WO2020233442A1 - 区块链与网络系统、数据接收与发送方法及设备 - Google Patents

区块链与网络系统、数据接收与发送方法及设备 Download PDF

Info

Publication number
WO2020233442A1
WO2020233442A1 PCT/CN2020/089721 CN2020089721W WO2020233442A1 WO 2020233442 A1 WO2020233442 A1 WO 2020233442A1 CN 2020089721 W CN2020089721 W CN 2020089721W WO 2020233442 A1 WO2020233442 A1 WO 2020233442A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
processing
unit
transmission
module
Prior art date
Application number
PCT/CN2020/089721
Other languages
English (en)
French (fr)
Inventor
刘小丽
曹政
高山渊
Original Assignee
阿里巴巴集团控股有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司 filed Critical 阿里巴巴集团控股有限公司
Publication of WO2020233442A1 publication Critical patent/WO2020233442A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
    • G06Q40/04—Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/166—Implementing security features at a particular protocol layer at the transport layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/104—Peer-to-peer [P2P] networks

Definitions

  • This application relates to the field of blockchain technology, and in particular to a blockchain and network system, data receiving and sending methods and equipment.
  • Blockchain is a new application mode of computer technology such as distributed data storage, point-to-point transmission, consensus mechanism, and encryption algorithm.
  • the mainstream blockchain architecture can be divided into network layer, data layer, consensus layer, incentive layer, contract layer and application layer.
  • the network layer is a peer-to-peer (P2P) network, so the consensus process between nodes is a communication-intensive process.
  • the consensus node needs to broadcast consensus messages to all other nodes and receive consensus messages sent from all other nodes.
  • Various aspects of this application provide a blockchain and network system, data receiving and sending methods and equipment, which are used to improve the processing efficiency of consensus messages, reduce the time-consuming of the consensus process, and improve the transaction processing speed of the blockchain system. Improve the throughput and scalability of the blockchain system.
  • the embodiment of the present application provides a network system, including: multiple node devices; each node device includes a network interface device, and transmits data to other node devices through the network interface device contained therein; each network interface device serves as a data transmission channel
  • the hardware device on the computer is used to use its internal hardware module to perform application-layer data processing on the data to be transmitted by its node device according to the command provided by its node device to indicate the data processing of the application layer, and to process the processed data
  • the data is sent out after being encapsulated in the network transmission protocol.
  • the embodiment of the application also provides a blockchain system, including: multiple blockchain nodes; each blockchain node includes a network interface device, and broadcasts consensus messages to other blockchain nodes through the network interface device contained therein ;
  • Each network interface device is used as a hardware device on the consensus message transmission channel, which is used to process the consensus message to be broadcast by its own blockchain node according to the data processing command provided by its own blockchain node. Data processing in the consensus process, and the processed consensus message is encapsulated in the network transmission protocol and sent out.
  • An embodiment of the present application also provides a network interface device, including: an interface module, an application processing module, and a transmission module; the interface module is used to obtain first data and a first processing command to be transmitted by the node device to which it belongs.
  • the first processing command indicates at least one application layer data processing in the data sending direction; the application processing module is configured to perform at least one application layer data processing in the data sending direction on the first data according to the first processing command.
  • the data processing; the transmission module is used to perform network transmission encapsulation on the first data processed by the application processing module, and send the encapsulated first data.
  • An embodiment of the application also provides a data sending method, which is suitable for a network interface device, and the method includes: acquiring first data and a first processing command to be transmitted by a node device to which the network interface device belongs, the first processing command Indicate at least one application layer data processing in the data sending direction; according to the first processing command, perform at least one application layer data processing in the data sending direction on the first data; The first data after the data processing of the layer is encapsulated in the network transmission protocol, and the encapsulated first data is sent out.
  • the embodiment of the present application also provides a data receiving method, which is applicable to a network interface device.
  • the method includes: receiving second data sent to a node device to which the network interface device belongs, and performing network transmission protocol on the second data Decapsulation processing; according to the second processing command provided by the node device in advance, perform data processing of at least one application layer in the data receiving direction on the decapsulated second data; pass through at least one application layer in the data receiving direction The second data after the data processing is sent to the node device.
  • the function of the network interface device in the node device is expanded, and some data processing of the application layer is offloaded to the network interface device.
  • the network interface device uses its internal hardware modules to implement data processing at the application layer during data transmission.
  • it is beneficial to reduce the memory copy and other operations required by the node device for these data processing, saving CPU resources, and on the other hand.
  • the network communication efficiency improves the throughput and scalability of the system where the node equipment is located.
  • FIG. 1 is a schematic diagram of the architecture of a blockchain system provided by an exemplary embodiment of this application;
  • Fig. 2a is a schematic diagram of a command structure provided by an exemplary embodiment of this application.
  • FIG. 2b is a schematic structural diagram of a data processing command provided by an embodiment of this application.
  • Fig. 2c is a schematic diagram of the data processing process for the data processing command shown in Fig. 2b;
  • FIG. 3 is a schematic structural diagram of a network system provided by an exemplary embodiment of this application.
  • FIG. 4a is a schematic structural diagram of a network interface device provided by an exemplary embodiment of this application.
  • 4b is a schematic structural diagram of another network interface device provided by an exemplary embodiment of this application.
  • FIG. 5a is a schematic flowchart of a data sending method provided by an exemplary embodiment of this application.
  • FIG. 5b is a schematic flowchart of a data receiving method provided by an exemplary embodiment of this application.
  • the network interface in the node device The equipment expands its functions, and offloads some data processing of the application layer to the network interface device.
  • the network interface device uses its internal hardware module to perform data transmission. Data processing at the application layer helps to reduce the memory copy and other operations required by the node device for these data processing and save CPU resources. On the other hand, it can improve the efficiency of network communication, thereby increasing the throughput and throughput of the system where the node device is located. Scalability.
  • FIG. 1 is a schematic diagram of the architecture of a blockchain system provided by an exemplary embodiment of this application.
  • the blockchain system includes: multiple blockchain nodes 10.
  • the blockchain node 10 can be any computer device with certain computing and communication capabilities.
  • it can be a server device such as a conventional server, cloud server, cloud host, virtual center, or server array, or it can be a smart phone, laptop, or tablet. Wait for terminal equipment.
  • each blockchain node 10 includes a network interface device 10a, which is a hardware device required for the blockchain node 10 to access the network and communicate with other blockchain nodes 10 .
  • the network interface device 10a can work at the physical layer and the data link layer in the OSI seven-layer model (equivalent to the network interface layer in the TCP/IP four-layer model), which is the blockchain node 10 to which it belongs.
  • the network interface device 10a can provide network transmission services for the blockchain node 10 to which it belongs according to the supported network transmission protocol. For example, it can encapsulate the data to be transmitted by the blockchain node 10 to the network transmission protocol and encapsulate the encapsulated data Send it out.
  • This embodiment does not limit the network transmission protocol supported by the network interface device 10a.
  • it may be the TCP/IP protocol or the remote direct memory access (RDMA) protocol.
  • RDMA remote direct memory access
  • the network interface device 10a may be a network interface card, a network interface controller, a network adapter, or a local area network receiver (LAN adapter).
  • the network interface device 10a can be inserted into the bus of the blockchain node 10 as an expansion card, or can be directly integrated in the blockchain node 10.
  • the blockchain node 10 and the network interface device 10a may have a one-to-one relationship, a one-to-many relationship, or a many-to-one relationship. That is, each blockchain node 10 may include one or more network interface devices 10a; one network interface device 10a may also be shared by multiple blockchain nodes 10. "Multiple" in the embodiments of the present application refers to two or more.
  • each blockchain node 10 is interconnected through the network interface device 10a contained therein to form a peer-to-peer (P2P) network, and each blockchain node 10 It is equivalent to a P2P node, and peer-to-peer data transmission can be performed between blockchain nodes 10.
  • P2P peer-to-peer
  • the blockchain system of this embodiment supports a consensus mechanism. Taking the application in the transaction system as an example, each blockchain node 10 can receive transaction information submitted by external customers, verify the transaction information, and then form a transaction block recognized by all blockchain nodes 10 through a consensus process, and meet When certain conditions are met, the specific execution and block chaining of transactions are promoted, so as to achieve the purpose of maintaining the same block chain among the block chain nodes 10.
  • the consensus process is a communication-intensive process.
  • consensus messages must be broadcast to other blockchain nodes 10, and consensus messages broadcast by other blockchain nodes 10 must be received.
  • the blockchain node 10 may broadcast consensus messages to other blockchain nodes 10 through the included network interface device 10a, and receive consensus messages broadcast by other blockchain nodes 10 through the included network interface device 10a.
  • the network interface device 10a serves as a hardware device on the consensus message transmission channel.
  • the blockchain node 10 can send the consensus message to be transmitted to the network interface device 10a.
  • the network interface device 10a encapsulates the consensus message according to the supported network transmission protocol, Send the encapsulated consensus message.
  • data processing related to secure communication can be performed on the consensus message to ensure communication security.
  • the blockchain node 10 can perform secure communication encryption and other processing on the consensus message to be sent, and then send the encrypted consensus message to the network interface device 10a, and the network interface device 10a will encrypt the consensus message according to the network transmission line protocol Encapsulate it into a data frame and send the data frame.
  • the blockchain node 10 will perform corresponding decryption processing. It can be seen that there are some data processing tasks in the entire consensus process, which requires higher processing capabilities of the blockchain node 10.
  • the throughput of the blockchain system can be represented by Transaction PerSecond (TPS).
  • TPS Transaction PerSecond
  • the function of the network interface device 10a in the blockchain node 10 is expanded, and some data processing in the consensus process is offloaded to the network interface device 10a. How to process the data in the consensus process and which data processing is offloaded to the network interface device 10a are key issues.
  • the blockchain node 10 provides a data processing command to the network interface device 10a, and the data processing command instructs the data processing in the consensus process that needs to be performed by the network interface device 10a. In this way, the network interface device 10a can be used for data processing.
  • the network interface device 10a uses its internal hardware module to perform data processing during the consensus process on the consensus message to be broadcast during the consensus message transmission process.
