be noted that when there are two candidate capacity configuration versions with the same total number of surplus engines, the version with the smallest surplus variance is selected as the target capacity configuration version.

[0044] Step 154: When the candidate version set is empty, determine the total effective coverage and the maximum gap dimension coverage of each capacity configuration version in the preset capacity configuration version library, and determine the target capacity configuration version based on the total effective coverage and the maximum gap dimension coverage.

[0045] Here, when the candidate version set is empty, it means that there is no capacity configuration version in the current capacity configuration version library that perfectly meets the engine quantity requirements of each national cryptographic algorithm. In this case, the full satisfaction constraint is abandoned, and the maximum gap coverage principle is instead executed, that is, the total effective coverage and the maximum gap dimension coverage are calculated for each capacity configuration version. The total effective coverage of capacity configuration version p... The maximum gap dimension coverage of capacity configuration version p is equal to when The maximum value corresponding to The value of . During the matching process, the total effective coverage is selected first. The largest capacity configuration version is selected as the target capacity configuration version when multiple capacity configuration versions have the same total effective coverage.

[0046] In an optional embodiment of the present invention, step 16, configuring the target capacity configuration version in the FPGA to obtain the configuration result, may include: Step 161: Receive the capacity configuration version reconfiguration instruction, suspend the delivery of atomic cryptographic tasks to the reconfigurable area, and clear any unfinished atomic cryptographic tasks in the reconfigurable area. Specifically, upon receiving the capacity configuration version reconfiguration instruction, the system enters the reconfiguration preparation state. It notifies the upper-layer scheduler to stop delivering new tasks to the area to be reconfigured, allowing unfinished tasks to be cleared within a timeout period. Tasks that cannot be completed within the time limit are migrated, saved, or canceled; necessary business context, sequence numbers, chained hash intermediate values, or session states are saved.

[0047] Step 162: Turn off the output valid signal of the reconfigurable area, confirm that the reconfigurable area is idle and reset the area; here, enable interface isolation logic, clear the cross-area FIFO, confirm that the area is idle and reset the area.

[0048] Step 163: Load the target capacity configuration version, and load the atomic images of national cryptographic algorithms contained in the target capacity configuration version into the target APU slot in the reconfigurable area to obtain the loading result; Here, the atomic image refers to a partial configuration file in .bit format, designed for a specific algorithm, a specific performance level, and with layout constraints within a specific range of physical slots. For example... Figure 2 As shown in the figure, in this embodiment, it is assumed that there are 8 APU slots in the reconfigurable area, and the resource allocation of each capacity configuration version in the capacity configuration version library is shown in Table 1 below.

[0049] Table 1, Capacity Configuration Versions

[0050] Assuming the target capacity configuration version is P2, each APU slot is reconfigured according to the P2 metadata.

[0051] Step 164: After the target capacity configuration version is loaded, verification is performed to obtain the verification result. Here, the configuration completion status and version identifier are read, and configuration file digest or signature verification, interface compatibility verification, and known answer self-check of the deployed modules of SM2, SM3, and SM4 are performed. After successful verification, the reset and isolation are lifted, the key handle mapping, task queue, and service routing are restored, new tasks are gradually released, and health indicators are observed.

[0052] Step 165: Obtain the configuration result based on the loading and verification results. Configuration is considered successful when the configuration version loads successfully and verification passes. Otherwise, configuration fails, and the previous stable version is rolled back.

[0053] In an optional embodiment of the present invention, step 17, processing the cryptographic operation request according to the configuration result and the capacity configuration version configured in the FPGA, may include: Step 171: When the configuration result is passed, the target capacity configuration version is successfully configured in the FPGA, and the atomic cryptographic tasks in the cryptographic operation request are encrypted according to the target number of national cryptographic algorithms specified in the target capacity configuration version. Step 172: If the configuration result is unsuccessful, the target capacity configuration version configuration fails, and the stable version before the FPGA reconfiguration is rolled back. The atomic cryptographic tasks in the cryptographic operation request are encrypted according to the target number of national cryptographic algorithms specified in the stable version.

