Patent ID: 12223068

DETAILED DESCRIPTION

To make the objectives, technical schemes and advantages of the present disclosure clearer, the present disclosure will be further described below in detail by embodiments with reference to the accompanying drawings. It should be understood that the embodiments described herein are merely for illustrating the present disclosure, and are not intended to limit the present disclosure.

It should be understood that, in the description of the embodiments of the present disclosure, a plurality of (or multiple) means more than two; greater than, less than, more than, etc., are interpreted as excluding this number; and, above, below, within, etc., are interpreted as including this number. If described, the terms such as “first” and “second” are only for distinguishing the technical features, rather than indicating or implying relative importance or implicitly indicating the number of the involved technical features or the precedence relationship between the involved technical features.

In the field of communication or information security, a large number of secure computations based on security algorithms are needed. Since the security algorithms all involve the processing of data, particularly data packets, and can reach a certain security standard only after undergoing various complex operations, more system resources will be consumed and the processing capability of the whole communication system is thus affected. Therefore, how to efficiently perform secure computing is particularly important. In addition, it is also necessary to consider how to efficiently utilize algorithm cores to improve the processing efficiency of data packets and algorithm cores and improve the efficiency of security algorithms for multi-stage processing.

The implementations of the present disclosure will be described below in detail with reference to the accompanying drawings.

In a conventional secure computing system, as shown inFIG.1, all operations related to secure computing are completed by a processor101. For example, a central processing unit (CPU) accesses data for secure computing from a memory102and calls1to N secure algorithms (also referred to as algorithm cores103), to complete the secure computing in the CPU. In this computing environment, even if the efficiency of a single algorithm core103can be improved, due to the overwhelming workload of the CPU, the performance and efficiency of the whole secure computing system are still limited by the CPU.

The method, apparatus and system related to secure computing control and processing in the present disclosure are improved and optimized based on the conventional secure computing system, where some functions for data packet processing are released from the processor101(that is, the software is executed by the processor101, which is equivalent to a software environment) to the hardware for completion, thus realizing the cooperation of software and hardware. Thus, the purpose of reducing the delay of data packet processing in the whole computing environment is achieved. In the data packet processing system combining software and hardware shown inFIG.2, the secure computing apparatus104is a main unit for improving the data packet processing efficiency and performance.

With reference toFIG.2, the whole data packet processing system may include four parts, i.e., the processor101, the secure computing control apparatus104,1to N algorithm cores103and the memory102.

The processor101encapsulates and transmits a data packet message that includes data packet information on which secure computing is to be performed and secure computing configuration information corresponding to the data packet information.

The secure computing control apparatus104, referred to as a control apparatus or controller for short hereinafter, may be interpreted by those having ordinary skill in the art as a control apparatus for controlling secure computing, particularly for controlling secure computing to the data packets. The secure computing control apparatus104writes and reads data packet data to and from the memory102according to the data packet message through the procedure and units described below, and accelerates the processing of the data packets.

The 1 to N algorithm cores103, also referred to as security algorithms herein, perform specific secure computing.

The memory102mainly stores the data of the algorithm cores103and the data packet.

The operation process and specific structure of the secure computing control apparatus104will be described below in more detail based on the environment shown inFIG.2.

FIG.3is an overall flowchart of a secure computing control method according to an embodiment of the present disclosure. As shown inFIG.3, the method may be performed by the secure computing control apparatus104described above to realize hardware acceleration of data packets. The method includes, but is not limited to, the following S301to S306.

At S301, a first data packet message for secure computing is received from a processor101, where the first data packet message includes data packet information and secure computing configuration information corresponding to the data packet information.

At302, corresponding first data packet data is acquired from a memory102according to the data packet information of the first data packet message.

At S303, a corresponding security algorithm is selected according to the secure computing configuration information corresponding to the first data packet message.

At S304, secure computing is performed on the first data packet data by means of the selected security algorithm to generate secure computed second data packet data and a second data packet message corresponding to the second data packet data.

At S305, the second data packet data is transmitted to the memory102.

At S306, the second data packet message is transmitted to the processor101.

Based on the advantages of the high-speed parallel computation of the hardware, one or more of the above processes may be performed in parallel.

In an example, the processor101may be a central processing unit of a general-purpose computer, or an embedded processor or microprocessor used for a particular task, etc. The memory102may be an external memory, or a storage portion integrated inside the hardware.