  • the network interface device 10a as a hardware device on the consensus message transmission channel, it can use its internal hardware module to broadcast to its own blockchain node 10 according to the data processing commands provided by its own blockchain node 10.
  • the consensus message is used for data processing in the consensus process, and the processed consensus message is encapsulated in the network transmission protocol and sent out.
  • it is beneficial to reduce the memory copy and other operations required by the blockchain node 10 for these data processing, and save CPU resources; on the other hand, it can use the hardware advantages of the network interface device to accelerate the processing of consensus messages, accelerate the consensus process, and improve The TPS and scalability of the blockchain system.
  • the consensus process can be divided into three stages. Take the first blockchain node to broadcast the transaction information that needs to be agreed as an example.
  • PBFT Practical Byzantine Fault Tolerance
  • the first stage from the first zone Blockchain nodes generate a consensus summary for a group of transaction information to be agreed on through the sha-256 algorithm, compose the consensus summary and the transaction information to be agreed on into a pp message, and broadcast the pp message to other blockchain nodes through the network interface device it contains ;
  • the second stage other blockchain nodes compare the received pp message to the consensus summary, and broadcast the consensus summary into p message; after each blockchain node receives the p message, it uses the sha-256 algorithm for the p message Production confirmation (commit) summary, ecdas signature on the commit summary, the signature is formed into a commit message, and the commit message is broadcast;
  • the third stage After each block chain node receives the commit message, it passes sha according to the consensus summary of the pp message -256 algorithm produces commit digest, and uses the generated commit digest to verify the signature of the commit message.
  • the consensus process is not the same, it mainly involves calculations such as message digests, digital signatures, signature verification, and broadcast communications.
  • the universal data processing in the process of extracting the consensus is offloaded to the network interface device on the data transmission path, and the in-flight is carried out with the advantage of the network interface device. Speed up and save the resources and operations of blockchain nodes.
  • the universal data processing in the consensus process is divided into two categories: security encryption processing and broadcast communication acceleration processing. Among them, the security encryption processing includes digital signature and signature verification.
  • security protocols can also be used on the transport layer to build secure communication channels.
  • the security protocols used by the transport layer include but are not limited to: Secure Socket Layer (SSL), Transport Layer Security (TLS), and so on.
  • SSL Secure Socket Layer
  • TLS Transport Layer Security
  • these security protocols can be used to encrypt the consensus message to be broadcast at the transport layer, which is referred to as transport layer encryption for short.
  • transport layer encryption for short.
  • the aforementioned security encryption processing may also include transport layer encryption processing.
  • the following functions can be extended to the network interface device: signature authentication function, security protocol processing function, and broadcast acceleration function.
  • signature authentication is mainly responsible for the digital signature or signature verification of the consensus message
  • security protocol processing function is mainly responsible for the transmission layer encryption or decryption of the consensus message
  • broadcast acceleration function is mainly responsible for generating multiple transmissions required for the broadcast of the consensus message Layer protocol headers, so that different transport layer protocol headers can be directly added to a consensus message during the consensus message broadcast process without reading multiple consensus messages, which is beneficial to improve broadcast efficiency and accelerate broadcast communications.
  • the signature authentication function, security protocol processing function, broadcast acceleration function and traditional transmission function of the network interface device can be used Combine them to form a configurable data path.
  • the network interface device also provides a command interface to the blockchain node for the blockchain node to configure the data processing required for the consensus message to be broadcast or the consensus message to be received.
  • the blockchain node can send data processing commands to the network interface device through the command interface provided by the network interface device, and define the data processing that needs to be performed on the consensus message to be broadcast or the consensus message to be received through the data processing command.
  • a blockchain node can use data processing commands to define digital signatures, transport layer encryption processing, and broadcast acceleration processing for the consensus messages to be broadcast, so that the network interface device can use its internal hardware modules according to the received data commands
  • the consensus messages to be broadcast by the blockchain nodes are sequentially digitally signed, transport layer encryption processing, and broadcast acceleration processing, and a series of processed consensus messages are encapsulated in a network transmission protocol and then sent out.
  • the blockchain node can use the data processing command to define the transport layer decryption process and signature verification of the consensus message to be received, so that the network interface device receives the consensus message that needs to be received by the blockchain node
  • the message is decapsulated in the network transmission protocol, and then according to the data command provided by the blockchain node, the decapsulated consensus message is sequentially decrypted and signed by the internal hardware module, and a series of processed The consensus message is sent to the blockchain node.
  • the sending and receiving process of consensus messages can be accelerated, thereby improving network consensus performance.
  • the above-mentioned data processing command is a set of commands, indicating a series of orderly operations to be performed on the consensus message using the network interface device.
  • the embodiment of the present application does not limit the command format of the data processing command.
  • an optional command structure provided in this embodiment of the application, but not limited to this.
  • the command structure contains a command header (cmdheader) and a command body (cmdbody), where cmdheader contains the command length (cmdlength), and cmdlength indicates the number of commands; cmdbody contains a series of command items (cmdentry), each A cmdentry indicates a kind of hardware operation.
  • One or more hardware operations can constitute a kind of data processing described in the embodiment of the present application.
  • the cmdentry includes an operation code (opcode) and an operation parameter list (parameter list). The operand of each operation is the data processed by the previous operation.
  • Figure 2b depicts a specific data processing command
  • Figure 2c depicts a schematic diagram of the data processing process corresponding to the data processing command.
  • the data processing command shown in Figure 2b illustrates the orderly operation of constructing and broadcasting pp messages in the blockchain consensus process.
  • the embodiment of the present application does not limit it.
  • the internal implementation structure of a network interface device can refer to the embodiment shown in FIG. 4a or FIG. 4b, which is not described in detail here.
  • the blockchain system of this embodiment may be located at the application layer in the TCP/IP model and run on the TCP/IP protocol layer. Based on this, the consensus process in the blockchain system belongs to the application layer. Correspondingly, the data processing in the consensus process belongs to the data processing of the application layer, so the “unload the data processing in the consensus process to the network interface” proposed in the embodiment of this application.
  • the idea of "in equipment” can be extended to "offload some data processing of the application layer to the network interface equipment", and then applied to other network systems outside the blockchain system, especially P2P network systems.
  • Fig. 3 is a schematic structural diagram of a network system provided by an exemplary embodiment of this application.
  • the network system includes: a plurality of node devices 30; each node device 30 includes a network interface device 30a, and the node device 30 can perform network interconnection with other node devices 30 through the network interface device 30a contained therein.
  • the other node devices 30 transmit data.
  • the node devices 30 may form a P2P network or a non-P2P network, which is not limited.
  • the node device 30 in this embodiment can be any computer device with certain computing and communication capabilities.
  • it can be a server device such as a conventional server, a cloud server, a cloud host, a virtual center, or a server array, or a smart phone, a laptop, or Terminal devices such as tablets.
  • the network interface device 30a is a hardware device required for the node device 30 to access the network and perform network communication with other node devices 30.
  • the network interface device 30a can provide network transmission services for the node device 30 to which it belongs according to the supported network transmission protocol. For example, it can encapsulate the data to be transmitted by the node device 30 of the network transmission protocol and send the encapsulated data.
  • This embodiment does not limit the network transmission protocol supported by the network interface device 30a. For example, it may be the TCP/IP protocol or the RDMA protocol.
  • the network interface device 30a may be a network card, a network interface controller, a network adapter, or a local area network receiver.
  • the network interface device 30a can be inserted into the bus of the node device 30 as an expansion card, or can be directly integrated in the node device 30.
  • the node device 30 and the network interface device 30a may have a one-to-one relationship, a one-to-many relationship, or a many-to-one relationship. That is, each node device 30 may include one or more network interface devices 30a; one network interface device 30a may also be shared by multiple node devices 30.
  • the network interface device 30a has expanded its functions to offload some data processing at the application layer to the network interface device 30a.
  • the network interface device 30a contained therein can be provided with a command indicating the data processing of the application layer, and the data to be transmitted can be transmitted through the network interface device 30.
  • the network interface device 30a as a hardware device on the data transmission channel, it can use its internal hardware module to transmit data to the node device 30 to which it belongs according to the command provided by the node device 30 to which it belongs to indicate data processing at the application layer.
  • the data is processed at the application layer, and the processed data is encapsulated in the network transmission protocol and sent out.
  • the throughput of the system may be TPS, or query rate per second (Queries Per Second, QPS).
  • data processing process of the application layer in the network system will also be different, which is not limited in this application.
  • data processing at the application layer is divided into at least one application layer data processing in the data sending direction and at least one application layer data processing in the data receiving direction.
  • the network interface device 30a contained therein can be provided with the data to be transmitted and the corresponding processing commands.
  • the data here is recorded as the first data
  • the processing command here is recorded as the first processing command.
  • the first processing command indicates at least one application layer data processing in the data sending direction.
  • the network interface device 30a the first data and the first processing command to be transmitted by the node device 30 to which it belongs can be obtained; according to the first processing command, at least one application layer data processing in the data sending direction is performed on the first data ; Perform network transmission protocol encapsulation on the processed first data, and send the encapsulated first data.
  • the node device 30 may directly send the first data and the first processing command to the network interface device 30a; the network interface device 30a may directly receive the first data and the first processing command sent by the node device 30.
  • the node device 30 may send the first data and the address of the first processing command to the network interface device 30a; the network interface device 30a reads the first data and the first processing command according to the address.
  • the network interface device 30a can read the first data and the first processing command from the memory of the node device 30 in a direct memory access (DMA) manner.
  • DMA direct memory access
  • the node device 30 may pre-configure a second processing command to the network interface device 30a; the second processing command indicates at least one application layer data processing in the data receiving direction.
  • the network interface device 30a can receive the second data sent by the other node device 30 to the node device 30 to which it belongs, and decapsulate the second data by the network transmission protocol; according to the second processing command, the decapsulated The second data performs at least one application layer data processing in the data receiving direction, and sends the processed second data to the node device 30 to which it belongs.