[0054] In the embodiments of the present invention, the arrival rates and queue depths of SM2, SM3, and SM4 tasks are continuously collected during FPGA operation to form an algorithm capacity demand vector. Based on the capacity demand vector, a target capacity configuration version is selected from multiple pre-generated and securely stored FPGA configuration versions. Different configuration versions not only support different algorithm combinations but also correspond to different numbers of algorithm computing engines, different pipeline stages, parallel channel numbers, clock configurations, and resource partitioning methods. During the switching process, the system enters a reconfiguration protection state: new task delivery to the area to be reconfigured is suspended, and in-transit tasks are emptied, migrated, or saved; the data and control interfaces between the area to be reconfigured and the static area are isolated; the target configuration file is loaded without power loss on the FPGA; subsequently, the integrity, version identification, interface compatibility, and algorithm self-test results of the configuration file are verified. After successful verification, task routing and business processing are restored; if verification fails, the previous stable version or a security-downgraded version is automatically loaded. Through the above mechanism, with limited FPGA logic resources, hardware resources are dynamically concentrated on SM2, SM3, or SM4 processing according to the algorithm demand at different times, achieving elastic improvement in algorithm capabilities and capacity.

[0055] like Figure 3 As shown, embodiments of the present invention also provide an FPGA national cryptographic algorithm online dynamic configuration device 30, comprising: The acquisition module 31 is used to receive cryptographic operation requests, wherein the cryptographic operation requests include operation requests for at least one national cryptographic algorithm; Processing module 32 is used to decompose the operation request of at least one national cryptographic algorithm included in the cryptographic operation request to obtain at least one atomic cryptographic task; add the at least one atomic cryptographic task to the national cryptographic algorithm task queue corresponding to the national cryptographic algorithm of the atomic cryptographic task; obtain a capacity demand vector based on the real-time load of multiple national cryptographic algorithm task queues, wherein the capacity demand vector describes the capacity demand of each national cryptographic algorithm at the current moment; when the switching trigger condition is met, match the capacity demand vector with each capacity configuration version in the preset capacity configuration version library to determine the target capacity configuration version; the capacity configuration version defines the number of engines, target slot allocation and total power consumption of each national cryptographic algorithm; configure the target capacity configuration version in the FPGA to obtain the configuration result; and process the cryptographic operation request according to the capacity configuration version configured in the FPGA based on the configuration result.

[0056] Optionally, a capacity demand vector is obtained based on the real-time load of multiple national cryptographic algorithm task queues, including: Obtain the task arrival rate and queue depth of each national cryptographic algorithm task queue, and smooth the task arrival rate and queue depth to obtain smoothed arrival rate and smoothed queue depth; Based on the smooth arrival rate and smooth queue depth, as well as the preset nominal processing rate of the FPGA single engine and the preset maximum allowed queue depth, the equivalent load factor is obtained. Based on the equivalent load factor, the number of engines required for the national cryptographic algorithm corresponding to the national cryptographic algorithm task queue is obtained; Obtain the waiting delay of historical tasks that have been processed in the national cryptographic algorithm task queue, and adjust the number of engine instances according to the waiting delay to obtain the adjusted number of engines; Obtain the preset first threshold and second threshold; The corrected number of engines is compared with the first threshold and the second threshold to determine the target number of engines required by the national cryptographic algorithm corresponding to the national cryptographic algorithm task queue. The capacity requirement vector is obtained based on the number of target engines required for each national cryptographic algorithm.

[0057] Optionally, the corrected number of engines is compared with the first threshold and the second threshold to determine the number of target engines required for the national cryptographic algorithm corresponding to the national cryptographic algorithm task queue, including: When the corrected number of engines is greater than or equal to the first threshold, the corrected number of engines is rounded up to obtain the target number of engines required by the national cryptographic algorithm corresponding to the national cryptographic algorithm task queue. If the corrected number of engines is less than or equal to the second threshold, the corrected number of engines is rounded down to obtain the target number of engines required by the national cryptographic algorithm corresponding to the national cryptographic algorithm task queue. When the corrected number of engines is greater than the second threshold and less than the first threshold, the number of engines currently configured in the national cryptographic algorithm in the FPGA is taken as the target number of engines.