In some implementations, the method described in this embodiment may be a control flow or control logic specific for the hardware. However, it should be understood that the method may also be a control flow specific for the software.

In some implementations, the interaction efficiency between the software and the hardware is further improved by queuing. In particular, the receiving of a first data packet message for secure computing from a processor101at S301may include: receiving one or more first data packet messages for secure computing from the processer101, where the one or more first data packet messages form a message input queue5011. The performing of secure computing on the first data packet data by means of the selected security algorithm at S304may include: performing secure computing on the first data packet data based on the message input queue5011according to the security algorithm corresponding to each piece of first data packet data.

The transmitting of the second data packet message to the processor101at S306includes: acquiring second data packet messages corresponding to the one or more first data packet messages, forming the second data packet messages into a message output queue5012, and transmitting the message output queue5012to the processor101. The second data packet message may include information of completed data packet tasks, for example, information about the data packet on which secure computing has been performed and the secure computing processing information corresponding to the information about the data packet.

In some implementations, the resources of the hardware may be efficiently allocated in the following way. One or more idle secure computing spatial resources are allocated for secure computing in accordance with the order of first data packet messages in the input queue5011, and secure computing is performed on the first data packet data according to the security algorithm corresponding to each piece of first data packet data. A plurality of secure computing spatial resources (e.g., encryption engines5031described below) may be constructed in the hardware, and all hardware resources are fully utilized to accelerate the secure computing of data packets through reasonable allocation. Since the data packet messages are managed in queues and flexibly allocated according to the resource condition, an output queue5012that is processed keeps corresponding to the input queue5011in terms of the order, so that proper order-preserving processing may be performed. For example, an order-preserving tag is added for each data packet message, so as to realize order-preserving output once secure computing is completed.

In some implementations, efficient and centralized packing can be realized in the hardware environment by splicing. The data packet information of the first data packet message includes segment information of the data packet. The first data packet data includes segment data corresponding to the segment information. The S302may accordingly include: acquiring segment data of the corresponding data packet from the memory102according to the segment information of the data packet, and splicing the segment data to generate data packet cache data. The spliced data may be immediately further processed, and the remaining segment data in the memory102is continuously retrieved and saved, so that a pipelined operation is realized and the processing time of data packets is effectively reduced.

In the hardware environment, the security algorithm and the data packet data may be read in parallel, thereby further reducing the processing time of data packets. In some implementations, the step S303may accordingly include: selecting one or more corresponding security algorithms from the memory102according to the secure computing configuration information corresponding to the first data packet message, and allocating the one or more security algorithms to the secure computing spatial resources.

In some implementations, the number of times of reading the memory102is decreased by caching by stages and multi-stage parallel and pipelined processing, so that efficient secure computing of data packets is realized. The secure computing configuration information of the first data packet message includes information of security algorithms to be selected, information of the order of processing by security algorithms, and security algorithm configuration information. The step S303accordingly may include: selecting and acquiring one or more corresponding security algorithms from the memory102according to the secure computing configuration information corresponding to the first data packet message. The performing of secure computing on the first data packet data through the selected security algorithm at S304may include: performing single-stage or multi-stage secure computing on the data packet cache data through the one or more selected security algorithms according to the secure computing configuration information and in the order of processing by security algorithms. As an example, single-stage secure computing is performed on the data packet cache data through one selected security algorithm, or multi-stage secure computing is performed on the data packet cache data through a plurality of selected security algorithms. The multi-stage secure computing means that multiple stages of secure computing are performed on the first data packet data through a plurality of security algorithms. For example, in a first stage of secure computing, encryption is performed by utilizing an encryption algorithm; and, in a second stage of secure computing, authentication is performed by calling an authentication algorithm. The multi-stage secure computing may also be classified into stage-by-stage secure computing and non-stage-by-stage secure computing. For example, after the first stage of secure computing is completed, it is possible to directly skip to the processing in a third stage according to actual needs without performing the authentication in the second stage. The single-stage secure computing means that a single stage of secure computing is performed on the first data packet data by utilizing only one security algorithm. For example, only encryption is to be performed on some data packets by calling an encryption algorithm.

In accordance with an embodiment of the present disclosure, a secure computing control apparatus is further provided. As shown inFIG.10, the apparatus includes: a storage device1001, a processing unit1002and computer programs stored on the storage device1001and executable by the processing unit1002which, when executed by the processing unit1002, cause the processing unit1002to implement the secure computing control method described above.