  • At least one application layer data processing in the data sending direction includes: digital signature, transmission layer encryption processing, and broadcast communication acceleration processing; accordingly, the data receiving direction At least one application layer data processing includes: transport layer decryption processing and signature verification.
  • the network interface device of this embodiment contains at least one hardware module inside. These hardware modules are located on the data transmission channel and cooperate with each other to perform application layer data processing on the data to be transmitted during the data transmission process. The data is sent out after being encapsulated in the network transmission protocol.
  • the embodiment of the present application does not limit it.
  • the following embodiments of the present application provide an internal implementation structure of a network interface device.
  • the network interface device is not only applicable to the network system shown in FIG. 3, but also applicable to the blockchain system shown in FIG.
  • Fig. 4a is a schematic structural diagram of a network interface device provided by an exemplary embodiment of this application.
  • the network interface device includes at least the following hardware modules: an interface module 41, an application processing module 42, and a transmission module 43.
  • These hardware modules can be implemented by FPGA or ASIC, but are not limited to this.
  • the interface module 41 is a communication interface between the network interface device and the node device to which it belongs, and various interface protocols may be used, for example, I/O protocols such as PCIE and PCI may be used.
  • the interface module 41 may obtain the first data and the first processing command to be transmitted by the node device to which it belongs, and transmit the first data and the first processing command to the application processing module 42.
  • the first processing command indicates at least one application layer data processing in the data sending direction.
  • the node device may send the first data and the address of the first processing command to the interface module 41; the interface module 41 goes to the node device to read the first data and the first processing command according to the address provided by the node device.
  • the application processing module 42 is connected to the interface module 41, and can perform data processing of at least one application layer in the data sending direction on the first data according to the first processing command, and transmit the processed first data to the transmission module 43.
  • the transmission module 43 is connected to the application processing module 42 and is used to perform network transmission and encapsulation on the first data processed by the application processing module, and send the encapsulated first data.
  • the transmission module 43 may also receive the second data sent to the node device to which it belongs, decapsulate the second data with a network transmission protocol, and transmit the decapsulated second data to the application processing module 42.
  • the application processing module 42 is further configured to: perform at least one application layer data processing in the data receiving direction on the second data decapsulated by the transmission module 43 according to a second processing command provided in advance by the node device to which it belongs, and process the processed second data
  • the second data is transmitted to the interface module 41.
  • the interface module 41 is also used to transmit the second data processed by the application processing module 42 to the node device to which it belongs.
  • the second processing command indicates at least one application layer data processing in the data receiving direction, which is provided in advance by the node device.
  • the data processing of the application layer that needs to be performed by the network interface device will also be different; for the data processing of different application layers, the internal implementation structure of the application processing module 42 will also be different. Different.
  • the network interface device shown in FIG. 4b an implementation structure of the application processing module 42 is given.
  • the implementation structure of the application processing module 42 shown in FIG. 4b is only an example, and is not limited thereto.
  • the application processing module 42 sequentially includes a signature authentication unit 421, a security protocol unit 422, and a broadcast acceleration unit 423.
  • the first processing command sequentially passes through the signature authentication unit 421, the security protocol unit 422, and the broadcast acceleration unit 423; the signature authentication unit 421, the security protocol unit 422, and the broadcast acceleration unit 423 can respond to the first data according to the instructions of the first processing command. Proceed accordingly.
  • the signature authentication unit 421 may also be referred to as a signature-authorization engine (SAE), which has the capability of digital signature and signature verification.
  • SAE signature-authorization engine
  • the interface module 41 provides the first data and the first processing command to the signature verification unit 421.
  • the signature verification unit 421 is connected to the interface module 41, and can digitally sign the first data transmitted from the interface module 41 when the first processing command indicates digital signature processing, and transmit the digitally signed first data to the security Protocol unit 422; or, in the case that the first processing command does not instruct digital signature processing, directly transmit the first data transmitted from the interface module 41 to the security protocol unit 422.
  • the signature authentication unit 421 also sends the first processing command to the security protocol unit 422.
  • the security protocol unit 422 may also be called a security protocol engine (Security Protocol Engint, SPE), which mainly implements security protocol processing on the transport layer, for example, has the encryption and decryption capabilities of the transport layer.
  • the security protocol unit 422 is connected to the signature verification unit 421, and can receive the first data transmitted by the signature verification unit 421.
  • the signature verification unit 421 is sent according to the security protocol used by the transport layer.
  • the transmitted first data is encrypted at the transmission layer, and the encrypted first data is transmitted to the broadcast acceleration unit 423; or, if the first processing command does not instruct the encryption at the transmission layer, the signature is directly authenticated
  • the first data transmitted by the unit 421 is transmitted to the broadcast acceleration unit 423.
  • the first data transmitted by the signature verification unit 421 may be the first data that has been digitally signed, or it may be the first data that has not been digitally signed.
  • the security protocol unit 422 also sends the first processing command to the broadcast acceleration unit 423.
  • the broadcast acceleration unit 423 may also be referred to as a broadcast acceleration engine (Braodcast-acceleration Engine, BAE), which is responsible for providing transmission layer protocol headers corresponding to each receiving end in the broadcast transmission mode, and realizes acceleration of broadcast transmission.
  • BAE Broadcast-acceleration Engine
  • the broadcast acceleration unit 423 is connected to the security protocol unit 422, and can receive the first data transmitted by the security protocol unit 422.
  • the first processing command instructs broadcast acceleration processing, it is safe according to the information of multiple node devices in the network system.
  • the first data transmitted by the protocol unit 422 generates multiple transport layer protocol headers (such as TCP/IP packet headers) required for broadcasting, so that the transmission module 43 transmits the first data of the security protocol unit 422 according to the multiple transport layer protocol headers.
  • the data is broadcast; or, in the case that the first processing command does not instruct broadcast acceleration processing, the first data transmitted by the security protocol unit 422 is directly transmitted to the transmission module 43.
  • the first data transmitted by the security protocol unit 422 may be the first data after the digital signature and the transmission layer encryption process, if possible, the first data only after the transmission layer encryption process, or it may be the first data without digital signature and transmission.
  • the encrypted first data may be the first data after the digital signature and the transmission layer encryption process, if possible, the first data only after the transmission layer encryption process, or it may be the first data without digital signature and transmission.
  • each transport layer protocol header corresponds to a node device
  • the multiple node devices may include the node device to which the network interface device belongs, or may only include other node devices except the node device to which the network interface device belongs.
  • the broadcast acceleration unit 423 is also connected to the transmission module 43, and is configured to transmit multiple transmission layer protocol headers to the transmission module 43, and transmit the first data transmitted from the security protocol unit 42 to the transmission module 43. After the transmission module 43 receives multiple transport layer protocol headers and the first data, it can add different transport layer protocol headers to the first data and send them to different node devices.
  • the node device only needs to provide one copy of the first data to the network interface device, and there is no need to provide multiple copies of the first data, which can save the node device from reading the first data from the memory multiple times, and can also eliminate the first data. Redundant transmission of data between node equipment and network interface equipment saves resources, improves the efficiency of broadcast communication, and realizes broadcast acceleration.
  • a list of executable operation codes may be preset in the signature authentication unit 421, the security protocol unit 422, and the broadcast acceleration unit 423.
  • the unit can sequentially check whether the operation code in the first processing command hits its executable operation code, and if it hits, execute the operation code indicated by the first data The hardware action, until the unsupported operation code is checked, the processed first data and the first processing command are passed to the next unit.
  • the broadcast acceleration unit 423 does not need to transmit the first processing command to the transmission module 43. The working process of the application processing module 42 will be described below in conjunction with the data processing command shown in FIG. 2b:
  • the data processing command shown in FIG. 2b can be used as the first processing command in this embodiment.
  • the interface module 41 in the network interface device After obtaining the pp message and the data processing command shown in FIG. 2b, the interface module 41 in the network interface device first sends the pp message And the data processing command is passed to the signature verification unit 421.
  • the signature verification unit 421 checks the first opcode (sha256) and finds that it is not in the list of operable opcodes, so it does not do any processing and directly sends the pp message and the data processing command Transparently transmit to the security protocol unit 422.
  • the security protocol unit 422 receives the pp message and the data processing command, and sequentially checks that the first opcode (sha256) to the fifth opcode (SSL) are in the list of operable opcodes, and then executes the corresponding operations in sequence:
  • an opcode (sha256) hit is detected, perform sha256 calculation on the pp message to obtain a digest (Digest);
  • the opcode (segment) hit is checked, the pp message (pp message + Digest) inserted into the Digest is segmented by 64K to obtain the data segment seg0 ⁇ seg3;
  • the opcode (compress) hit is checked When the segmented data is compressed, the compressed data cmp0 ⁇ cmp3 are obtained respectively; when the operation code (SSL) hit is checked, the compressed data is processed by the
  • the broadcast acceleration unit 423 receives the data and data processing commands processed by the security protocol unit 422, and when the sixth operation code (broadcast) hits is checked, the data processed by the SSL Record protocol is processed according to the pre-configured system node devices The transmission layer protocol header corresponding to each node device is generated, and the transmission layer protocol header corresponding to each node device is passed to the transmission module 43, which is encapsulated into data corresponding to each node device and sent out.
  • the security protocol unit 422 is also connected to the transmission module 43, and can decrypt the second data transmitted by the transmission module 43 according to the security protocol used by the transmission layer when the second processing command instructs the transmission layer decryption processing. Process, and transmit the decrypted second data to the signature verification unit 421; or, in the case that the second processing command does not instruct the transport layer decryption process, directly transmit the second data transmitted by the transmission module 43 to the signature verification unit 421.
  • the signature verification unit 421 may also perform signature verification on the second data transmitted by the security protocol unit 422 when the second processing command indicates the signature verification processing, and transmit the second data that has passed the signature verification to the interface module 41; or, when the second processing command does not indicate signature verification processing, directly transmit the second data transmitted from the security protocol unit 422 to the interface module 41.
  • the second data transmitted by the security protocol unit 422 may be the second data that has been decrypted by the transport layer, or it may be the second data that has not been decrypted by the transport layer.
  • the application processing module 42 may further include an encryption and decryption unit 424.