[0058] Optionally, the capacity demand vector is matched with each capacity configuration version in a preset capacity configuration version library to determine the target capacity configuration version, including: Obtain the capacity vector for each capacity configuration version in the preset capacity configuration version library; The capacity requirement vector is compared with each dimension of the capacity vector to obtain a candidate version set; When the candidate version set is not empty, the version with the smallest total number of surplus engines in the candidate version set is taken as the target capacity configuration version; When the candidate version set is empty, determine the total effective coverage and the maximum gap dimension coverage of each capacity configuration version in the preset capacity configuration version library, and determine the target capacity configuration version based on the total effective coverage and the maximum gap dimension coverage.

[0059] Optionally, the capacity demand vector is compared with each dimension of the capacity vector to obtain a candidate version set, including: The capacity demand vector With the capacity vector In comparison, among them The number of target engines required for the i-th national cryptographic algorithm, Configure the capacity vector for version p of the capacity. The number of engines for the i-th national cryptographic algorithm provided for capacity configuration version p, where n is a positive integer; When i takes any value from 1 to n, the formula When all conditions are met, the capacity configuration version p is used as a candidate version to obtain a candidate version set.

[0060] Optionally, the target capacity configuration version is configured in the FPGA to obtain the configuration result, including: Upon receiving a capacity configuration version reconfiguration instruction, pause the delivery of atomic cryptographic tasks to the reconfigurable area and clear any unfinished atomic cryptographic tasks in the reconfigurable area; Turn off the output valid signal of the reconfigurable region, confirm that the reconfigurable region is idle, and reset the region; Load the target capacity configuration version, and load the national cryptographic algorithm atomic images contained in the target capacity configuration version into the target APU slot in the reconfigurable region to obtain the loading result; Once the target capacity configuration version is loaded, verification is performed to obtain the verification result; The configuration result is obtained based on the loading result and the verification result.

[0061] Optionally, based on the configuration result, the cryptographic operation request is processed according to the capacity configuration version configured in the FPGA, including: When the configuration result is passed, the target capacity configuration version is successfully configured in the FPGA, and each atomic cryptographic task in the cryptographic operation request is encrypted according to the target number of national cryptographic algorithms specified in the target capacity configuration version. If the configuration result is unsuccessful, the target capacity configuration version configuration fails, and the stable version before the FPGA reconfiguration is rolled back. The atomic cryptographic tasks in the cryptographic operation request are encrypted according to the target number of national cryptographic algorithms specified in the stable version.

[0062] It should be noted that this device is the same as the method described above. All implementations in the above method embodiments are applicable to the embodiments of this device and can achieve the same technical effect.

[0063] Embodiments of the present invention also provide a computing device, including: a processor and a memory storing a computer program, wherein the computer program, when executed by the processor, performs the method as described above. All implementations in the above method embodiments are applicable to this embodiment and can achieve the same technical effects.

[0064] Embodiments of the present invention also provide a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the method as described above. All implementations in the above method embodiments are applicable to this embodiment and can achieve the same technical effects.

[0065] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0066] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0067] In the embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0068] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0069] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0070] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0071] Furthermore, it should be noted that in the apparatus and method of the present invention, it is obvious that the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered equivalent solutions of the present invention. Moreover, the steps performing the above series of processes can naturally be executed in the order described, but are not necessarily required to be executed in chronological order; some steps can be executed in parallel or independently of each other. Those skilled in the art will understand that all or any step or component of the method and apparatus of the present invention can be implemented in any computing device (including processors, storage media, etc.) or network of computing devices, in hardware, firmware, software, or a combination thereof. This is something that those skilled in the art can achieve by using their basic programming skills after reading the description of the present invention.

