Data processing method, data processing apparatus, processor, chip, computing device, storage medium and computer program product

Abstract

Provided in the embodiments of the present disclosure are a data processing method, a data processing apparatus, a processor, a chip, a computing device, a storage medium and a computer program product. The data processing method is applied to a main processor core that is bound to a network card and configured with a cryptographic coprocessor, and comprises: receiving data packets to be processed that are sequentially sent by a network side, and then executing network layer processing to obtain data vectors; sequentially writing the data vectors into a ring buffer, such that a main processor core and a slave processor core acquire the data vectors; after the data vectors are acquired, using a cryptographic coprocessor to perform encryption / decryption processing on data indicated by the data vectors, so as to obtain first result data, and feeding result information back to the ring buffer; and on the basis of an indication of the data vectors in the ring buffer, sending result data to the network side, wherein the result data comprises the first result data, and second result data obtained after the slave processor core uses an encryption / decryption program to perform encryption / decryption processing on the data indicated by the data vectors. Thus, the full utilization of computing resources is realized.

Description

Data processing method, data processing apparatus, processor, chip, computing device, storage medium and computer program product

[0001] This application claims priority to Chinese Patent Application No. 202411329980.X, filed on September 23, 2024, the disclosure of which is incorporated herein in its entirety as part of the present application. TECHNICAL FIELD

[0002] Embodiments of the present disclosure relate to a data processing method, a data processing apparatus, a processor, a chip, a computing device, a storage medium and a computer program product. BACKGROUND

[0003] With the continuous development of information technology, the guarantee of data security is becoming more and more important. Among them, data security refers to the process of identifying the relative importance, sensitivity, compliance, etc. of various data sets such as files, databases, account information, etc. on the network by technical means, and taking appropriate security control measures to protect them. For example, various data on the network is protected by Internet Protocol Security (IPSec).

[0004] However, IPSec has a large computing power requirement in processing data on the network, and consumes a large amount of computing resources, making it easy to cause performance bottlenecks in IPSec when processing large data traffic.

[0005] In this context, how to fully utilize computing resources to ensure the computing power requirement of IPSec and improve data processing efficiency has become a technical problem that technicians in the field need to solve. SUMMARY

[0006] Therefore, embodiments of the present disclosure provide a data processing method, a data processing apparatus, a processor, a chip, a computing device, a storage medium and a computer program product to fully utilize computing resources and improve data processing efficiency.

[0007] To achieve the above object, the embodiments of the present disclosure provide the following technical solutions.

[0008] In a first aspect, the embodiments of the present disclosure provide a data processing method applied to a main processor core bound with a network card, and the main processor core is configured with a cryptographic co-processor, and the method comprises:

[0009] receiving a plurality of to-be-processed data packets sent by a network end in sequence;

[0010] performing network layer processing on the to-be-processed data packets to obtain a data vector;

[0011] sequentially record the data vectors into a ring buffer, so that the master processor core and the slave processor core located in the computing architecture where the master processor core is located obtain the data vectors;

[0012] after obtaining the data vectors, use the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vectors to obtain first result data, and feed back result information to the ring buffer;

[0013] based on the indication of the data vectors in the ring buffer, send the result data after performing encryption / decryption processing to a network end; wherein the result data includes the first result data and second result data, the second result data is obtained by the slave processor core after obtaining the data vectors, using encryption / decryption program to perform encryption / decryption processing on the data indicated by the data vectors, and feeding back result information to the ring buffer after obtaining the second result data.

[0014] Optionally, the cryptographic coprocessor is configured with a direct memory access queue;

[0015] Before the use of the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vectors after obtaining the data vectors, it further includes:

[0016] send the obtained data vectors to the direct memory access queue;

[0017] The use of the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vectors is specifically: using the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vectors in the direct memory access queue.

[0018] Optionally, the ring buffer includes a head and a tail, a head pointer indicating the position of the head is set corresponding to the head, and a tail pointer indicating the position of the tail is set corresponding to the tail;

[0019] The sequentially recording the data vectors into a ring buffer includes:

[0020] sequentially record the data vectors into the head position indicated by the head pointer of the ring buffer; wherein the head position indicated by the head pointer of the ring buffer advances one bit after recording each data vector;

[0021] The based on the indication of the data vectors in the ring buffer, sending the result data after performing encryption / decryption processing to the network end includes:

[0022] According to the tail position indicated by the tail pointer, result data after performing the encryption / decryption processing is sent to the network end based on the indication of the data vector in the ring buffer; wherein, the tail position indicated by the tail pointer of the ring buffer is advanced by one bit for each result data sent.

[0023] Optionally, a state flag bit corresponding to the data vector is set in the ring buffer, and the state flag bit is used to indicate the encryption / decryption processing state of the data indicated by the data vector.

[0024] After the result information is fed back to the ring buffer, the state flag bit is updated based on the result information; wherein, if the state flag bit is a first value, it indicates that the encryption / decryption processing of the data indicated by the data vector is not completed; and if the state flag bit is a second value, it indicates that the encryption / decryption processing of the data indicated by the data vector is completed.

[0025] Optionally, the result data after performing the encryption / decryption processing sent to the network end based on the indication of the data vector in the ring buffer has the state flag bit corresponding to the data vector in the ring buffer as the second value.

[0026] Optionally, the main processor core acquires the data vector in the ring buffer based on a compare-and-swap (CAS) mechanism.

[0027] Optionally, when the slave processor core is configured with a cryptographic coprocessor, the second result data included in the result data is obtained by the slave processor core using the cryptographic coprocessor to perform the encryption / decryption processing on the data indicated by the data vector after the slave processor core acquires the data vector, and the result information is fed back to the ring buffer after the second result data is obtained.

[0028] In a second aspect, the embodiments of the present disclosure provide a data processing method applied to a slave processor core, and the method comprises:

[0029] Acquiring a data vector in a ring buffer; wherein, the data vector is obtained by a main processor core located in a computing architecture in which the slave processor core is located, receiving a to-be-processed data packet sent by a network end, performing network layer processing on the to-be-processed data packet, and sequentially recording the data vector in the ring buffer; the main processor core is bound with a network card and is configured with a cryptographic coprocessor.

[0030] Using an encryption / decryption program to perform encryption / decryption processing on the data indicated by the acquired data vector to obtain second result data, and feeding back result information to the ring buffer.

[0031] Optionally, the slave processor core acquires the data vector in the ring buffer based on a compare-and-swap (CAS) mechanism.

[0032] Optionally, when the slave processor core is configured with a cryptographic coprocessor, the second result data is obtained by performing encryption / decryption processing on the data indicated by the data vector by using the cryptographic coprocessor, and after obtaining the second result data, result information is fed back to the ring buffer.

[0033] Optionally, a state flag bit is set in the ring buffer for the data vector, and the state flag bit is used to indicate the encryption / decryption processing state of the data indicated by the data vector.