  • the encryption and decryption unit 424 may also be referred to as an encryption and decryption engine (Crypto-Process Engine, CPE), which mainly performs hash calculation and encryption and decryption calculation.
  • CPE Codon-Process Engine
  • the encryption and decryption unit 424 is connected to the signature authentication unit 421 and/or the security protocol unit 422 to provide hash calculation and encryption and decryption calculations for the signature authentication unit 421 and/or the security protocol unit 422.
  • the signature verification unit 421 can digitally sign the received first data or perform signature verification on the received second data with the help of the hash calculation and encryption and decryption calculation capabilities of the encryption and decryption unit 424.
  • the security protocol unit 422 can use the hash calculation and encryption and decryption calculation capabilities of the encryption and decryption unit 424 to perform transport layer encryption processing on the received first data, or perform transmission layer decryption processing on the received second data.
  • the signature verification unit 421 may provide the first data transmitted by the interface module 41 as the data to be encrypted to the encryption and decryption unit 424, and the encryption and decryption unit 424 may perform the first data according to a designated or pre-configured hash algorithm (for example, sha256).
  • a designated or pre-configured hash algorithm for example, sha256.
  • a data is hashed to obtain a hash digest, then the hash digest is digitally signed according to a designated or pre-configured digital signature algorithm, and the digital signature result is returned to the signature verification unit 421.
  • the security protocol unit 422 can provide the data that needs to be digitally signed or encrypted to the encryption and decryption unit 424 during the transmission layer encryption process, and the encryption and decryption unit 424 is based on a designated or pre-configured hash algorithm (for example, sha256) ,
  • the designated or pre-configured digital signature algorithm and the designated encryption algorithm (such as AES) perform digital signature or encryption processing on the received data and return the digital signature result or encryption result.
  • the signature verification unit 421 or the security protocol unit 422 can also provide the encryption and decryption unit 424 with data that requires signature verification or decryption during the data processing process; the encryption and decryption unit 424 is based on a designated or pre-configured hash algorithm (such as sha256). ), a designated or pre-configured digital signature algorithm and a designated encryption algorithm (such as AES) perform signature verification or decryption processing on the received data and return the signature verification result or decryption result.
  • a designated or pre-configured hash algorithm such as sha256.
  • AES designated encryption algorithm
  • the application processing module 42 further includes: a configuration unit 425.
  • the configuration unit 425 is configured to receive configuration information sent by the node device to which it belongs via the interface module 41, and provide corresponding configuration information for the signature authentication unit 421, the security protocol unit 422, and/or the broadcast acceleration unit 423; wherein, the configuration information includes the following At least one: a hash algorithm, a digital signature algorithm, a security protocol used by the transport layer, an encryption algorithm, information of each node device in the network system, and a second processing command.
  • the configuration information may also include some other information required for processing the second data, such as the offset and size of the transaction type field required for parsing the second data.
  • the transaction type field is a field in the second data, which indicates the transaction type to which the second data belongs. Different transaction types correspond to different second processing commands. According to the transaction type, the application layer data processing of the second data can be uniquely determined. The second processing command.
  • the configuration unit 425 may store the above-mentioned at least one kind of configuration information locally, and the corresponding module may go to the configuration unit 425 to read the required configuration information.
  • the signature authentication unit 421 can read from the configuration unit 425 when it needs to use a hash algorithm and a digital signature algorithm
  • the security protocol unit 422 can read from the configuration unit 425 when it needs to use the security protocol and encryption algorithm used by the transport layer.
  • the broadcast acceleration unit 423 can read the configuration unit 425 when it needs to use the information of each node device.
  • the signature authentication unit 421, the security protocol unit 422, and the broadcast acceleration unit 423 can also read the second processing command from the configuration unit 425 to learn whether the second data sent to the node device needs to be processed accordingly. or,
  • the configuration unit 425 may also directly configure the corresponding configuration information in each module.
  • the hash algorithm and digital signature algorithm can be configured in the signature authentication unit 421
  • the security protocol and encryption algorithm used by the transport layer can be configured in the security protocol unit 422
  • the information of each node device can be configured in the broadcast acceleration unit 423 , And configure the second processing command to the signature authentication unit 421, the security protocol unit 422, and the broadcast acceleration unit 423, respectively.
  • the configuration information may also be carried in the first processing command and provided to the corresponding unit through the first processing command.
  • the transmission module 43 mainly performs network transmission protocol encapsulation or decapsulation processing on the received data, for example, performs encapsulation processing on the first data, and performs decapsulation processing on the second data. According to different network transmission protocols, the implementation process of encapsulation or decapsulation will be different. Taking the TCP/IP protocol as an example, as shown in FIG. 4b, the transmission module 43 includes: a transmission protocol unit 431 and a MAC interface unit 432.
  • the transmission protocol unit 431 is used to encapsulate the first data processed by the application processing module 42 at the transmission layer, and mainly refers to encapsulating the TCP/IP header for the first data, and transmitting the encapsulated first data to the MAC interface unit 432.
  • the MAC interface unit 432 mainly implements the MAC function of the network interface device, and can encapsulate the data link layer of the first data transmitted by the transmission protocol unit 431. It mainly refers to encapsulating the Ethernet header for the first data and encapsulating the encapsulated The first data is sent out.
  • the MAC interface unit 432 can also receive second data sent by other node devices to the node device to which it belongs, and decapsulate the second data at the data link layer, which mainly refers to removing the Ethernet packet header in the second data. And the decapsulated second data is transmitted to the transmission protocol unit 431.
  • the transmission protocol unit 431 can also decapsulate the second data transmitted by the MAC interface unit 432 at the transport layer, which mainly refers to removing the TCP/IP header in the second data and transmitting the decapsulated second data to Application processing module 42.
  • the application processing module 42 may perform application layer data processing on the second data decapsulated by the network transmission protocol according to the pre-configured second processing command, and send the processed second data to the node device through the interface module 41, Realize data transmission between node devices.
  • mapping relationship between the transaction type and the second processing command may be set, and the mapping relationship may be pre-configured in the node device in the manner of configuration information.
  • the transport protocol unit 431 can also perform decapsulation on the second data after the network transport protocol is decapsulated according to the offset and size of the pre-configured transaction type field. Analyze to obtain the transaction type of the second data.
  • the application processing module 42 performs application layer data processing on the second data decapsulated through the network transmission protocol according to the second processing command, and sends the processed second data to the node device through the interface module 41, so as to realize the inter-node device Data transfer.
  • the transmission protocol unit 431 may also send the transaction type of the second data and the second data decapsulated by the transport layer to the application processing module 42; the application processing module 42 may pull the second data corresponding to the transaction type from the configuration module.
  • the processing command is to perform application layer data processing on the second data decapsulated through the network transmission protocol according to the second processing command, and send the processed second data to the node device through the interface module 41.
  • embodiments of the present application also provide embodiments of the data sending method and the data receiving method. These embodiments are described from the perspective of a network interface device, and detailed descriptions are provided below.
  • Fig. 5a is a schematic flowchart of a data sending method provided by an exemplary embodiment of this application. As shown in Figure 5a, the data sending method includes:
  • At least one application layer data processing in the data sending direction is performed on the first data according to the first processing command, including at least one of the following:
  • the first processing command indicates digital signature processing, digitally sign the first data
  • the first processing command instructs the transmission layer encryption processing, perform the transmission layer encryption processing on the first data or the digitally signed first data according to the security protocol used by the transmission layer;
  • the first processing command instructs broadcast acceleration processing
  • the first data or the first data after the digital signature or the first data after the encryption processing are generated for the broadcast.
  • a transport layer protocol header to broadcast the first data or digitally signed first data or encrypted first data.
  • the node device initializes and configures the information of each node device in the system through the interface module in the network interface device, the security protocol, digest algorithm and digital signature algorithm used by the network system at the transmission layer.
  • the node device prepares the first data to be sent and the first processing command, and notifies the network interface device of the address where the first data and the first processing command are located through the interface module.
  • the network interface device obtains the first data and the first processing command to be sent by the node device according to the foregoing address.
  • the first data and the first processing command enter the signature authentication module in the network interface device; if the first processing command contains the operation code for the signature authentication unit, it means that the digital signature processing is instructed, then the digital signature is pre-configured
  • the algorithm implements the specified digital signature processing on the first data; if the first processing command does not include an operation code for the signature authentication unit, which means that no digital signature processing is instructed, the first data is passed through to the security protocol unit.
  • the first data and the first processing command enter the security protocol unit; if the first processing command contains an operation code for the security protocol unit, which means that the transport layer encryption processing is instructed, the first data is processed according to the pre-configured security protocol Realize the designated security encryption processing; if the first processing command does not contain the operation code for the security protocol unit, which means that the transmission layer encryption processing is not instructed, the first data is passed through to the broadcast acceleration unit.
  • the first data and the first processing command enter the broadcast acceleration unit; if the first processing command contains the operation code for the broadcast acceleration unit, which means that the broadcast acceleration processing is instructed, it will be generated according to the information of each node device pre-configured The TCP/IP packet header required to send the first data to each node device; if the first processing command does not contain the operation code for the broadcast acceleration unit, which means that the broadcast acceleration processing is not instructed, the first data is passed through to the transmission coordination unit .
  • the first data enters the transmission protocol unit; the transmission protocol unit encapsulates different TCP/IP headers for the first data and sends them out through the MAC interface unit.
  • FIG. 5b is a schematic flowchart of a data receiving method provided by an exemplary embodiment of this application. As shown in Figure 5b, the data receiving method includes:
  • performing at least one application layer data processing in the data receiving direction on the deencapsulated second data according to the second processing command including at least one of the following:
  • the second processing command instructs the transport layer to decrypt, perform transport layer decryption on the decapsulated second data according to the security protocol used by the transport layer;
  • signature verification is performed on the second data after decapsulation or the second data after decryption processing.
  • the node device initializes and configures the second processing command, the transaction type corresponding to the second processing command, and the offset and size of the transaction type field in the data message through the interface module in the network interface device.
  • the MAC interface unit in the network interface device receives the second data sent by other node devices to the node device to which it belongs, and decapsulates the second data at the data link layer, which mainly refers to removing the ether in the second data.