FIG.4depicts an overall flowchart of a data packet processing method according to an embodiment of the present disclosure, which may be applied to the data packet processing system shown inFIG.2. The system includes: a processor101, a memory102and a secure computing control apparatus104that is connected to the processor101and the memory102, respectively. As shown inFIG.4, the method includes, but is not limited to, the following S401to S405.

At S401, the processor101transmits a first data packet message for secure computing to the secure computing control apparatus104, where the first data packet message includes data packet information and secure computing configuration information corresponding to the data packet information.

At S402, the secure computing control apparatus104acquires corresponding first data packet data from the memory102according to the data packet information of the first data packet message.

At S403, the secure computing control apparatus104selects a corresponding algorithm core103(i.e., security algorithm) according to the secure computing configuration information corresponding to the first data packet message.

At S404, the secure computing control apparatus104performs secure computing on the first data packet data through the algorithm core103to generate secure computed second data packet data and a second data packet message corresponding to the second data packet data, and outputs the second data packet data to the memory102.

At S405, the secure computing control apparatus104transmits the second data packet message to the processor101.

In some implementations, the data packet processing method in the embodiment is applied to the whole data packet processing system shown inFIG.2, so as to efficiently process data packets by the cooperation of software and hardware.

FIG.5depicts a schematic diagram showing modules of a secure computing control apparatus104according to an embodiment of the present disclosure. As shown inFIG.5, the secure computing control apparatus104includes a management module401and a control module402.

The management module401is configured to: receive a first data packet message for secure computing from a processor101, the first data packet message including data packet information and secure computing configuration information corresponding to the data packet information; and transmit a second data packet message to the processor101.

The control module402is connected to the management module401and is configured to: acquire corresponding first data packet data from a memory102according to the data packet information of the first data packet message; select a corresponding security algorithm according to the secure computing configuration information corresponding to the first data packet message; perform secure computing on the first data packet data through the security algorithm to generate secure computed second data packet data and a second data packet message corresponding to the second data packet data; and transmit the second data packet data to the memory102.

In some implementations, the management module401includes a queue management unit501and a task management unit502.

The queue management unit501includes an input queue, where one or more first data packet messages are formed into a message input queue; and an output queue, where the second data packet messages corresponding to the one or more first data packet messages are formed into a message output queue to be transmitted to the processor101.

The task management unit502is connected to the queue management unit501and is configured to: perform order-preserving processing on each data packet message in an order of first data packet messages in the input queue, allocate the first data packet messages in the input queue to one or more encryption engines of the control module402for secure computing processing, and transmit the second packet messages to the output queue of the queue management unit501.

The control module402includes an encryption control unit503and an arbitration selector504.

The encryption control unit503includes one or more encryption engines. The encryption engines are configured to select and call one or more corresponding security algorithms according to the secure computing configuration information of the first data packet message and perform secure computing on the first data packet data according to the security algorithm corresponding to each piece of first data packet data. In some implementations, the one or more corresponding security algorithms are read from the memory102.

The arbitration selector504is connected to the encryption control unit503and configured to establish, according to the allocated first data packet message, routing links between the one or more encryption engines of the encryption control unit and the one or more selected security algorithms.

The secure computing control apparatus104in this embodiment may be applied to the data packet processing system shown inFIG.2. It should be understood by those having ordinary skill in the art that the secure computing control apparatus104may also be applied to other hardware environments or software-hardware environments that require secure computing, so as to efficiently control the secure computing of data packets.

FIG.6depicts a schematic diagram of internal construction of the secure computing control apparatus104according to an embodiment of the present disclosure, with more details. As shown inFIG.6, the secure computing control apparatus includes a queue management unit501, a task management unit502, an encryption control unit503and an arbitration selector504.

The queue management unit501includes an input queue5011and an output queue5012. The input queue5011includes one or more first data packet messages for secure computing received from a memory101, each first data packet message includes data packet information and secure computing configuration information corresponding to the data packet information.

The output queue5012includes secure computed second data packet messages, and is configured to transmit the second data packet messages to the processor101.

The task management unit502is connected to the queue management unit501and is configured to: perform order-preserving processing on the one or more received first data packet messages, allocate the order-preserved one or more first data packet messages to encryption engines5031of the encryption control unit503for secure computing, and transmit the second data packet messages to the queue management unit501.