[0034] After the result information is fed back to the ring buffer, the state flag bit is updated based on the result information; if the state flag bit is a first value, it indicates that the encryption / decryption processing of the data indicated by the data vector is not completed; if the state flag bit is a second value, it indicates that the encryption / decryption processing of the data indicated by the data vector is completed.

[0035] In a third aspect, an embodiment of the present disclosure provides a data processing apparatus applied to a master processor core bound with a network card, and the master processor core is configured with a cryptographic coprocessor, and the data processing apparatus comprises:

[0036] A receiving unit is configured to receive a plurality of to-be-processed data packets sent by a network end in sequence.

[0037] A processing unit is configured to perform network layer processing on the to-be-processed data packets to obtain a data vector.

[0038] A writing unit is configured to sequentially record the data vector in a ring buffer, so that the master processor core and a slave processor core located in a computing architecture of the master processor core acquire the data vector.

[0039] A master execution unit is configured to, after acquiring the data vector, perform encryption / decryption processing on the data indicated by the data vector by using the cryptographic coprocessor to obtain first result data, and feed back result information to the ring buffer.

[0040] A sending unit is configured to send the result data after performing encryption / decryption processing to the network end based on the indication of the data vector in the ring buffer; the result data comprises the first result data and second result data, the second result data is obtained by performing encryption / decryption processing on the data indicated by the data vector by using an encryption / decryption program after the slave processor core acquires the data vector, and after obtaining the second result data, result information is fed back to the ring buffer.

[0041] In a fourth aspect, the embodiments of the present disclosure provide a data processing apparatus, characterized in that, applied to a slave processor core, comprising:

[0042] an acquisition unit, configured to acquire a data vector in a ring buffer; wherein the data vector is a master processor core located in a computing architecture in which the slave processor core is located, receives a to-be-processed data packet sent by a network end, performs network layer processing on the to-be-processed data packet to obtain the data vector, and sequentially records the data vector in the ring buffer; the master processor core is bound with a network card and is configured with a cryptographic coprocessor;

[0043] a slave execution unit, configured to perform encryption / decryption processing on data indicated by the acquired data vector by using an encryption / decryption program, to obtain second result data, and to feed back result information to the ring buffer.

[0044] In a fifth aspect, the embodiments of the present disclosure provide a processor, comprising: a master processor core, a slave processor core and an asynchronous engine; the master processor core is bound with a network card and is configured with a cryptographic coprocessor;

[0045] the master processor core is configured to schedule the asynchronous engine and the cryptographic coprocessor to perform the data processing method according to the first aspect;

[0046] the slave processor core is configured to perform the data processing method according to the second aspect based on the scheduling of the master processor core on the asynchronous engine.

[0047] Optionally, the master processor core and the slave processor core are allocated at least according to initial state information of each processor core when the processor is initialized.

[0048] In a sixth aspect, the embodiments of the present disclosure provide a chip, comprising the processor according to the fifth aspect.

[0049] In a seventh aspect, the embodiments of the present disclosure provide a computing device, comprising the chip according to the sixth aspect.

[0050] In an eighth aspect, the embodiments of the present disclosure provide a storage medium, which stores one or more computer executable instructions, and the one or more computer executable instructions, when executed, implement the data processing method according to the first aspect or the second aspect.

[0051] In a ninth aspect, the embodiments of the present disclosure provide a computer program product, comprising one or more computer executable instructions, and the one or more computer executable instructions, when executed, implement the data processing method according to the first aspect or the second aspect.

[0052] The data processing method provided by the embodiment of the present disclosure can perform network layer processing on the received to-be-processed data packet sent by the network end based on the main processor core bound with the network card, obtain a data vector, and then sequentially record the data vector into a ring buffer, so that the main processor core and the slave processor core located in the computing architecture of the main processor core obtain the data vector, thereby fully utilizing the main processor core and the slave processor core to perform encryption / decryption processing, and improving the data processing efficiency.

[0053] Moreover, after obtaining the data vector, the main processor core can use the configured cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector by using the cryptographic coprocessor, obtain first result data, and feed back result information to the ring buffer, thereby realizing encryption / decryption processing on the data indicated by the data vector based on the hardware device (i.e., the cryptographic coprocessor); after obtaining the data vector, the slave processor core can use the encryption / decryption program to perform encryption / decryption processing on the data indicated by the data vector, obtain second result data, and feed back result information to the ring buffer, thereby realizing encryption / decryption processing on the data indicated by the data vector based on the software program (i.e., the encryption / decryption program). Furthermore, based on the indication of the data vector in the ring buffer, the result data after the encryption / decryption processing is sent to the network end. It can be seen that the encryption / decryption processing can be performed by using both hardware computing resources and software computing resources, thereby effectively guaranteeing the computing power requirement of IPSec. BRIEF DESCRIPTION OF DRAWINGS

[0054] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only embodiments of the present disclosure, and other drawings can be obtained by those skilled in the art without creative effort based on the provided drawings.

[0055] FIG. 1 is a flow diagram of data transmission between two communication parties in IPSec;

[0056] FIG. 2 is a data processing flow diagram in the synchronization engine mode of VPP;

[0057] FIG. 3 is a data processing flow diagram in the "dpdk_cryptodev" asynchronous engine mode of VPP;

[0058] FIG. 4 is an optional flow diagram of the data processing method provided by the embodiment of the present disclosure;

[0059] FIG. 5 is an optional structure diagram of the ring buffer provided by the embodiment of the present disclosure;

[0060] FIG. 6 is a schematic diagram of a data processing flow provided by an embodiment of the present disclosure;

[0061] FIG. 7 is a schematic diagram of performance comparison provided by an embodiment of the present disclosure;

[0062] FIG. 8 is an optional schematic diagram of a data processing apparatus provided by an embodiment of the present disclosure;

[0063] FIG. 9 is another optional schematic diagram of a data processing apparatus provided by an embodiment of the present disclosure; and

[0064] FIG. 10 is an optional block diagram of a computing device provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0065] The technical solutions in the embodiments of the present disclosure will be clearly and completely described below with reference to the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present disclosure.

[0066] Internet Protocol Security (IPSec) is a collection of protocols and services that provide security for IP networks, mainly used to establish a secure and protected private network on an insecure public network, and is a commonly used technology in VPN (Virtual Private Network). IPSec establishes an IPsec tunnel between two or more private networks on a public network, so that the communication parties use the IPSec tunnel to ensure the security of the VPN connection through encryption and verification algorithms. Specifically, the communication parties can establish a secure alliance through key exchange to form an IPSec tunnel, and the data flowing through the tunnel is protected by encryption and verification mechanisms to prevent data from being stolen and tampered with during transmission, and to ensure the security of data transmission.