  • the net packet header sends the decapsulated second data to the transmission protocol unit.
  • the transmission protocol unit decapsulates the second data decapsulated by the MAC interface unit at the transport layer, obtains the TCP/IP header, transaction type, etc., obtains the second processing command from the configuration module according to the transaction type, and decapsulates the decapsulated first data.
  • the second data and the second processing command are passed to the safety protocol unit.
  • the decapsulated second data and the second processing command enter the security protocol unit; if the second processing command contains an operation code for the security protocol unit, which means that the transport layer decryption processing is instructed, the decryption will be performed according to the pre-configured security protocol
  • the encapsulated second data implements the designated security decryption processing, and the decrypted second data and the second processing command are transmitted to the signature authentication unit; if the second processing command does not contain the operation code for the security protocol unit, it means that it is not Instruct the transport layer to decrypt processing, and pass the encapsulated second data and the second processing command directly to the signature verification unit.
  • the decapsulated second data or the decrypted second data and the second processing command enter the signature verification unit; if the second processing command contains an operation code for the signature verification unit, it means that the signature verification is instructed, then the decapsulation The second data or the decrypted second data specifies the signature verification, and sends the second data that passes the signature verification to the interface module; if the second processing command does not contain the operation code for the signature verification unit, it means that it is not instructed For signature verification, the decapsulated second data or the decrypted second data is passed through to the interface module.
  • the interface module sends the received second data and signature authentication result to its own node device for further processing by the upper layer application.
  • some data processing of the application layer in the network system or blockchain system is offloaded to the network interface device on the data transmission channel, and the hardware advantage of the network interface device is used for data transmission on the data transmission path.
  • Processing at the application layer can achieve in-flight acceleration. On the one hand, it can improve the TPS throughput and scale scalability of the system. On the other hand, it can release the CPU resources of node devices or blockchain nodes. Let the CPU perform other operations more efficiently, and improve the performance of the network system or blockchain system in an all-round way.
  • the execution subject of each step of the method provided in the foregoing embodiment may be the same device, or the method may also be executed by different devices or different modules in the same device.
  • the execution subject of steps 51a to 51c can be different modules in the network interface device; wherein, the execution subject of step 51a can be the interface module 41 in the network interface device, and the execution subject of step 52a can be the interface module 41 in the network interface device.
  • the application processing module 42, the execution subject of step 53a may be the transmission module 43 in the network interface device; and so on.
  • the embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may be in the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.
  • a computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device.
  • the device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment.
  • the instructions provide steps for implementing functions specified in a flow or multiple flows in the flowchart and/or a block or multiple blocks in the block diagram.
  • the computing device includes one or more processors (CPU), input/output interfaces, network interfaces, and memory.
  • processors CPU
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • the memory may include non-permanent memory in computer readable media, random access memory (RAM) and/or non-volatile memory, such as read-only memory (ROM) or flash memory (flash RAM). Memory is an example of computer readable media.
  • RAM random access memory
  • ROM read-only memory
  • flash RAM flash memory
  • Computer-readable media include permanent and non-permanent, removable and non-removable media, and information storage can be realized by any method or technology.
  • the information can be computer-readable instructions, data structures, program modules, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disc (DVD) or other optical storage, Magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media can be used to store information that can be accessed by computing devices. According to the definition in this article, computer-readable media does not include transitory media, such as modulated data signals and carrier waves.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Business, Economics & Management (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Finance (AREA)