The encryption control unit503is connected to the task management unit502. The encryption control unit503includes one or more encryption engines5031. Each encryption engine5031is configured to: read corresponding first data packet data from the memory102according to the data packet information of the allocated first data packet messages, select and read one or more corresponding security algorithms from the memory102according to the secure computing configuration information of the allocated first data packet messages, perform secure computing on the allocated first data packet data through the one or more selected security algorithms to generate secure computed second data packet and second data packet messages corresponding to the second data packet data, and transmit the second data packet messages to the memory102.

The arbitration selector504is connected to the encryption control unit503and configured to establish, according to the allocated first data packet messages, routing links between the one or more encryption engines5031of the encryption control unit503and the one or more selected security algorithms.

In some implementations, the secure computing control apparatus104may be implemented as an application specific integrated circuit (ASIC), a programmable logic device, a system on chip (SOC), etc., into which the hardware control logic may be fixedly written or programmed.

In some implementations, the queue management unit501is configured to interact with the processor101. It can be appreciated that, the queue management unit501is interacting with the software via the processor101. The input queue5011stores task information of data packet to be processed, i.e., the one or more first data packet messages. A determination is performed according to the state of the queue as to whether there is a task to be processed. In case that the input queue5011is in a non-null state, one or more first data packet messages are extracted from the input queue5011and transmitted to the task management unit502. In some implementations, the output queue5012stores the information of secure computed data packet tasks, i.e., the second data packet messages. Once the secure computing is completed, the second data packet messages are transmitted to the output queue5012by the task management unit502for subsequent processing(s).

In some implementations, the task management unit502is configured to perform order-preserving processing and scheduling. During the order-preserving processing, as an example, an order-preserving tag is added to each first data packet message, so that the first data packet message may be output with order-preserved once secure computing is completed. Based on the similarities between the security algorithm and the protocol, the apparatus or the whole system including the apparatus may support the order-preserving processing. Once the order-preserving tag is added, as an example, each first data packet message may be allocated to an idle encryption engine5031(for example, this encryption engine has completed the previous secure computing task and thus is in an idle state) according to the order of this first data packet message in the input queue. Since there may be a plurality of encryption engines5031and the encryption engines to be in the idle state for secure computing is out-of-order of the first data packet messages, once the data packets corresponding to a plurality of first data packet messages have been successively subjected to secure computing by the plurality of encryption engines5031, the order of each first data packet message in the input queue may be reproduced by means of the order-preserving tag, and each first data packet message is output to the output queue, so that the processor calls and processes data packets sequentially. During scheduling, as an example, if the encryption control unit503is provided with M sets of encryption engines5031, the task management unit502makes a request to the encryption control unit503for an idle encryption engine5031. When there are one or more idle encryption engines503, for example, when the one or more encryption engines5031have completed the previously allocated secure computing, the task management unit502allocates the data packet secure computing tasks to be processed (i.e., one or more first data packet messages) in the output queue5012to the one or more encryption engines5031, thereby realizing scheduling. Through scheduling, the secure computing spatial resources such as the encryption engines5031are fully utilized, so that multiple sets of encryption engines5031may process in parallel, the processing efficiency of data packets is improved, and the expansibility of the apparatus or the whole system including the apparatus is improved.

In some implementations, the encryption control unit503is configured to complete the control of secure computing of data packets, such as encryption, decryption, authentication and additional authentication as well as data processing. As shown inFIGS.4-5, the encryption control unit503may include M sets of encryption engines5031for processing a plurality of data packets in parallel. Each set of encryption engines5031controls and completes the operation of multi-stage or single-stage secure computing.

FIG.7depicts a schematic diagram showing construction of encryption engine5031according to an embodiment of the present disclosure. As shown inFIG.7, the encryption engine5031of the encryption control unit503corresponds to one of the secure computing spatial resources in the method as described above. The encryption engine5031may include a data packing sub-unit601, a data packet management sub-unit602, a plurality of algorithm adaption sub-units603and an output sub-unit604.

The data packing sub-unit601is configured to acquire segment data of the corresponding data packet from the memory102according to the segment information of the data packet and splice the segment data to generate data packet cache data.

The data packet management sub-unit602is connected to the data packing sub-unit601and is configured to match the data packet cache data with appropriate security algorithms and transmit the data packet cache data to the algorithm adaption sub-units603according to a result of matching.