[0072] Therefore, the object of the present invention can also be achieved by running a program or a set of programs on any computing device. The computing device can be a known general-purpose device. Therefore, the object of the present invention can also be achieved simply by providing a program product containing program code implementing the method or apparatus. That is, such a program product also constitutes the present invention, and the storage medium storing such a program product also constitutes the present invention. Obviously, the storage medium can be any known storage medium or any storage medium developed in the future. It should also be noted that in the apparatus and method of the present invention, it is obvious that the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered equivalent to the present invention. Furthermore, the steps performing the above series of processes can naturally be performed in the order described, but are not necessarily required to be performed in chronological order. Some steps can be performed in parallel or independently of each other.

[0073] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for online dynamic configuration of FPGA national cryptographic algorithms, characterized in that, The field-programmable gate array (FPGA) is divided into a static region and a reconfigurable region containing multiple homogeneous algorithm processing unit (APU) slots. The method includes: Receive cryptographic operation requests, wherein the cryptographic operation requests include operation requests for at least one national cryptographic algorithm; The operation request of at least one national cryptographic algorithm included in the cryptographic operation request is decomposed to obtain at least one atomic cryptographic task; Add the at least one atomic cryptographic task to the national cryptographic algorithm task queue corresponding to the national cryptographic algorithm of the atomic cryptographic task; Based on the real-time load of multiple national cryptographic algorithm task queues, a capacity demand vector is obtained, which describes the capacity demand of each national cryptographic algorithm at the current moment. When the switching trigger condition is met, the capacity demand vector is matched with each capacity configuration version in the preset capacity configuration version library to determine the target capacity configuration version; the capacity configuration version defines the number of engines, target slot allocation and total power consumption for each national cryptographic algorithm; Configure the target capacity configuration version in the FPGA to obtain the configuration result; Based on the configuration results, the cryptographic operation request is processed according to the capacity configuration version configured in the FPGA.

2. The FPGA national cryptographic algorithm online dynamic configuration method according to claim 1, characterized in that, Based on the real-time load of multiple national cryptographic algorithm task queues, a capacity demand vector is obtained, including: Obtain the task arrival rate and queue depth of each national cryptographic algorithm task queue, and smooth the task arrival rate and queue depth to obtain smoothed arrival rate and smoothed queue depth; Based on the smooth arrival rate and smooth queue depth, as well as the preset nominal processing rate of the FPGA single engine and the preset maximum allowed queue depth, the equivalent load factor is obtained. Based on the equivalent load factor, the number of engines required for the national cryptographic algorithm corresponding to the national cryptographic algorithm task queue is obtained; Obtain the waiting delay of historical tasks that have been processed in the national cryptographic algorithm task queue, and adjust the number of engine instances according to the waiting delay to obtain the adjusted number of engines; Obtain the preset first threshold and second threshold; The corrected number of engines is compared with the first threshold and the second threshold to determine the target number of engines required by the national cryptographic algorithm corresponding to the national cryptographic algorithm task queue. The capacity requirement vector is obtained based on the number of target engines required for each national cryptographic algorithm.

3. The FPGA national cryptographic algorithm online dynamic configuration method according to claim 2, characterized in that, The corrected number of engines is compared with the first threshold and the second threshold to determine the target number of engines required for the national cryptographic algorithm corresponding to the national cryptographic algorithm task queue, including: When the corrected number of engines is greater than or equal to the first threshold, the corrected number of engines is rounded up to obtain the target number of engines required by the national cryptographic algorithm corresponding to the national cryptographic algorithm task queue. If the corrected number of engines is less than or equal to the second threshold, the corrected number of engines is rounded down to obtain the target number of engines required by the national cryptographic algorithm corresponding to the national cryptographic algorithm task queue. When the corrected number of engines is greater than the second threshold and less than the first threshold, the number of engines currently configured in the national cryptographic algorithm in the FPGA is taken as the target number of engines.