[0067] Fig. 1 exemplarily shows a flow diagram of transmitting data by two communication parties in IPSec. As shown in Fig. 1, the IPSec sender and the IPSec receiver first generate and share a symmetric key, and the generation and sharing of the symmetric key can be implemented based on a key exchange protocol; then, the IPSec sender uses the symmetric key to encrypt IP packets by using an encryption algorithm, that is, the original IP data is encrypted and encapsulated to obtain IP ciphertext; then, the IPSec sender and the IPSec receiver process the IP ciphertext by using the same verification algorithm and verification key to obtain an integrity check value ICV (Integrity Check Value); then, the IPSec receiver compares the calculated ICV with the ICV value of the IPSec sender, and if they are the same, it indicates that the IP ciphertext has not been tampered with in the transmission process, and the IPSec receiver uses the same symmetric key as the IPSec sender to decrypt the IP ciphertext that passes the verification to obtain the IP plaintext, that is, the original IP data. If the calculated ICV of the IPSec receiver is different from the ICV value of the IPSec sender, it indicates that the IP ciphertext has been tampered with in the transmission process, and the IP ciphertext can be directly discarded.

[0068] In the process of transmitting data by the two communication parties in IPSec, the part enclosed by the dashed line in the figure has a large demand for computing power, and consumes a large amount of computing resources. When the data traffic transmitted by the sender and the receiver in IPSec is large, a performance bottleneck of data forwarding is prone to occur.

[0069] To solve the above problems, as an optional implementation, a synchronization engine in the VPP (Vector Packet Processing) technology can be used for data processing.

[0070] It should be noted that VPP has an IPSec function, which provides a framework for processing IPSec data plane forwarding, and supports registering various encryption / decryption engines to provide algorithm support for IPSec.

[0071] The VPP can abstract each functional block (i.e. a software or hardware module responsible for performing a specific network operation task, which can involve various stages of packet processing, such as filtering, encryption, decryption, load balancing, etc.) as a directed graph node, with a set of data vectors input to each node, so that the data vectors can be processed in the same way inside the node to maximize CPU instruction cache efficiency. After each node completes the execution of one or a class of fixed functions, all nodes can be organized into a tree graph, starting from an entry node. When a node has finished processing the data vectors, the data vectors are sent to the next node for processing according to the processing logic, from the receiving node to the sending node, or discarded along the way.

[0072] To ensure the hit rate of data in the cache, the VPP can bind the receive queue (RX queue) of the network card to a fixed processor thread, and in a multi-core processor, all threads can form a one-to-one correspondence with the processor cores. Therefore, during the entire software running period, the packet reception of the network card can be processed by the fixed processor core, and all processor cores, whether bound to the network card or not, have the function of processing other VPP nodes.

[0073] When processing data, the crypto engine provided by the VPP can be divided into a synchronous engine and an asynchronous engine. In the synchronous engine mode, the caller's call to the data processing algorithm function is synchronous, i.e. when the called function returns, the data has been processed. In the asynchronous engine mode, the caller's call to the data processing algorithm function is asynchronous, i.e. when the called function returns, the data has been arranged to other modules for data processing, and the processing result is notified to the caller through polling or interruption later.

[0074] In the VPP synchronous engine mode, as shown in FIG. 2, for a multi-core processor, in order to improve the network data processing performance, the data processing work of the network card can be allocated to a specific processor core X, i.e., only the processor core bound with the network card can receive the data packet sent by the network end. The interval of the dashed line in FIG. 2 is the thread of the processor core X. On the thread of the processor core X, the four stages of receiving the data packet sent by the network end (i.e., packet receiving), network layer processing of the data packet, encryption / decryption operation, and sending the processed data packet to the network end (i.e., packet sending) are experienced. The network layer processing can include packet fragmentation and reassembly, such as when the data packet is too large, the data packet needs to be divided into smaller fragments at the network layer, and the fragmentation information is recorded so as to correctly assemble the other fragments when they are received later; data analysis, such as analyzing the IP, TCP / UDP, and other network protocol headers to determine the destination address, source address, port number, and protocol type of the data packet; route lookup, such as querying the routing table according to the destination address of the data to determine how to forward the data packet; security check of the data, such as verifying the integrity and identity authentication information of the AH or ESP header encapsulated by the IPSec data packet to ensure the confidentiality and authenticity of the data; and establishment of a transmission tunnel.

[0075] However, in the VPP synchronous engine mode, only the single processor core X bound with the network card can execute the entire process of packet receiving to packet sending, so when the data traffic exceeds the processing capacity of the processor core X, even if other processor cores in the multi-core processor are in an idle state, they cannot share the processing task of the processor core X, which limits the concurrency capability of the multi-core processor and makes the computing resources of the multi-core processor cannot be effectively utilized.

[0076] In order to utilize the multi-thread processing performance of the multi-core processor, as another optional implementation, the asynchronous engine in the VPP technology can be used for data processing.

[0077] It should be noted that the VPP has two asynchronous engines, namely "sw_scheduler" and "dpdk_cryptodev". "sw_scheduler" is a software scheduler, mainly used to manage the input and output operations of the processor inside the VPP, and decompose the processing task of the data packet to different processor cores, to realize high-performance data flow scheduling in a multi-core environment. "dpdk_cryptodev" is the encryption device driver module of the DPDK (Data Plane Development Kit) data plane development kit. dpdk_cryptodev can provide a hardware acceleration-based way for the processor to process the encryption / decryption operations of the data packet.

[0078] It should be further noted that the data plane development kit (hereinafter referred to as "DPDK") is a user space network development platform, focusing on the performance optimization of high-speed network data paths, and is usually used in high-performance network applications such as load balancing, firewalls and switches, etc., and provides a set of libraries and driver programs, so that the processor can quickly process data packets. Based on DPDK, network data packets can be sent and received. When receiving the data packet sent by the network end, the processing device can divide the data packet into multiple data vectors, and the data vector is a memory area with a certain size, which corresponds to the memory address information. Each data vector can contain at most 256 memory addresses of data packets. DPDK includes an important component VDEV (Virtual Device). VDEV is a virtual device driver that provides an abstraction layer that can be both a software abstraction and a hardware abstraction, allowing developers to create and configure virtual devices. These virtual devices can be abstracted real hardware devices or user-developed software devices, such as network cards, cryptographic co-processors, etc.; user-developed software devices such as openssl encryption / decryption algorithms, loopback interfaces, and internal queues, etc.

[0079] Moreover, in the data processing process, a high-performance, memory-based network data packet queue structure, namely a ring buffer, is provided. The data vector is stored in the ring buffer in a first-in, first-out (FIFO) manner, so that the order of data writing corresponds to the order of data reading, efficiently transferring data between the kernel space and the user space, reducing the context switching and memory copying of the kernel space, and significantly improving the network throughput and delay.