The plurality of algorithm adaption sub-units603are connected to the data management sub-unit602and are connected in stages. Each stage of algorithm adaption sub-unit603is configured to route, according to the selected security algorithm and the first data packet message, the data packet cache data to an appropriate security algorithm for multi-stage operation or single-stage operation, and a last algorithm adaption sub-unit (e.g., a Jth-stage algorithm adaption sub-unit603inFIG.7) transmits the secure computed second data packet data to the output sub-unit604. Herein, the security algorithm may also be called an algorithm core103.

The output sub-unit604is connected to the last-stage algorithm adaption sub-unit603and is configured to transmit the secure computed second data packet data to the memory102.

In particular, the data packet information of the first data packet message includes segment information of the data packet, and the first data packet data includes segment data corresponding to the segment information.

In some implements, the time of data accessing from the memory is saved by two parallel paths. As shown at the moment T2in the flowchart of the parallel operation of the encryption engines5031inFIG.8, once the encryption engine5031starts reading the algorithm core103from the memory102, the data packing sub-unit601may cooperatively read the segment data from the memory102in parallel, thereby realizing parallel processing. The data packing sub-unit601also reads the segment data from the memory102in a pipelined manner, then splices the segment data by splicing, and finally transmits the spliced data packet cache data to each stage of algorithm adaption sub-unit603through the data management sub-unit602, thereby realizing the centralized processing of data.

As shown in the period of time T2-T5inFIG.8, when packing the spliced segment data, the data packing sub-unit601successively allocates the packed data packet cache data to the algorithm adaption sub-units603through the data management sub-unit602. By the cooperation of several technical means such as parallel processing, data splicing and centralized data management, the processing time of data packets is effectively reduced.

In some embodiments, the algorithm adaption sub-units603allocate the data packet cache data to the corresponding algorithm cores103for secure computing, and transmit the secure computed second data packet data to the output sub-unit604. For the secure computing with multiple algorithm algorithms, pipelined operations may be performed on the data packet cache data between the algorithm adaption sub-units603.

As shown at the moment T4inFIG.8, when both the algorithm cores103are and the data packet cache data are ready, the algorithm cores103may be activated for secure computing. The data packet cache data immediately flows in the algorithm adaption sub-units603. The data that can be shared by the algorithm cores103of the algorithm adaption sub-units603is cached to a next stage by pipelining. Different data that is to be separately processed by the algorithm adaption sub-units603may be separately transmitted to the algorithm adaption sub-units603for separation processing through the data management sub-unit602.

As an example, as long as each algorithm adaption sub-unit603is stored with data and a next-stage algorithm adaption sub-unit603is ready, the data may be outputted for next-stage processing. There may be the following three situations.

Single-stage processing: the data is transmitted to the algorithm core103allocated to a single algorithm adaption sub-unit603. For example, it is only necessary to encrypt the data.

Stage-by-stage processing in multi-stage processing: the data is transmitted to the algorithm core103allocated to a first-stage algorithm adaption sub-unit603for processing, and then is transmitted to a next stage after being processed, so that data caching to a next stage is realized stage by stage. For example, at the first stage, encryption is performed by calling an encryption algorithm; and, at the second stage, authentication is performed by calling an authentication algorithm.

Non-stage-by-stage processing in multi-stage processing: the data is directly forwarded to a next-stage algorithm adaption unit instead of being transmitted to the algorithm core103allocated to the current-stage algorithm adaption sub-unit603, for example, when the current-stage algorithm adaption sub-unit602is not required in the secure computing.

Thus, by operating the algorithm cores103in parallel, the utilization rate of data is greatly improved. Meanwhile, the output data, if presents the last-stage algorithm adaption sub-unit603, is transmitted to the output sub-unit604for processing, so that the secure computed second data packet data is written into the memory102in a pipelined manner. Thus, the data input process and the data output process are also parallel operations, as shown in the period of time T4-T6inFIG.8.

By means of the encryption engine5031in the present disclosure, the processing time is effectively saved, and the computing performance of multiple stages of security algorithms is greatly improved as compared with separate reading of the data packet cache data by each algorithm adaption sub-unit. Meanwhile, the keys, context and other related configuration information as required by the algorithm cores103are processed in parallel with the data packet data, so that the time is saved in comparison to the serial processing method.