  • Accounting & Taxation (AREA)
  • Development Economics (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • Economics (AREA)
  • Marketing (AREA)
  • Strategic Management (AREA)
  • Technology Law (AREA)
  • Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Computer And Data Communications (AREA)

Abstract

本申请实施例提供一种区块链与网络系统、数据接收与发送方法及设备。在本申请实施例中，对节点设备中的网络接口设备进行功能扩展，将应用层的一些数据处理卸载到网络接口设备中，借助网络接口设备处于数据传输通道上的优势和其硬件优势，由网络接口设备在数据传输中利用其内部的硬件模块对数据实现应用层的数据处理，一方面有利于减少节点设备进行这些数据处理所需的内存拷贝等操作，节约CPU资源，另一方面可提升网络通信效率，进而提高节点设备所在系统的吞吐量和可扩展性。

Description

区块链与网络系统、数据接收与发送方法及设备
本申请要求2019年05月22日递交的申请号为201910431080.9、发明名称为“区块链与网络系统、数据接收与发送方法及设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及区块链技术领域，尤其涉及一种区块链与网络系统、数据接收与发送方法及设备。
背景技术
区块链是分布式数据存储、点对点传输、共识机制、加密算法等计算机技术的新型应用模式。主流的区块链架构可划分为网络层，数据层，共识层，激励层，合约层和应用层。其中，网络层是一个点对点(P2P)网络，因此节点间的共识过程是一个通信密集型过程，共识节点要向其它所有节点广播共识消息，并接收从其它所有节点发来的共识消息。
随着共识节点规模扩大，共识过程存在大量的计算任务，对发出的共识消息要进行加密、安全通信等处理，对接收的共识消息要进行加解密、验证等处理。当节点不能及时处理大规模高并发的共识消息时，共识过程延长，会降低区块链系统的交易处理速度，限制区块链系统的TPS和规模的可扩展性。
发明内容
本申请的多个方面提供一种区块链与网络系统、数据接收与发送方法及设备，用以提高共识消息的处理效率，减少共识过程的耗时，提高区块链系统的交易处理速度，提高区块链系统的吞吐量和规模的可扩展性。
本申请实施例提供一种网络系统，包括：多个节点设备；每个节点设备包含网络接口设备，并通过其包含的网络接口设备向其它节点设备传输数据；每个网络接口设备作为数据传输通道上的硬件设备，用于根据其所属节点设备提供的指示应用层的数据处理的命令，利用其内部的硬件模块对其所属节点设备要传输的数据进行应用层的数据处理，并将处理后的数据进行网络传输协议的封装后发送出去。
本申请实施例还提供一种区块链系统，包括：多个区块链节点；每个区块链节点包 含网络接口设备，并通过其包含的网络接口设备向其它区块链节点广播共识消息；每个网络接口设备作为共识消息传输通道上的硬件设备，用于根据其所属区块链节点提供的数据处理命令，利用其内部的硬件模块对其所属区块链节点要广播的共识消息进行共识过程中的数据处理，并将处理后的共识消息进行网络传输协议的封装后发送出去。
本申请实施例还提供一种网络接口设备，包括：接口模块、应用处理模块和传输模块；所述接口模块，用于获取其所属节点设备要传输的第一数据和第一处理命令，所述第一处理命令指示数据发送方向上至少一种应用层的数据处理；所述应用处理模块，用于根据所述第一处理命令，对所述第一数据进行数据发送方向上至少一种应用层的数据处理；所述传输模块，用于对所述应用处理模块处理后的第一数据进行网络传输封装，并将封装后的第一数据发送出去。
本申请实施例还提供一种数据发送方法，适用于网络接口设备，所述方法包括：获取所述网络接口设备所属节点设备要传输的第一数据和第一处理命令，所述第一处理命令指示数据发送方向上至少一种应用层的数据处理；根据所述第一处理命令，对所述第一数据进行数据发送方向上至少一种应用层的数据处理；对经过所述至少一种应用层的数据处理后的第一数据进行网络传输协议的封装，并将封装后的第一数据发送出去。
本申请实施例还提供一种数据接收方法，适用于网络接口设备，所述方法包括：接收发往所述网络接口设备所属节点设备的第二数据，对所述第二数据进行网络传输协议的解封装处理；根据所述节点设备预先提供的第二处理命令，对解封装后的第二数据进行数据接收方向上至少一种应用层的数据处理；将经过数据接收方向上至少一种应用层的数据处理后的第二数据发送给所述节点设备。
在本申请实施例中，对节点设备中的网络接口设备进行功能扩展，将应用层的一些数据处理卸载到网络接口设备中，借助网络接口设备处于数据传输通道上的优势和其硬件优势，由网络接口设备在数据传输中利用其内部的硬件模块对数据实现应用层的数据处理，一方面有利于减少节点设备进行这些数据处理所需的内存拷贝等操作，节约CPU资源，另一方面可提升网络通信效率，进而提高节点设备所在系统的吞吐量和可扩展性。
附图说明
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。在附图中：
图1为本申请示例性实施例提供的一种区块链系统的架构示意图；
图2a为本申请示例性实施例提供的一种命令结构的示意图；
图2b为本申请实施例提供的一种数据处理命令的结构示意图；
图2c为针对图2b所示数据处理命令的数据处理过程的示意图；
图3为本申请示例性实施例提供的一种网络系统的结构示意图；
图4a为本申请示例性实施例提供的一种网络接口设备的结构示意图；
图4b为本申请示例性实施例提供的另一种网络接口设备的结构示意图；
图5a为本申请示例性实施例提供的一种数据发送方法的流程示意图；
图5b为本申请示例性实施例提供的一种数据接收方法的流程示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合本申请具体实施例及相应的附图对本申请技术方案进行清楚、完整地描述。显然，所描述的实施例仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
针对区块链系统面临的共识过程长，交易处理速度较低，区块链系统的TPS和规模的可扩展性受限等技术问题，在本申请一些实施例中，对节点设备中的网络接口设备进行功能扩展，将应用层的一些数据处理卸载到网络接口设备中，借助网络接口设备处于数据传输通道上的优势和其硬件优势，由网络接口设备在数据传输中利用其内部的硬件模块对数据实现应用层的数据处理，一方面有利于减少节点设备进行这些数据处理所需的内存拷贝等操作，节约CPU资源，另一方面可提升网络通信效率，进而提高节点设备所在系统的吞吐量和可扩展性。
以下结合附图，详细说明本申请各实施例提供的技术方案。
图1为本申请示例性实施例提供的一种区块链系统的架构示意图。如图1所示，该区块链系统包括：多个区块链节点10。区块链节点10可以是任何具有一定计算和通信能力的计算机设备，例如可以是常规服务器、云服务器、云主机、虚拟中心或服务器阵列等服务器设备，也可以是智能手机、笔记本电脑或平板电脑等终端设备。
如图1所示，每个区块链节点10包含网络接口设备10a，该网络接口设备10a是区块链节点10接入网络，并与其它区块链节点10进行网络通信所需的硬件设备。在本实施例中，网络接口设备10a可工作于OSI七层模型中的物理层和数据链路层(相当于TCP/IP四层模型中的网络接口层)，为其所属区块链节点10提供物理层和数据链路层 的服务。网络接口设备10a可根据支持的网络传输协议为其所属区块链节点10提供网络传输服务，例如可以对其所属区块链节点10要传输的数据进行网络传输协议的封装并将封装后的数据发送出去。本实施例并不限定网络接口设备10a支持的网络传输协议，例如可以是TCP/IP协议或远程直接数据存取(Remote Direct Memory Access，RDMA)协议等。
本实施例并不限定网络接口设备10a的实现形态，例如网络接口设备10a可以是网卡(network interface card)、网络接口控制器、网络适配器(network adapter)或局域网接收器(LAN adapter)等。其中，网络接口设备10a可以作为扩展卡插到区块链节点10的总线上，也可以直接集成在区块链节点10中。另外，区块链节点10与网络接口设备10a之间可以是一对一的关系，也可以是一对多，或多对一的关系。即，每个区块链节点10可以包含一个或多个网络接口设备10a；一个网络接口设备10a也可以为多个区块链节点10共用。本申请实施例中的“多个”是指两个或两个以上。
如图1所示，在本实施例的区块链系统中，多个区块链节点10通过其所包含的网络接口设备10a进行网络互联形成点对点(P2P)网络，每个区块链节点10相当于一个P2P节点，区块链节点10之间可以进行点对点的数据传输。另外，本实施例的区块链系统支持共识机制。以应用于交易系统为例，每个区块链节点10可接收外部客户提交的交易信息，验证交易信息，然后通过共识过程形成所有区块链节点10一致性认可的交易区块，并在满足一定条件时，推进交易的具体执行和成块上链，进而达到在各区块链节点10之间维护同一个区块链的目的。
其中，共识过程是一个通信密集型过程，对一个区块链节点10来说，要向其它区块链节点10广播共识消息，并接收其它区块链节点10广播的共识消息。具体地，区块链节点10可以通过其包含的网络接口设备10a向其它区块链节点10广播共识消息，并通过其包含的网络接口设备10a接收其它区块链节点10广播的共识消息。网络接口设备10a作为共识消息传输通道上的硬件设备，区块链节点10可以将要传输的共识消息发送给网络接口设备10a，网络接口设备10a根据所支持的网络传输协议，对共识消息进行封装，将封装后的共识消息发送出去。
在本实施例的区块链系统中，在将共识消息广播出去之前，可以对共识消息进行安全通信相关的数据处理，例如安全通信加密等处理，以保证通信安全。例如，区块链节点10可以对要发送的共识消息进行安全通信加密等处理，然后将加密后的共识消息发送给网络接口设备10a，由网络接口设备10a根据网络传输线协议将加密后的共识消息封装 成数据帧，并将数据帧发送出去。当然，对于接收到的共识消息，区块链节点10会进行相应的解密处理。由此可见，整个共识过程中存在一些数据处理任务，这对区块链节点10的处理能力要求较高，如果区块链节点10不能及时处理大规模高并发的共识消息时，会导致共识过程延长，限制区块链系统的吞吐量和规模的可扩展性。可选地，区块链系统的吞吐量可以用每秒事务处理量(TransactionPerSecond，TPS)表示。
在本实施例中，对区块链节点10中的网络接口设备10a进行了功能扩展，将共识过程中的一些数据处理卸载到网络接口设备10a中。如何将共识过程中的数据处理以及将哪些数据处理卸载到网络接口设备10a是关键问题。在本实施例中，区块链节点10向网络接口设备10a提供数据处理命令，通过数据处理命令指示需要网络接口设备10a执行的共识过程中的数据处理，这样，可借助网络接口设备10a处于数据传输通道上的优势和其硬件优势，由网络接口设备10a在共识消息传输过程中利用其内部的硬件模块对要广播的共识消息进行共识过程中的数据处理。对网络接口设备10a来说，作为共识消息传输通道上的硬件设备，可根据其所属区块链节点10提供的数据处理命令，利用其内部的硬件模块对其所属区块链节点10要广播的共识消息进行共识过程中的数据处理，并将处理后的共识消息进行网络传输协议的封装后发送出去。一方面有利于减少区块链节点10进行这些数据处理所需的内存拷贝等操作，节约CPU资源；另一方面可借助网络接口设备的硬件优势，加速共识消息的处理，加速共识过程，进而提高区块链系统的TPS和可扩展性。