[0080] In the DPDK environment, VPP can use the DPDK API (application program interface of DPDK) to create and manage devices using VDEV. Developers can create multiple VDEV instances, each corresponding to a physical network interface or a software-simulated interface, thereby being able to directly access hardware, reducing the overhead of the operating system, and achieving more efficient packet processing. VPP configures each network interface as a large, lock-free ring buffer through VDEV, so that the receiving and sending operations of the data packet can be concurrently performed between multiple processor core threads of the processor, greatly improving the network processing capability.

[0081] Taking the processor core 0 to the processor core n as multiple processor cores of a processor, and the processor core 0 and the network card as an example, the data processing flow in the "sw_scheduler" asynchronous engine mode of VPP is described. When processing the network traffic of IPSec in the "sw_scheduler" asynchronous engine mode of VPP, in order to improve the overall performance, the processor core 0 can be configured to have the right to receive and send data packets to the network end. Therefore, after receiving the data packet sent by the network end, the processor core 0 can perform network layer processing on the data packet, that is, perform corresponding operations according to the rules of the network protocol stack, such as checking the header information, routing selection, etc., and combine the processed data packet into a data vector and store it in a specially designed ring buffer. Among them, the ring buffer provides a data vector extraction function to the processor core 1 to the processor core n, so that the encryption / decryption calculation task of the data vector stored in the ring buffer can be shared by the processor core 1 to the processor core n, that is, the data vector is non-blockingly distributed to the processor core 1 to the processor core n to perform encryption / decryption processing using a software algorithm, and the encryption / decryption program can be a software program for performing data encryption / decryption operations.

[0082] Among them, Fig. 3 exemplarily shows a data processing flow diagram in the "dpdk_cryptodev" asynchronous engine mode of VPP. As shown in Fig. 3, when processing the network traffic of IPSec in the "dpdk_cryptodev" asynchronous engine mode of VPP, in order to improve the overall performance, the processor core 0 can be configured to be bound with the network card and have the right to receive data packets from the network end. Moreover, after receiving the data packet sent by the network end, the processor core 0 can perform network layer processing on the data packet, and combine the processed data packet into a data vector and send it to the VDEV managed by the DPDK for encryption / decryption processing by the cryptographic co-processor abstraction.

[0083] However, for the asynchronous engine mode of the VPP, although the "sw_scheduler" asynchronous engine can send the computing task to the processor core 1 to the processor core n for execution, the software computing capability of the multiple processor cores is utilized, but the cryptographic co-processor is not utilized. The "dpdk_cryptodev" asynchronous engine only uses the core 0 bound with the network card to meet the need of delivering data to the cryptographic co-processor, and the software computing resources of the idle other processor cores (i.e., the processor core 1 to the processor core n) cannot be utilized. Obviously, both the "sw_scheduler" asynchronous engine and the "dpdk_cryptodev" asynchronous engine waste the computing resources, and the hardware resources and the software resources cannot be used simultaneously.

[0084] Therefore, the embodiments of the present disclosure provide a new data processing scheme, and the master processor core bound with the network card and the slave processor core in the computing architecture of the master processor core both obtain the data vector in the ring buffer, so that the master processor core and the slave processor core can be fully utilized to perform the encryption / decryption processing, and the data processing efficiency is improved. In addition, when the master processor core is configured with the cryptographic co-processor, the master processor core can perform the encryption / decryption processing on the data indicated by the data vector by using the cryptographic co-processor after obtaining the data vector, and the slave processor core can perform the encryption / decryption processing on the data indicated by the data vector by using the encryption / decryption program after obtaining the data vector, so that the hardware computing resources and the software computing resources can be simultaneously utilized to perform the encryption / decryption processing, and the computing power requirement of IPSec is effectively ensured.

[0085] Based on the above idea, FIG. 4 exemplarily shows an optional flowchart of the data processing method of the embodiments of the present disclosure. As shown in FIG. 4, the method can include the following steps:

[0086] In step S100, the master processor core receives the data packets to be processed sent by the network in sequence.

[0087] The master processor core can be the processor core bound with the network card based on the consideration of improving the overall performance of the processor, and the master processor core can be configured with the cryptographic co-processor to provide the master processor core with the encryption / decryption service, the digest calculation service and the like based on the hardware device. The cryptographic co-processor is internally fixed with a chip private key, which is not allowed to be read by any device other than the cryptographic co-processor, so as to ensure the security of the data.

[0088] It can be understood that in the processor core provided with the cryptographic coprocessor, since the device performing the data encryption / decryption operation is the cryptographic coprocessor, the processor core is only responsible for data interaction with the cryptographic coprocessor, and only involves logical judgment and memory copy operation in the algorithm process, and the occupancy rate is low, and the computing power is relatively abundant. Thus, in order to effectively utilize the idle computing power of the processor core, the processor core can be bound with the network card, so as to perform the receiving and sending work of the to-be-processed data packet sent by the network end and the network layer processing work. The processor core bound with the network card can be referred to as a "master processor core", and other processor cores in the computing architecture where the master processor core is located can be referred to as "slave processor cores". As an optional implementation, the master processor core and the slave processor core can be obtained according to the initial state information of each processor core in the initialization stage of the multi-core processor. Moreover, in the chip with the cryptographic coprocessor, the processor core configured with the cryptographic coprocessor can be matched with the cryptographic coprocessor according to the number of the cryptographic coprocessors, so that the processor core configured with the cryptographic coprocessor can perform the data encryption / decryption operation by using hardware, and the processor core without the cryptographic coprocessor can perform the data encryption / decryption operation by using software (for example, encryption / decryption program). The master processor core must be configured with the cryptographic coprocessor.

[0089] In step S110, the master processor core performs network layer processing on the to-be-processed data packet to obtain a data vector.

[0090] By performing network layer processing on the to-be-processed data packet by the master processor core, a data vector can be obtained, which can correspond to an indication of the data memory address of the to-be-processed data packet.

[0091] In step S120, the master processor core sequentially records the data vector in the ring buffer.

[0092] In the process of data processing by using the VPP technology, based on the ring buffer provided by the VPP technology for storing the data vector, in order to reduce the context switching and memory copy of the kernel space, improve the throughput of the network and reduce the delay, the master processor core can sequentially record the data vector obtained by performing network layer processing on the to-be-processed data packet in the ring buffer according to the order of receiving the to-be-processed data packet.

[0093] It should be noted that the ring buffer of the embodiments of the present disclosure can correspond to all processor cores in the multi-core processor, so that all processor cores can obtain data vectors in the ring buffer. That is, by sequentially recording data vectors into the ring buffer by the master processor, the master processor core can perform step S130, the master processor core obtains data vectors in the ring buffer, and the slave processor core located in the computing architecture of the master processor core performs step S140, the slave processor core obtains data vectors in the ring buffer, so as to fully utilize the master processor core and the slave processor core to perform encryption / decryption processing, and improve the data processing efficiency.

[0094] Further, after obtaining the data vector, the master processor core can perform step S150, and the slave processor core can perform step S160.