In some implementations, the arbitration selector504completes the arbitration and routing links between the encryption control unit503and the algorithm cores103. The arbitration selector504establishes a routing relationship between the encryption control unit503and the algorithm cores103, and completes the arbitration of the algorithm cores103. By means of the data packet information and secure computing configuration information of the first data packet message, particularly the information of the processing order of security algorithms in the secure computing configuration information, the routing relationship between M sets of encryption engines5031and N algorithm cores103is established. Since the algorithm cores103are equivalent to a resource pool and the M sets of encryption engines5031actually share the N algorithm cores103, when one algorithm core103is requested and called by multiple encryption engines5031simultaneously, the algorithm cores103is utilized by arbitration. For example, once each algorithm adaption sub-unit603in the current encryption engine5031has completed processing, the algorithm core103may be released for other encryption engines5031or subsequent processing(s). In the secure computing process of the algorithm core103, the arbitration selector504may also forward the data packet cache data to a next-stage algorithm adaption sub-unit603for processing.

With reference toFIG.2again, the secure computing control apparatus104in the embodiment may be applied to the data packet processing system shown inFIG.2. The data packet processing system may include: a processor101; a memory102; and, a secure computing control apparatus104, which is connected to the processor101and the memory102, respectively.

In some implementations, merely light tasks are to be processed with the processor101in the data packet processing system. In such a case, the processor101may encapsulate the first data packet message according to the data format of the hardware, and the first data packet message is subsequently parsed by the encryption engine5031for the content of the message. The data packet to be processed with secure computing may support a plurality of data segments, and it is unnecessary for the processor101to form a complete data packet from the segments and then transmit the data packet to the hardware, for example, the secure computing control apparatus104as described in this embodiment for processing, instead, the packing task is transferred to the hardware, so that the performance of the whole system is improved.

The processor101transmits the encapsulated data packet information to the secure computing control apparatus104, in particular, the data packet information is transmitted to the input queue5011of the queue management unit501of the secure computing control apparatus104as shown inFIG.6. The simple and efficient interaction between software and hardware is realized by queuing.

FIG.9shows a flowchart of an example application scenario of the data packet processing system according to an embodiment of the present disclosure.

The construction of the secure computing system for data packets is as described above. The flowchart includes S801to S817.

At S801, the processor101encapsulates first data packet messages.

At S802, the processor101transmits the first data packet messages to the input queue5011of the secure computing control apparatus104.

At S803, the secure computing control apparatus104determines if first data packet messages (i.e., data packet secure computing tasks) are presented in the input queue5011.

At S804, if the result of determination at the S803is TRUE, the secure computing control apparatus104extracts one or more first data packet messages from the input queue5011, where the first data packet message includes data packet information and secure computing configuration information corresponding to the data packet information.

At S805, the secure computing control apparatus104performs order-preserving processing on the one or more extracted first data packet messages and transmit the one or more first data packet messages to an idle encryption engine5031.

At S806, the encryption engine5031parses the encapsulated first data packet messages.

At S807, the encryption engine5031configure the data packet information and secure computing configuration information of the parsed first data packet messages to each sub-unit.

At S808, the encryption engine5031reads the information of one or more algorithm cores103from the memory102.

At S809, the encryption engine5031establishes routing links between one or more algorithm cores103and one or more algorithm adaption sub-units603according to the parsed data packet information and secure computing configuration information through the arbitration selector504.

At S810, parallel to S809, the encryption engine5031reads segment data from the memory102in a pipelined manner, and packs data via the packing sub-unit.

At S811, a determination is performed as to whether the algorithm cores103are ready and whether data packet cache data is cached in the encryption engine5031.

At S812, if the result of determination at S811is TRUE, the data packet cache data is transmitted between the algorithm adaption sub-units603to the corresponding algorithm cores103for secure computing at multiple stages or a single stage.

At S813, a determination is performed as to whether the secure computed second data packet data is cached in the last-stage algorithm adaption sub-unit603.

At S814, if the result of determination at S813is TRUE, the second data packet data is written into the memory102in a pipelined manner.

At S815, a determination is made as to whether the second data packet data is entirely written into the memory102.

At S816, if the result of determination at S815is TRUE, the secure computing control apparatus104performs order-preserving processing on second data packet messages corresponding to the second data packet data, and transmits the second data packet messages to the output queue5012.

At S817, the secure computing control apparatus104interacts with the processor101via the output queue5012, and transmits the second data packet messages to the processor101.