4. The FPGA national cryptographic algorithm online dynamic configuration method according to claim 1, characterized in that, The capacity requirement vector is matched with each capacity configuration version in a preset capacity configuration version library to determine the target capacity configuration version, including: Obtain the capacity vector for each capacity configuration version in the preset capacity configuration version library; The capacity requirement vector is compared with each dimension of the capacity vector to obtain a candidate version set; When the candidate version set is not empty, the version with the smallest total number of surplus engines in the candidate version set is taken as the target capacity configuration version; When the candidate version set is empty, determine the total effective coverage and the maximum gap dimension coverage of each capacity configuration version in the preset capacity configuration version library, and determine the target capacity configuration version based on the total effective coverage and the maximum gap dimension coverage.

5. The FPGA national cryptographic algorithm online dynamic configuration method according to claim 4, characterized in that, The capacity requirement vector is compared with each dimension of the capacity vector to obtain a candidate version set, including: The capacity demand vector With the capacity vector In comparison, among them The number of target engines required for the i-th national cryptographic algorithm, Configure the capacity vector for version p of the capacity. The number of engines for the i-th national cryptographic algorithm provided for capacity configuration version p, where n is a positive integer; When i takes any value from 1 to n, the formula When all conditions are met, the capacity configuration version p is used as a candidate version to obtain a candidate version set.

6. The FPGA national cryptographic algorithm online dynamic configuration method according to claim 1, characterized in that, The target capacity configuration version is configured in the FPGA to obtain the configuration result, including: Upon receiving a capacity configuration version reconfiguration instruction, pause the delivery of atomic cryptographic tasks to the reconfigurable area and clear any unfinished atomic cryptographic tasks in the reconfigurable area; Turn off the output valid signal of the reconfigurable region, confirm that the reconfigurable region is idle, and reset the region; Load the target capacity configuration version, and load the national cryptographic algorithm atomic images contained in the target capacity configuration version into the target APU slot in the reconfigurable region to obtain the loading result; Once the target capacity configuration version is loaded, verification is performed to obtain the verification result; The configuration result is obtained based on the loading result and the verification result.

7. The FPGA national cryptographic algorithm online dynamic configuration method according to claim 1, characterized in that, Based on the configuration results, the cryptographic operation request is processed according to the capacity configuration version configured in the FPGA, including: When the configuration result is passed, the target capacity configuration version is successfully configured in the FPGA, and each atomic cryptographic task in the cryptographic operation request is encrypted according to the target number of national cryptographic algorithms specified in the target capacity configuration version. If the configuration result is unsuccessful, the target capacity configuration version configuration fails, and the stable version before the FPGA reconfiguration is rolled back. The atomic cryptographic tasks in the cryptographic operation request are encrypted according to the target number of national cryptographic algorithms specified in the stable version.

8. An online dynamic configuration device for FPGA national cryptographic algorithms, characterized in that, include: The acquisition module is used to receive cryptographic operation requests, wherein the cryptographic operation requests include operation requests for at least one national cryptographic algorithm; The processing module is used to decompose the operation request of at least one national cryptographic algorithm included in the cryptographic operation request to obtain at least one atomic cryptographic task; and add the at least one atomic cryptographic task to the national cryptographic algorithm task queue corresponding to the national cryptographic algorithm of the atomic cryptographic task. Based on the real-time load of multiple national cryptographic algorithm task queues, a capacity demand vector is obtained, which describes the capacity demand of each national cryptographic algorithm at the current moment. When the switching trigger condition is met, the capacity demand vector is matched with each capacity configuration version in the preset capacity configuration version library to determine the target capacity configuration version. The capacity configuration version defines the number of engines, target slot allocation and total power consumption of each national cryptographic algorithm. The target capacity configuration version is configured in the FPGA to obtain the configuration result; according to the configuration result, the cryptographic operation request is processed according to the capacity configuration version configured in the FPGA.

9. A computing device, characterized in that, include: A processor, a memory storing a computer program, wherein the computer program, when executed by the processor, performs the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, A storage instruction that, when executed on a computer, causes the computer to perform the method as described in any one of claims 1 to 7.

Images