[0095] Step S150, the master processor core uses the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector.

[0096] Step S160, the slave processor core uses the encryption / decryption program to perform encryption / decryption processing on the obtained data indicated by the data vector.

[0097] In the case where the master processor core is configured with a cryptographic coprocessor, the master processor core can use the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the obtained data vector, so as to obtain first result data, and feed back result information to the ring buffer. The slave processor can use the encryption / decryption program to perform encryption / decryption processing on the data indicated by the obtained data vector, so as to obtain second result data, and feed back result information to the ring buffer.

[0098] It should be noted that as an optional implementation, when the slave processor core is configured with a cryptographic coprocessor, based on the role of the cryptographic coprocessor in performing encryption / decryption operation on data, the second result data obtained in step S160 can be obtained by the slave processor core using the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the obtained data vector, and after obtaining the second result data, feeding back result information to the ring buffer. In the case where the cryptographic coprocessor is configured with a direct memory access queue, the slave processor core can send the obtained data vector to the direct memory access queue, so that when using the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the obtained data vector, the cryptographic coprocessor can be used to perform encryption / decryption processing on the data indicated by the data vector in the direct memory access queue.

[0099] The result information can be that the data indicated by the data vector is in the process of encryption / decryption, the encryption / decryption of the data indicated by the data vector fails, or the encryption / decryption of the data indicated by the data vector succeeds. If the encryption / decryption of the data indicated by the data vector is in the process, it means that the encryption / decryption of the data indicated by the data vector is not completed. If the encryption / decryption of the data indicated by the data vector fails or succeeds, it means that the encryption / decryption of the data indicated by the data vector is completed.

[0100] It should be noted that, in the embodiment of the present disclosure, the main processor core uses the cryptographic co-processor to perform encryption / decryption processing on the data indicated by the obtained data vector, so that the main processor core can return to perform other operations immediately after sending the obtained data vector to the cryptographic co-processor. Since the slave processor core uses its own encryption / decryption program to perform encryption / decryption processing on the data indicated by the obtained data vector, the slave processor core can return to perform the next operation only after the encryption / decryption processing on the data indicated by the obtained data vector is completed.

[0101] In step S170, the main processor core sends the result data after encryption / decryption processing to the network side based on the indication of the data vector in the ring buffer.

[0102] In the case that the main processor core and the slave processor core both feed back the result information to the ring buffer, the result data can include first result data and second result data.

[0103] It can be seen that, in the embodiment of the present disclosure, the main processor core bound with the network card can perform network layer processing on the received network-side sent data packet to be processed to obtain a data vector, and then the data vector can be recorded in the ring buffer in sequence, so that the main processor core and the slave processor core located in the computing architecture of the main processor core can obtain the data vector, thereby fully utilizing the main processor core and the slave processor core to perform encryption / decryption processing, and improving the data processing efficiency.

[0104] Further, after obtaining the data vector, the main processor core can utilize the configured cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector by using the cryptographic coprocessor, obtain first result data, and feed back result information to the ring buffer, so as to perform encryption / decryption processing on the data indicated by the data vector based on a hardware device (i.e., the cryptographic coprocessor); after obtaining the data vector, the main processor core can utilize the encryption / decryption program to perform encryption / decryption processing on the data indicated by the data vector, obtain second result data, and feed back result information to the ring buffer, so as to perform encryption / decryption processing on the data indicated by the data vector based on a software program (i.e., the encryption / decryption program). Further, based on the indication of the data vector in the ring buffer, the result data after the encryption / decryption processing is sent to the network end. It can be seen that the encryption / decryption processing can be performed by using hardware computing resources and software computing resources at the same time, so as to effectively guarantee the computing power requirement of IPSec.

[0105] In some embodiments, in order to facilitate the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector, the cryptographic coprocessor of the embodiment of the present disclosure can be provided with a direct memory access queue (DMA queue) for storing the data vector required by the main processor core to perform encryption / decryption processing by the cryptographic coprocessor.

[0106] Therefore, after the main processor core obtains the data vector from the ring buffer, and before the main processor core performs encryption / decryption processing on the data indicated by the data vector by using the cryptographic coprocessor, the main processor core can also send the obtained data vector to the direct memory access queue.

[0107] Based on the storage of the data vector by the direct memory access queue, the main processor core performs encryption / decryption processing on the data indicated by the data vector by using the cryptographic coprocessor, which can specifically be that the main processor core performs encryption / decryption processing on the data indicated by the data vector in the direct memory access queue by using the cryptographic coprocessor.

[0108] In some embodiments, FIG. 5 exemplarily shows an optional structure schematic diagram of the ring buffer of the embodiment of the present disclosure. As shown in FIG. 5, the ring buffer can include a head (Head) and a tail (Tail), and a head pointer indicating the position of the head can be arranged corresponding to the head, and a tail pointer indicating the position of the tail can be arranged corresponding to the tail, so as to form a closed loop structure containing a fixed number of elements.

[0109] Based on the head-tail structure of the ring buffer, when sequentially writing data vectors into the ring buffer, the data vectors can be sequentially written into the head position indicated by the head pointer of the ring buffer. Wherein, the head position indicated by the head pointer of the ring buffer advances one bit (as shown by the arrow direction in the figure) for each data vector written.

[0110] In some embodiments, in order to realize the extraction of the processed result data in the ring buffer, a state flag bit corresponding to the data vector can be set in the ring buffer, which is used to indicate the encryption / decryption processing state of the data indicated by the data vector. Therefore, after the cryptographic coprocessor or the processor core feeds back the result information to the ring buffer, the state flag bit can be updated based on the result information. Wherein, if the state flag bit is a first value (for example, 0), it can indicate that the encryption / decryption processing of the data indicated by the data vector is not completed. If the state flag bit is a second value (for example, 1), it can indicate that the encryption / decryption processing of the data indicated by the data vector is completed.

[0111] As an optional implementation, based on the indication of the data vector in the ring buffer, the result data after encryption / decryption processing sent to the network end, the state flag bit corresponding to the data vector in the ring buffer can be the second value, that is, only the result data of the data indicated by the data vector whose state flag bit indicates completion can be sent to the network end in the ring buffer.

[0112] In some embodiments, since the ring buffer is a closed loop structure, when the main processor core and the slave processor core share the ring buffer, in order to ensure the data consistency of the ring buffer and avoid the race condition in the concurrent environment, the main processor core and the slave processor core can acquire the data vector in the ring buffer based on the compare and swap (CAS) mechanism. Wherein, the CAS mechanism provides an atomic operation way to check whether the current value has changed, if not, update the data, otherwise do nothing. Through the CAS operation, the threads of the processor core can compete in an asynchronous manner, which improves the concurrent performance of the system.