In applications, when the Internet protocol security (IPSEC) protocol on the network side processes a data packet, an encapsulating security payload (ESP) encryption algorithm, an ESP authentication algorithm and an authentication header (AH) authentication algorithm may be utilized. In this case, secure computing is to be performed by at most three algorithm cores103. When the PDCP protocol on the radio side processes a data packet, ZUC f9 authentication algorithm and ZUC F8 encryption algorithm may be utilized. In this case, secure computing is to be performed by at most two algorithm cores103. The secure computing control apparatus104and the data packet processing system according to the embodiments of the present disclosure are suitable for the efficient utilization of multiple stages of security algorithms, the improvement of the processing efficiency of data packets in coordination with the algorithm cores103and the improvement of the efficiency of security algorithms for multi-stage processing are achieved.

In the radio access system of the base station, in terms of the application of the secure processing of the Internet protocol (IP) layer on the network side and the packet data convergence protocol (PDCP) layer on the radio side, during secure computing, the secure computing control apparatus104and the data packet processing system according to various embodiments of the present disclosure realize efficient processing of data packet and reduce the processing time of data packets through task scheduling management, data packet centralized processing, resource sharing or other methods by the cooperation of various technologies such as data splicing, parallel computation and multi-stage security algorithms sharing storage and processing.

In addition, in accordance with an embodiment of the present disclosure, a non-transitory computer-readable storage medium is further provided. The non-transitory computer-readable storage medium stores computer programs which, when executed by a processor, cause the processor to implement the secure computing control method described above or the data packet processing method described above.

The method in an embodiment of the present disclosure includes: acquiring a first data packet message from a processor; acquiring corresponding first data packet data from a memory; selecting a corresponding security algorithm and packing the first data packet data and performing secure computing to generate secure computed second data packet data and a corresponding second data packet message. Based on the technical schemes in the embodiments of the present disclosure, some processes or environments of data packet processing that are to be executed by software via the processor are released to the hardware for completion, and the interaction between the software and the hardware is accelerated by queues on the hardware. The load of the software is released by data packet segmentation, so that the performance of the whole secure computing system is improved. The data packets are centralized for processing by pipelining and splicing, so that the efficiency of accessing the external storage is improved. Moreover, through the pipelined parallel processing of the algorithm adaption units, particularly the secure computing of multi-stage algorithms, the processing time of data packets is greatly reduced. To sum up, in accordance with the embodiments of the present disclosure, the processing time of data packets can be saved, the processing efficiency of the system can be improved, and the overall secure computing performance can be improved. The embodiments of the present disclosure have good processing performance, flexibility and expansibility, and can satisfy the computing scenarios of different protocols and different security algorithms.

The apparatus embodiments described above are only illustrative. The units described as separate components may be or may not be physically separated from each other, that is, they may be located in one place or may be distributed on a plurality of network units. Some or all of the modules may be selected according to practical needs to achieve the objectives of the schemes of the embodiments.

It should be understood by those having ordinary skill in the art that all or some of the steps in the methods disclosed above and the systems disclosed above may be implemented as software, firmware, hardware and suitable combinations thereof. Some or all of the physical components may be implemented as software executed by processors such as central processors, digital signal processors or microprocessors, or implemented as hardware, or implemented as integrated circuits such as application specific integrated circuits. Such software may be distributed on a computer-readable medium, and the computer-readable medium may include computer storage mediums (or non-transitory mediums) and communication mediums (or transitory mediums). As well-known to those having ordinary skill in the art, the term computer storage medium includes volatile or non-volatile and removable or non-removable mediums implemented in any method or technology used to store information (such as computer-readable instructions, data structures, program modules or other data). The computer storage medium may include, but not limited to, RAMs, ROMs, EEPROMs, flash memories and other memory technologies, CD-RMs, digital versatile disks (DVDs) or other optical disk storages, magnetic cassettes, magnetic tapes, magnetic disk storages or other magnetic storage devices, or any other mediums that can be used to store desired information and can be accessed by computers. In addition, as well-known to those having ordinary skill in the art, the communication medium generally includes computer-readable instructions, data structures, program modules or other data in modulation data signals such as carriers or other transmission mechanisms, and may include any information transfer medium.

Although some implementations of the present disclosure have been described above in detail, the present disclosure is not limited thereto. Those having ordinary skill in the art can make various equivalent variations or alternations without departing from the protection scope of the present disclosure, and these equivalent variations or alternations shall fall within the protection scope defined by the appended claims of the present disclosure.