值得说明的是，根据区块链系统的应用场景、采用的共识机制等因素的不同，共识过程中的数据处理过程也会有所不同，本申请对此不做限定。以实用拜占庭容错(Practical Byzantine Fault Tolerance，PBFT)算法为例，共识过程可分为三个阶段，以第一区块链节点对外广播要共识的交易信息为例，第一阶段：由第一区块链节点对要共识的一组交易信息通过sha-256算法生成共识摘要，将共识摘要和要共识的交易信息组成pp消息，通过其包含的网络接口设备将pp消息广播给其它区块链节点；第二阶段：其它区块链节点对收到的pp消息比对共识摘要，将共识摘要组成p消息广播出去；每个区块链节点收到p消息后，对p消息通过sha-256算法生产确认(commit)摘要，对commit摘要进行ecdas签名，将签名组成commit消息，将commit消息广播出去；第三阶段：每个区块链节点收到commit消息后，根据pp消息的共识摘要通过sha-256算法生产commit摘要，利用生成的commit摘要对commit消息进行签名验证。从上述过程可以看出虽然共识过程不尽相同，但是主要涉及消息摘要、数字签名、签名验证等计算以及广播通信。基于 此，在本申请实施例中，提取共识过程中具有通用性的数据处理，将其卸载到数据传输通路上的网络接口设备中，借助网络接口设备的优势进行飞行(in-flight)中的加速，节约区块链节点的资源和操作。可选地，对共识过程中具有通用性的数据处理划分为两类：安全加密处理和广播通信加速处理。其中，安全加密处理包括数字签名和签名验证等。
进一步，为了保证区块链节点之间的通信安全，还可以在传输层上使用安全协议，利用安全协议搭建安全通信通道。可选地，传输层使用的安全协议包括但不限于：安全套接层(Secure Socket Layer，SSL)、传输层安全(Transport Layer Security，TLS)等。其中，利用这些安全协议可以在传输层对要广播的共识消息进行加密处理，简称为传输层加密处理。基于此，上述安全加密处理还可以包括传输层加密处理。
基于上述，可对网络接口设备扩展以下功能：签名认证功能、安全协议处理功能和广播加速功能。其中，签名认证主要负责对共识消息进行数字签名或签名验证；安全协议处理功能主要负责对共识消息进行传输层的加密或解密处理；广播加速功能主要负责为共识消息生成广播所需的多个传输层协议头，这样在共识消息广播过程中可以直接在一份共识消息上添加不同传输层协议头，无需读取多份共识消息，有利于提高广播效率，实现广播通信的加速。
进一步，考虑到不同共识消息涉及的数据处理会有所不同，为了对不同共识消息实现指定的数据处理，可将网络接口设备的签名认证功能、安全协议处理功能、广播加速功能以及传统的传输功能组合起来，设置成一条可配置的数据通路。相应地，网络接口设备还面向区块链节点提供一种命令接口，以供区块链节点配置需要对要广播的共识消息或要接收的共识消息进行的数据处理。基于此，区块链节点可以通过网络接口设备提供的命令接口向网络接口设备发送数据处理命令，通过数据处理命令定义需要对要广播的共识消息或要接收的共识消息进行的数据处理。例如，区块链节点可以通过数据处理命令定义对其要广播的共识消息进行数字签名、传输层加密处理和广播加速处理，这样网络接口设备可以根据接收到的数据命令，利用其内部的硬件模块对区块链节点要广播的共识消息依次进行数字签名、传输层加密处理和广播加速处理，并将一系列处理后的共识消息进行网络传输协议的封装，然后发送出去。相应地，区块链节点可以通过数据处理命令定义对其要接收的共识消息进行传输层解密处理和签名验证，这样网络接口设备在接收到需要区块链节点接收的共识消息后，对该共识消息进行网络传输协议的解封装，然后根据区块链节点提供的数据命令，利用其内部的硬件模块对解封装后的共识消息依次进行传输层解密处理和签名验证，并将一系列处理后的共识消息发送给区块链节 点。借助网络接口设备的硬件优势，可加速共识消息的发送和接收过程，进而提高网络共识性能。
上述数据处理命令(cmd)是一组命令的集合，指示了要使用网络接口设备对共识消息执行的一系列有序操作。本申请实施例并不限定数据处理命令的命令格式。如图2a所示，为本申请实施例提供的一种可选的命令结构，但并不限于此。如图2a所示，该命令结构包含命令头(cmdheader)和命令体(cmdbody)，其中cmdheader包含命令长度(cmdlength)，cmdlength指示了命令的数量；cmdbody包含了一系列命令项(cmdentry)，每个cmdentry指示一种硬件操作，一个或多个硬件操作可构成一种本申请实施例所述的一种数据处理，该cmdentry包括了操作码(opcode)和操作参数列表(parameterlist)。每一个操作的操作数都是前一个操作处理后的数据。
图2b描述了一个具体的数据处理命令，图2c描述了该数据处理命令对应的数据处理过程的示意图。图2b所示数据处理命令示意了区块链共识过程中构建并广播pp消息的有序操作，共包含6个，依次是：哈希(sha256)：对pp消息进行sha256计算，获得摘要(Digest)；插入(insert)：将sha256计算出的摘要Digest插入到pp消息的偏移(offset)＝0处；分段(segment)：将插入Digest后的pp消息(pp消息+Digest)按大小(size)64K进行分段，得到数据段seg0～seg3；压缩(compress)：将各分段数据进行压缩，分别获得压缩数据cmp0～cmp3；SSL：对压缩数据进行SSL记录(Record)协议处理，包括计算hash获得摘要MAC，将数据和摘要MAC组合后的数据进行AES加密，得到cipher0-3，并附加SSL头；广播(broadcast)：将经过SSL Record协议处理后的数据，根据预先记录的各区块链节点的信息，生成每个区块链节点对应的传输层协议头，最后封装各区块链节点对应的数据发送出去。
关于网络接口设备的内部实现，本申请实施例不做限定。可选地，一种网络接口设备的内部实现结构可参见图4a或图4b所示实施例，在此暂不详述。
值得说明的是，本实施例的区块链系统可位于TCP/IP模型中的应用层，运行于TCP/IP协议层之上。基于此，区块链系统中的共识过程属于应用层，相应地，共识过程中的数据处理属于应用层的数据处理，则本申请实施例提出的“将共识过程中的数据处理卸载到网络接口设备中”的思路可以扩展为“将应用层的一些数据处理卸载到网络接口设备中”，进而应用于区块链系统之外的其它网络系统，尤其是P2P网络系统。
图3为本申请示例性实施例提供的一种网络系统的结构示意图。如图3所示，该网络系统包括：多个节点设备30；每个节点设备30包含网络接口设备30a，节点设备30 通过其包含的网络接口设备30a可以与其它节点设备30进行网络互联并向其它节点设备30传输数据。其中，节点设备30之间可以形成P2P网络，也可以是非P2P网络，对此不做限定。
本实施例的节点设备30可以是任何具有一定计算和通信能力的计算机设备，例如可以是常规服务器、云服务器、云主机、虚拟中心或服务器阵列等服务器设备，也可以是智能手机、笔记本电脑或平板电脑等终端设备。
网络接口设备30a是节点设备30接入网络，并与其它节点设备30进行网络通信所需的硬件设备。网络接口设备30a可根据支持的网络传输协议为其所属节点设备30提供网络传输服务，例如可以对其所属节点设备30要传输的数据进行网络传输协议的封装并将封装后的数据发送出去。本实施例并不限定网络接口设备30a支持的网络传输协议，例如可以是TCP/IP协议，也可以是RDMA协议等。
本实施例并不限定网络接口设备30a的实现形态，例如网络接口设备30a可以是网卡、网络接口控制器、网络适配器或局域网接收器等。网络接口设备30a可以作为扩展卡插到节点设备30的总线上，也可以直接集成在节点设备30中。另外，节点设备30与网络接口设备30a之间可以是一对一的关系，也可以是一对多，或多对一的关系。即，每个节点设备30可以包含一个或多个网络接口设备30a；一个网络接口设备30a也可以为多个节点设备30共用。
在本实施例中，网络接口设备30a进行了功能扩展，将应用层的一些数据处理卸载到网络接口设备30a中。这样，在某个节点设备30需要与其它节点设备30进行数据传输的情况下，可以向其包含的网络接口设备30a提供指示应用层的数据处理的命令，通过网络接口设备30对要传输的数据进行该命令所指示的应用层的数据处理。对网络接口设备30a来说，作为数据传输通道上的硬件设备，可根据其所属节点设备30提供的指示应用层的数据处理的命令，利用其内部的硬件模块对其所属节点设备30要传输的数据进行应用层的数据处理，并将处理后的数据进行网络传输协议的封装后发送出去。一方面有利于减少节点设备30进行这些数据处理所需的内存拷贝等操作，节约CPU资源；另一方面可借助网络接口设备30a的硬件优势，加速数据处理的速度，进而提高节点设备30所在系统的吞吐量和可扩展性。可选地，系统的吞吐量可以是TPS，或者每秒查询率(Queries Per Second，QPS)。
值得说明的是，根据网络系统的应用场景、数据传输机制等因素的不同，网络系统中应用层的数据处理过程也会有所不同，本申请对此不做限定。在本申请实施例中，根 据数据传输方向，将应用层的数据处理划分为数据发送方向上的至少一种应用层的数据处理和数据接收方向上的至少一种应用层的数据处理。
对节点设备30来说，在需要向其它节点设备传输数据的情况下，可以向其包含的网络接口设备30a提供要传输的数据和对应的处理命令。为便于描述和区分，将这里的数据记为第一数据，将这里的处理命令记为第一处理命令。第一处理命令指示数据发送方向上至少一种应用层的数据处理。对网络接口设备30a来说，可获取其所属节点设备30要传输的第一数据和第一处理命令；根据第一处理命令，对第一数据进行数据发送方向上至少一种应用层的数据处理；对处理后的第一数据进行网络传输协议的封装，并将封装后的第一数据发送出去。
可选地，节点设备30可以将第一数据和第一处理命令直接发送给网络接口设备30a；网络接口设备30a可以直接接收节点设备30发送的第一数据和第一处理命令。或者，节点设备30可以将第一数据和第一处理命令的地址发送给网络接口设备30a；网络接口设备30a根据该地址读取第一数据和第一处理命令。进一步可选地，网络接口设备30a可以采用直接内存存取(Direct Memory Access，DMA)方式从节点设备30的内存中读取第一数据和第一处理命令。
对于节点设备30需要接收其它节点设备传输的数据的情况，节点设备30可以预先将第二处理命令配置给网络接口设备30a；第二处理命令指示数据接收方向上至少一种应用层的数据处理。基于此，网络接口设备30a可接收由其它节点设备30发往其所属节点设备30的第二数据，并对第二数据进行网络传输协议的解封装；根据第二处理命令，对解封装后的第二数据进行数据接收方向上至少一种应用层的数据处理，将处理后的第二数据发送给其所属节点设备30。
可选地，以采用安全通信机制的P2P网络为例，则数据发送方向上至少一种应用层的数据处理包括：数字签名、传输层加密处理和广播通信加速处理；相应地，数据接收方向上至少一种应用层的数据处理包括：传输层解密处理和签名验证。
本实施例的网络接口设备内部包含至少一个硬件模块，这些硬件模块位于数据传输通道上，彼此之间相互配合可在数据传输过程中对要传输的数据进行应用层的数据处理，并将处理后的数据进行网络传输协议的封装后发送出去。关于网络接口设备的内部实现结构，本申请实施例不做限定。本申请下面实施例提供一种网络接口设备的内部实现结构，该网络接口设备不仅适用于图3所示的网络系统，也适用于图1所示的区块链系统。
图4a为本申请示例性实施例提供的一种网络接口设备的结构示意图。如图4a所示， 该网络接口设备至少包括以下硬件模块：接口模块41、应用处理模块42和传输模块43。这些硬件模块可以采用FPGA或ASIC实现，但不限于此。
其中，接口模块41是网络接口设备与其所属节点设备之间的通信接口，可以采用各种接口协议，例如可以采用PCIE、PCI等I/O协议。
接口模块41可获取其所属节点设备要传输的第一数据和第一处理命令，并将第一数据和第一处理命令传输给应用处理模块42。其中，第一处理命令指示数据发送方向上至少一种应用层的数据处理。可选地，节点设备可以将第一数据和第一处理命令的地址发送给接口模块41；接口模块41根据节点设备提供的地址，去节点设备读取第一数据和第一处理命令。
应用处理模块42与接口模块41连接，可根据第一处理命令，对第一数据进行数据发送方向上至少一种应用层的数据处理，并将处理后的第一数据传输给传输模块43。传输模块43与应用处理模块42连接，用于对应用处理模块处理后的第一数据进行网络传输封装，并将封装后的第一数据发送出去。