[0113] For the convenience of understanding the data processing method of the embodiments of the present disclosure, taking the processor cores 0 to n as a plurality of processor cores of a processor, and the processor core 0 being configured to be bound with the network card as an example, the processor core 0 and the processor core 1 are configured with a cryptographic coprocessor, and the data processing flowchart of the embodiments of the present disclosure is exemplarily shown in FIG. 6.

[0114] As shown in FIG. 6, the processor core 0 can perform the transceiving of the data packet and the network layer processing task on the thread to which the processor core 0 is online. After the processor core 0 sends the data vector obtained through the network layer processing to the ring buffer facing all the processor cores, the processor cores 0 to n can all obtain the data vector in the ring buffer and perform the encryption / decryption processing of the data.

[0115] Among them, since the processor core 0 and the processor core 1 are configured with a cryptographic coprocessor, the processor core 0 can send the data vector obtained by it to the direct storage access queue 0 of the corresponding cryptographic coprocessor 0 for storage, and then the cryptographic coprocessor 0 can obtain the data vector in the direct storage access queue 0, perform the encryption / decryption processing of the data indicated by the data vector, obtain the result data, and feed back the result information to the ring buffer. Similarly, the processor core 1 can send the data vector obtained by it to the direct storage access queue 1 of the corresponding cryptographic coprocessor 1 for storage, and then the cryptographic coprocessor 1 can obtain the data vector in the direct storage access queue 1, perform the encryption / decryption processing of the data indicated by the data vector, obtain the result data, and feed back the result information to the ring buffer. After the processor cores 2 to n obtain the data vector in the ring buffer, they can use the encryption / decryption program to perform the encryption / decryption processing of the data indicated by the data vector, obtain the result data, and feed back the result information to the ring buffer.

[0116] For the convenience of understanding the performance improvement degree of the data processing method of the embodiments of the present disclosure, the data processing performed based on the data processing method of the embodiments of the present disclosure can be simulated and compared with the data processing in the "dpdk_cryptodev" mode and the data processing in the "sw_scheduler" mode, and the performance comparison diagram shown in FIG. 7 is obtained, wherein the horizontal axis is the performance index of the data processing, and the vertical axis is the adopted data processing mode. As shown in FIG. 7, it can be seen that the data processing performance of the data processing mode of the embodiments of the present disclosure is obviously higher than the data processing performance in the "dpdk_cryptodev" mode and the data processing performance in the "sw_scheduler" mode.

[0117] It can be seen that the data processing method provided in the embodiments of the present disclosure can perform network layer processing on the received to-be-processed data packet sent by the network end based on the main processor core bound with the network card, obtain a data vector, and then sequentially record the data vector into the ring buffer, so that the main processor core and the slave processor core located in the computing architecture of the main processor core can obtain the data vector, thereby fully utilizing the main processor core and the slave processor core to perform encryption / decryption processing, and improving the data processing efficiency.

[0118] In addition, after obtaining the data vector, the main processor core can use the configured cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector by using the cryptographic coprocessor, obtain first result data, and feed back result information to the ring buffer, thereby realizing encryption / decryption processing on the data indicated by the data vector based on the hardware device (i.e., the cryptographic coprocessor). After obtaining the data vector, the slave processor core can use the encryption / decryption program to perform encryption / decryption processing on the data indicated by the data vector, obtain second result data, and feed back result information to the ring buffer, thereby realizing encryption / decryption processing on the data indicated by the data vector based on the software program (i.e., the encryption / decryption program). Furthermore, based on the indication of the data vector in the ring buffer, the result data after the encryption / decryption processing is sent to the network end, so that the hardware computing resources and the software computing resources are used to simultaneously perform encryption / decryption processing, thereby effectively guaranteeing the computing power requirement of IPSec.

[0119] The data processing device provided in the embodiments of the present disclosure can be applied to a main processor core bound with a network card, and the main processor core is configured with a cryptographic coprocessor. The data processing device can be configured to execute the data processing method implemented by the main processor core provided in the embodiments of the present disclosure. The following description can be considered as the functional modules required to be set by the data processing device to implement the data processing method provided in the embodiments of the present disclosure, and the following description can be mutually corresponding to the above description.

[0120] As shown in FIG. 8, the data processing device can include a receiving unit 81, a processing unit 82, a writing unit 83, a main execution unit 84, and a sending unit 85.

[0121] The receiving unit 81 is configured to receive to-be-processed data packets sent by the network end in sequence.

[0122] The processing unit 82 is configured to perform network layer processing on the to-be-processed data packet, and obtain a data vector.

[0123] a writing unit 83, configured to sequentially record the data vectors into the ring buffer, so that the master processor core and the slave processor cores located in the computing architecture where the master processor core is located obtain the data vectors;

[0124] a main execution unit 84, configured to, after obtaining the data vectors, perform encryption / decryption processing on the data indicated by the data vectors by using the cryptographic coprocessor, to obtain first result data, and feed back result information to the ring buffer;

[0125] a sending unit 85, configured to send the result data after performing the encryption / decryption processing to a network end based on the indication of the data vectors in the ring buffer; wherein the result data includes the first result data and second result data, the second result data is obtained by performing encryption / decryption processing on the data indicated by the data vectors by using an encryption / decryption program by the slave processor cores after obtaining the data vectors, and result information is fed back to the ring buffer after obtaining the second result data.

[0126] Optionally, the cryptographic coprocessor is configured with a direct memory access queue;

[0127] the main execution unit 84, after obtaining the data vectors, before performing the encryption / decryption processing on the data indicated by the data vectors by using the cryptographic coprocessor, further includes:

[0128] sending the obtained data vectors to the direct memory access queue;

[0129] the main execution unit 84 performs the encryption / decryption processing on the data indicated by the data vectors by using the cryptographic coprocessor, specifically: performing the encryption / decryption processing on the data indicated by the data vectors in the direct memory access queue by using the cryptographic coprocessor.

[0130] Optionally, the ring buffer includes a head and a tail, a head pointer indicating a position of the head corresponding to the head is arranged, and a tail pointer indicating a position of the tail corresponding to the tail is arranged;

[0131] the writing unit 83 sequentially records the data vectors into the ring buffer, including:

[0132] sequentially recording the data vectors into a position of the head indicated by the head pointer of the ring buffer; wherein the position of the head indicated by the head pointer of the ring buffer is advanced by one bit after recording each data vector;

[0133] the sending unit 85 sends the result data after performing the encryption / decryption processing to the network end based on the indication of the data vectors in the ring buffer, including:

[0134] According to the tail position indicated by the tail pointer, result data after performing the encryption / decryption processing is sent to the network side based on the indication of the data vector in the ring buffer; wherein the tail position indicated by the tail pointer of the ring buffer is advanced by one bit for each result data sent.

[0135] Optionally, a state flag bit is set in the ring buffer corresponding to the data vector, and the state flag bit is used to indicate the encryption / decryption processing state of the data indicated by the data vector.

[0136] After the main execution unit 84 feeds back the result information to the ring buffer, the state flag bit is updated based on the result information; wherein if the state flag bit is a first value, it indicates that the encryption / decryption processing of the data indicated by the data vector is not completed; if the state flag bit is a second value, it indicates that the encryption / decryption processing of the data indicated by the data vector is completed.

[0137] Optionally, the result data after performing the encryption / decryption processing sent by the sending unit 85 to the network side based on the indication of the data vector in the ring buffer, the state flag bit corresponding to the data vector in the ring buffer is the second value.

[0138] Optionally, the main processor core acquires the data vector in the ring buffer based on a compare-and-swap (CAS) mechanism.

[0139] Optionally, when the slave processor core is configured with a cryptographic coprocessor, the second result data sent by the sending unit 85 is obtained by performing the encryption / decryption processing on the data indicated by the acquired data vector by using the cryptographic coprocessor, and after obtaining the second result data, the result information is fed back to the ring buffer.

[0140] The embodiment of the present disclosure also provides a data processing apparatus, the structure of which can be referred to as shown in FIG. 9. The data processing apparatus can be applied to a slave processor core, and the data processing apparatus can be configured to perform the data processing method implemented by the slave processor core. Wherein, the content described below can be considered as the function modules required to be set by the data processing apparatus to implement the data processing method provided by the embodiment of the present disclosure. The content described below can be mutually corresponding with the content described above.

[0141] As shown in FIG. 9, the data processing apparatus can include an acquisition unit 91 and a slave execution unit 92.

[0142] The acquisition unit 91 is configured to acquire a data vector in a ring buffer; wherein the data vector is a master processor core located in a computing architecture in which the slave processor core is located, receives a to-be-processed data packet sent by a network end, performs network layer processing on the to-be-processed data packet, and sequentially records the data vector in the ring buffer; the master processor core is bound with a network card and is configured with a cryptographic coprocessor;

[0143] The execution unit 92 is configured to perform encryption / decryption processing on data indicated by the acquired data vector by using an encryption / decryption program, to obtain second result data, and to feed back result information to the ring buffer.

[0144] Optionally, the slave processor core acquires the data vector in the ring buffer based on a compare-and-swap (CAS) mechanism.

[0145] Optionally, when the slave processor core is configured with the cryptographic coprocessor, the second result data obtained by the execution unit 92 is obtained by performing encryption / decryption processing on the data indicated by the acquired data vector by using the cryptographic coprocessor, and after the second result data is obtained, result information is fed back to the ring buffer.

[0146] Optionally, a state flag bit is set in the ring buffer corresponding to the data vector, and the state flag bit is used to indicate the encryption / decryption processing state of the data indicated by the data vector.

[0147] After the execution unit 92 feeds back the result information to the ring buffer, the state flag bit is updated based on the result information; wherein if the state flag bit is a first value, it indicates that the encryption / decryption processing of the data indicated by the data vector is not completed; and if the state flag bit is a second value, it indicates that the encryption / decryption processing of the data indicated by the data vector is completed.

[0148] The disclosure also provides a processor which can be configured to perform the data processing method provided by the embodiments of the disclosure. In an optional implementation, in combination with the foregoing description, the processor can include a master processor core, a slave processor core and an asynchronous engine, the master processor core is bound with a network card and is configured with a cryptographic coprocessor. The functions and detailed structures of the master processor core, the slave processor core, the asynchronous engine and the cryptographic coprocessor can be referred to the descriptions in the corresponding parts in the foregoing description.

[0149] The master processor core is configured to schedule the asynchronous engine and the cryptographic coprocessor to perform the data processing method performed by the master processor core according to the embodiments of the disclosure.

[0150] The slave processor core is configured to perform the data processing method executed by the slave processor core based on the scheduling of the master processor core to the asynchronous engine.

[0151] In some embodiments, the master processor core and the slave processor core are assigned at least according to initial state information of each processor core when the processor is initialized.

[0152] Embodiments of the present disclosure also provide a chip comprising the processor provided by the embodiments of the present disclosure.

[0153] Embodiments of the present disclosure also provide a computing device, which can be configured by the chip described above to implement the data processing method provided by the embodiments of the present disclosure. As an optional implementation, FIG. 10 is an optional block diagram of a computing device provided by the embodiments of the present disclosure. As shown in FIG. 10, the electronic device can include at least one processor 1, at least one communication interface 2, at least one memory 3, and at least one communication bus 4.

[0154] In the embodiments of the present disclosure, the number of the processor 1, the communication interface 2, the memory 3, and the communication bus 4 is at least one, and the processor 1, the communication interface 2, and the memory 3 complete communication with each other through the communication bus 4.

[0155] Optionally, the communication interface 2 can be an interface of a communication module for network communication.

[0156] Optionally, the processor 1 can be a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a NPU (Neural Processing Unit), a FPGA (Field Programmable Gate Array), a TPU (Tensor Processing Unit), an AI chip, an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiments of the present disclosure, etc.

[0157] The memory 3 can include a high-speed RAM memory and can also include a non-volatile memory, such as at least one disk memory.

[0158] The memory 3 stores one or more computer executable instructions, and the processor 1 invokes the one or more computer executable instructions to execute the data processing method of the embodiments of the present disclosure.

[0159] The embodiment of the present disclosure further provides a storage medium, which stores one or more computer executable instructions, and the one or more computer executable instructions are executed to implement the data processing method according to the embodiment of the present disclosure.

[0160] The embodiment of the present disclosure further provides a computer program product, which comprises one or more computer executable instructions, and the one or more computer executable instructions are executed to implement the data processing method according to the embodiment of the present disclosure.

[0161] The above describes a plurality of embodiment schemes provided by the embodiment of the present disclosure, and each optional mode introduced by each embodiment scheme can be combined, cross-referenced in the case of no conflict, thereby extending a plurality of possible embodiment schemes, which can be considered as the embodiment schemes disclosed and published by the embodiment of the present disclosure.

[0162] Although the embodiment of the present disclosure is disclosed as above, the present disclosure is not limited to this. Any person skilled in the art can make various changes and modifications without departing from the spirit and scope of the present disclosure, and therefore the protection scope of the present disclosure should be subject to the scope defined by the claims.

Claims

1. A data processing method applied to a master processor core bound with a network card, wherein the master processor core is configured with a cryptographic coprocessor, and the method comprises: receiving data packets to be processed sent by a network end in sequence; performing network layer processing on the data packets to be processed to obtain data vectors; sequentially recording the data vectors in a ring buffer so that the master processor core and a slave processor core located in a computing architecture of the master processor core obtain the data vectors; after obtaining the data vectors, using the cryptographic coprocessor to perform encryption / decryption processing on data indicated by the data vectors to obtain first result data, and feeding back result information to the ring buffer; and based on the indication of the data vectors in the ring buffer, sending the result data after performing encryption / decryption processing to the network end, wherein the result data comprises the first result data and second result data, the second result data is obtained by performing encryption / decryption processing on data indicated by the data vectors by using an encryption / decryption program by the slave processor core after obtaining the data vectors, and after obtaining the second result data, feeding back result information to the ring buffer. The cryptographic coprocessor is configured with a direct memory access queue. Before the step of using the cryptographic coprocessor to perform encryption / decryption processing on data indicated by the data vectors after obtaining the data vectors, the method further comprises: sending the obtained data vectors to the direct memory access queue; and the step of using the cryptographic coprocessor to perform encryption / decryption processing on data indicated by the data vectors comprises using the cryptographic coprocessor to perform encryption / decryption processing on data indicated by the data vectors in the direct memory access queue. The ring buffer comprises a head and a tail, a head pointer indicating the position of the head is arranged corresponding to the head, and a tail pointer indicating the position of the tail is arranged corresponding to the tail.

2. The method of claim 1, wherein, The step of sequentially recording the data vectors in the ring buffer comprises: sequentially recording the data vectors in the position of the head indicated by the head pointer of the ring buffer; wherein the position of the head indicated by the head pointer of the ring buffer advances by one bit after recording each data vector. The step of sending the result data after performing encryption / decryption processing to the network end based on the indication of the data vectors in the ring buffer comprises: sending the result data after performing encryption / decryption processing to the network end based on the indication of the data vectors in the ring buffer according to the position of the tail indicated by the tail pointer; wherein the position of the tail indicated by the tail pointer of the ring buffer advances by one bit after sending each result data.

3. The method of claim 1 or 2, wherein, In the ring buffer, a state flag bit corresponding to the data vector is arranged, and the state flag bit is used to indicate the encryption / decryption processing state of data indicated by the data vector. ​ ​ ​ ​ 4. The method of claim 3, wherein, ​ After the result information is fed back to the ring buffer, the state flag bit is updated based on the result information; wherein, if the state flag bit is a first value, it indicates that the encryption / decryption processing of the data indicated by the data vector is not completed; if the state flag bit is a second value, it indicates that the encryption / decryption processing of the data indicated by the data vector is completed.

5. The method of claim 4, wherein, Based on the indication of the data vector in the ring buffer, the result data after the encryption / decryption processing is sent to the network end, and the state flag bit corresponding to the data vector in the ring buffer is the second value.

6. The method according to any one of claims 1 to 5, wherein, The master processor core acquires the data vector in the ring buffer based on a compare-and-swap (CAS) mechanism.

7. The method according to any one of claims 1-6, wherein, When the slave processor core is configured with a cryptographic coprocessor, the second result data included in the result data is obtained by the slave processor core using the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector after the data vector is acquired, and after the second result data is obtained, result information is fed back to the ring buffer.

8. A data processing method applied to a slave processor core, comprising: acquiring a data vector in a ring buffer; wherein the data vector is obtained by a master processor core located in a computing architecture in which the slave processor core is located, receiving a to-be-processed data packet sent by a network end, performing network layer processing on the to-be-processed data packet, and sequentially recording the data vector into the ring buffer; the master processor core is bound to a network card and is configured with a cryptographic coprocessor; performing encryption / decryption processing on the data indicated by the acquired data vector using an encryption / decryption program to obtain second result data, and feeding back result information to the ring buffer.

9. The method of claim 8, wherein, The slave processor core acquires the data vector in the ring buffer based on a compare-and-swap (CAS) mechanism.

10. The method of claim 8 or 9, wherein, When the slave processor core is configured with a cryptographic coprocessor, the second result data is obtained by using the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the acquired data vector, and after the second result data is obtained, result information is fed back to the ring buffer.

11. The method according to any one of claims 8-10, wherein, A state flag bit corresponding to the data vector is set in the ring buffer, and the state flag bit is used to indicate the encryption / decryption processing state of the data indicated by the data vector. After the result information is fed back to the ring buffer, the state flag bit is updated based on the result information; wherein, if the state flag bit is a first value, it indicates that the encryption / decryption processing of the data indicated by the data vector is not completed; if the state flag bit is a second value, it indicates that the encryption / decryption processing of the data indicated by the data vector is completed.

12. A data processing apparatus applied to a master processor core bound to a network card, and the master processor core is configured with a cryptographic coprocessor, comprising: a receiving unit configured to receive to-be-processed data packets sent by a network end in sequence; a processing unit configured to perform network layer processing on the to-be-processed data packets to obtain a data vector; a write unit configured to sequentially record the data vector into a ring buffer, so that the master processor core and a slave processor core located in a computing architecture in which the master processor core is located obtain the data vector; a main execution unit configured to, after obtaining the data vector, use the cryptographic co-processor to perform encryption / decryption processing on data indicated by the data vector to obtain first result data, and feed back result information to the ring buffer; a sending unit configured to send the result data after performing encryption / decryption processing to a network end based on the indication of the data vector in the ring buffer; wherein the result data includes the first result data and second result data, the second result data being obtained by the slave processor core using an encryption / decryption program to perform encryption / decryption processing on data indicated by the data vector after obtaining the data vector, and feeding back result information to the ring buffer after obtaining the second result data.

13. A data processing apparatus applied to a slave processor core, comprising: an obtaining unit configured to obtain a data vector in a ring buffer; wherein the data vector is obtained by a master processor core located in a computing architecture in which the slave processor core is located, receiving a to-be-processed data packet sent by a network end, performing network layer processing on the to-be-processed data packet to obtain the data vector, and sequentially recording the data vector into a ring buffer; the master processor core is bound to a network card and is configured with a cryptographic co-processor; a slave execution unit configured to use an encryption / decryption program to perform encryption / decryption processing on data indicated by the obtained data vector to obtain second result data, and feed back result information to the ring buffer.

14. A processor comprising: a master processor core, a slave processor core and an asynchronous engine; the master processor core is bound to a network card and is configured with a cryptographic co-processor; the master processor core is configured to schedule the asynchronous engine and the cryptographic co-processor to perform the data processing method according to any one of claims 1-7; the slave processor core is configured to perform the data processing method according to any one of claims 8-11 based on the scheduling of the master processor core on the asynchronous engine.

15. The processor of claim 14, wherein, the master processor core and the slave processor core are obtained based on initial state information of each processor core when the processor is initialized.

16. A chip comprising the processor according to any one of claims 14-15.

17. A computing device comprising the chip according to claim 16.

18. A storage medium storing one or more computer-executable instructions, wherein, the one or more computer-executable instructions, when executed, implement the data processing method according to any one of claims 1-7 or claims 8-11.

19. A computer program product comprising one or more computer-executable instructions that, when executed by a processor of a device, cause the device to perform the method of any of claims 1-18. the one or more computer-executable instructions, when executed, implement the data processing method according to any one of claims 1-7 or claims 8-11.

Images