可选地，传输模块43还可接收发往其所属节点设备的第二数据，并对第二数据进行网络传输协议的解封装，将解封装后的第二数据传输给应用处理模块42。应用处理模块42还用于：根据其所属节点设备预先提供的第二处理命令，对传输模块43解封装后的第二数据进行数据接收方向上至少一种应用层的数据处理，并将处理后的第二数据传输给接口模块41。接口模块41还用于：将应用处理模块42处理后的第二数据传输给其所属节点设备。其中，第二处理命令指示数据接收方向上至少一种应用层的数据处理，是节点设备预先提供的。
值得说明的是，根据应用场景、数据传输机制等不同，需要网络接口设备进行的应用层的数据处理也会有所不同；针对不同应用层的数据处理，应用处理模块42的内部实现结构也会有所不同。在图4b所示的网络接口设备中，给出一种应用处理模块42的实现结构。图4b所示的应用处理模块42的实现结构仅为一种示例，并不限于此。如图4b所示，应用处理模块42依次包括：签名认证单元421、安全协议单元422和广播加速单元423。其中，第一处理命令依次通过签名认证单元421、安全协议单元422和广播加速单元423；签名认证单元421、安全协议单元422和广播加速单元423可根据第一处理命令的指示，对第一数据进行相应处理。
其中，签名认证单元421也可称为签名认证引擎(Signature-authorization Engine，SAE)，具有数字签名和签名验证的能力。接口模块41将第一数据和第一处理命令提供 给签名认证单元421。签名认证单元421与接口模块41连接，可在第一处理命令指示数字签名处理的情况下，对接口模块41传输来的第一数据进行数字签名，并将数字签名后的第一数据传输给安全协议单元422；或者，在第一处理命令未指示数字签名处理的情况下，直接将接口模块41传输来的第一数据传输给安全协议单元422。其中，签名认证单元421还将第一处理命令发送给安全协议单元422。
安全协议单元422也可称为安全协议引擎(Security Protocol Engint，SPE)，主要实现传输层上的安全协议处理，例如具备传输层的加解密能力。安全协议单元422与签名认证单元421连接，可接收签名认证单元421传输过来的第一数据，在第一处理命令指示传输层加密处理的情况下，根据传输层使用的安全协议对签名认证单元421传输来的第一数据进行传输层的加密处理，并将加密处理后的第一数据传输给广播加速单元423；或者，在第一处理命令未指示传输层加密处理的情况下，直接将签名认证单元421传输来的第一数据传输给广播加速单元423。其中，签名认证单元421传输来的第一数据可能是经过数字签名后的第一数据，也可能是未经过数字签名的第一数据。其中，安全协议单元422还将第一处理命令发送给广播加速单元423。
广播加速单元423也可称为广播加速引擎(Braodcast-acceleration Engine，BAE)，负责提供广播发送方式下各接收端对应的传输层协议头，实现广播发送的加速。广播加速单元423与安全协议单元422连接，可接收安全协议单元422传输来的第一数据，在第一处理命令指示广播加速处理的情况下，根据网络系统中多个节点设备的信息，为安全协议单元422传输来的第一数据生成广播所需的多个传输层协议头(例如TCP/IP包头)，以供传输模块43根据多个传输层协议头将安全协议单元422传输来的第一数据广播出去；或者，在第一处理命令未指示广播加速处理的情况下，直接将安全协议单元422传输来的第一数据传输给传输模块43。安全协议单元422传输来的第一数据可能是经过数字签名和传输层加密处理后的第一数据，有可能时仅经过传输层加密处理后的第一数据，也可能是未经数字签名和传输加密处理的第一数据。
其中，每个传输层协议头对应一个节点设备，多个节点设备可以包括网络接口设备所属的节点设备，也可以仅包括网络接口设备所属的节点设备之外的其它节点设备。另外，广播加速单元423还与传输模块43连接，用于将多个传输层协议头传输给传输模块43，并将安全协议单元42传输来的第一数据传输给传输模块43。传输模块43接收到多个传输层协议头和第一数据后，可以为第一数据添加不同的传输层协议头发送给不同的节点设备。在这个过程中，节点设备只需向网络接口设备提供一份第一数据，无需提供 多份第一数据，可以节约节点设备多次从内存中读取第一数据的操作，也可以消除第一数据在节点设备和网络接口设备之间的冗余传输，节约资源，还可提高广播通信的效率，实现广播加速。
可选地，签名认证单元421、安全协议单元422和广播加速单元423中可以预置可执行的操作码列表。这样，当第一处理命令到达某个单元时，该单元可以将依次检查第一处理命令中的操作码是否命中自己可执行的操作码，如果命中，则对第一数据执行该操作码指示的硬件动作，直到检查到不支持的操作码时，则将处理后的第一数据及第一处理命令传递给下一个单元。值得说明的是，广播加速单元423无需向传输模块43传输第一处理命令。下面结合图2b所示的数据处理命令，对应用处理模块42的工作过程进行说明：
其中，图2b所示的数据处理命令可以作为本实施例中的第一处理命令，则网络接口设备中的接口模块41在获取pp消息和图2b所示的数据处理命令后，首先将pp消息和该数据处理命令传递给签名认证单元421，签名认证单元421检查第一个操作码(sha256)，发现不在自己可执行的操作码列表中，于是不作任何处理，直接将pp消息和数据处理命令透传给安全协议单元422。
安全协议单元422接收到pp消息和数据处理命令，依次检查到第一个操作码(sha256)到第五个操作码(SSL)都在自己可执行的操作码列表中，则依次执行相应操作：当检查到操作码(sha256)命中时，对pp消息进行sha256计算，获得摘要(Digest)；当检查到操作码(insert)命中时，将sha256计算出的摘要Digest插入到pp消息的偏移offset＝0处；当检查到操作码(segment)命中时，将插入Digest后的pp消息(pp消息+Digest)按64K进行分段，得到数据段seg0～seg3；当检查到操作码(compress)命中时，将各分段数据进行压缩，分别获得压缩数据cmp0～cmp3；当检查到操作码(SSL)命中时，对压缩数据进行SSL记录(Record)协议处理，包括计算hash获得摘要MAC，将数据和摘要MAC组合后的数据进行AES加密，并添加附加SSL头；当检查到操作码(broadcast)不命中时，将处理后的数据和数据处理命令传递给广播加速单元423。值得说明的是，上述数据处理命令中第一个到第五个操作码对应的硬件动作构成了本申请实施例限定的一个数据处理，即传输层加密处理。
广播加速单元423接收安全协议单元422处理后的数据和数据处理命令，当检查到第六个操作码(broadcast)命中时，对SSL Record协议处理后的数据，根据预先配置的系统中各节点设备的信息，生成每个节点设备对应的传输层协议头，将每个节点设备对 应的传输层协议头传递给传输模块43，由传输模块43封装成每个节点设备对应的数据后发送出去。
另外，安全协议单元422还与传输模块43连接，可在第二处理命令指示传输层解密处理的情况下，根据传输层使用的安全协议对传输模块43传输来的第二数据进行传输层的解密处理，并将解密后的第二数据传输给签名认证单元421；或者，在第二处理命令未指示传输层解密处理的情况下，直接将传输模块43传输来的第二数据传输给签名认证单元421。相应地，签名认证单元421还可在第二处理命令指示签名验证处理的情况下，对安全协议单元422传输来的第二数据进行签名验证，并将通过签名验证的第二数据传输给接口模块41；或者，在第二处理命令未指示签名验证处理的情况下，直接将安全协议单元422传输来的第二数据传输给接口模块41。安全协议单元422传输来的第二数据可能是经过传输层解密处理后的第二数据，也可能是未经过传输层解密处理的第二数据。
进一步，如图4b所示，应用处理模块42还可以包括：加解密单元424。加解密单元424也可称为加解密引擎(Crypto-Process Engine，CPE)，主要进行哈希计算和加解密计算。其中，加解密单元424与签名认证单元421和/或安全协议单元422连接，为签名认证单元421和/或安全协议单元422提供的哈希计算和加解密计算。相应地，签名认证单元421可借助加解密单元424的哈希计算和加解密计算能力对接收到的第一数据进行数字签名，或对接收到的第二数据签名认证。安全协议单元422可借助加解密单元424的哈希计算和加解密计算能力对接收到的第一数据进行传输层加密处理，或对接收到的第二数据进行传输层解密处理。
可选地，签名认证单元421可将接口模块41传输来的第一数据作为待加密数据提供给加解密单元424，加解密单元424可以根据指定或预先配置的哈希算法(例如sha256)对第一数据进行hash计算得到哈希摘要，再根据指定或预先配置的数字签名算法对哈希摘要进行数字签名，并向签名认证单元421返回数字签名结果。同理，安全协议单元422在进行传输层加密处理过程中，可以将需要进行数字签名或加密的数据提供给加解密单元424，加解密单元424根据指定或预先配置的哈希算法(例如sha256)、指定或预先配置的数字签名算法以及指定的加密算法(例如AES)对接收到的数据进行数字签名或加密处理并返回数字签名结果或加密结果。
可选地，签名认证单元421或安全协议单元422也可以将数据处理过程中需要签名验证或解密的数据提供给加解密单元424；加解密单元424根据指定或预先配置的哈希 算法(例如sha256)、指定或预先配置的数字签名算法以及指定的加密算法(例如AES)对接收到的数据进行签名验证或解密处理并返回签名验证结果或解密结果。
进一步，如图4b所示，应用处理模块42还包括：配置单元425。配置单元425，用于接收其所属节点设备通过接口模块41发送的配置信息，为签名认证单元421、安全协议单元422和/或广播加速单元423提供相应配置信息；其中，所述配置信息包括以下至少一种：哈希算法、数字签名算法、传输层使用的安全协议、加密算法、网络系统中各节点设备的信息以及第二处理命令。进一步，配置信息还可以包括对第二数据进行处理所需的一些其它信息，例如对第二数据进行解析所需的事务类型字段的偏移和大小等。事务类型字段是第二数据中的一个字段，表示第二数据所属的事务类型，不同事务类型对应不同的第二处理命令，根据事务类型可唯一确定对第二数据进行应用层的数据处理所使用的第二处理命令。
可选地，配置单元425可以将上述至少一种配置信息存储在本地，相应模块可以到配置单元425中读取所需的配置信息。例如，签名认证单元421在需要使用哈希算法和数字签名算法时可以到配置单元425中读取；安全协议单元422需要使用传输层使用的安全协议和加密算法等时可以到配置单元425中读取；广播加速单元423需要使用各节点设备的信息时可以到配置单元425中读取。另外，签名认证单元421、安全协议单元422和广播加速单元423还可以到配置单元425中读取第二处理命令，以便获知是否需要对发往所属节点设备的第二数据进行相应处理。或者，
可选地，配置单元425也可以将相应配置信息直接配置到各模块中。例如，可以将哈希算法和数字签名算法配置到签名认证单元421中，将传输层使用的安全协议和加密算法等配置到安全协议单元422中，将各节点设备的信息配置到广播加速单元423中，以及将第二处理命令分别配置到签名认证单元421、安全协议单元422和广播加速单元423中。
值得说明的是，除了可以通过配置模块向各单元提供所需的配置信息之外，这些配置信息也可以携带在第一处理命令中，通过第一处理命令提供给相应单元。
值得说明的是，传输模块43主要对接收到的数据进行网络传输协议的封装或解封装处理，例如对第一数据进行封装处理，对第二数据进行解封装处理。根据网络传输协议的不同，封装或解封装的实现过程也会有所不同。以采用TCP/IP协议为例，则如图4b所示，传输模块43包括：传输协议单元431和MAC接口单元432。
传输协议单元431，用于对应用处理模块42处理后的第一数据进行传输层的封装， 主要是指为第一数据封装TCP/IP包头，并将封装后的第一数据传输给MAC接口单元432。MAC接口单元432主要实现网络接口设备的MAC功能，可对传输协议单元431传输来的第一数据进行数据链路层的封装，主要是指为第一数据封装以太网包头，并将封装后的第一数据发送出去。
另外，MAC接口单元432还可接收其它节点设备发往其所属节点设备的第二数据，对第二数据进行数据链路层的解封装，主要是指移除第二数据中的以太网包头，并将解封装后的第二数据传输给传输协议单元431。传输协议单元431还可对MAC接口单元432传输来的第二数据进行传输层的解封装，主要是指移除第二数据中的TCP/IP包头，并将解封装后的第二数据传输给应用处理模块42。应用处理模块42可根据预先配置的第二处理命令，对经过网络传输协议解封装后的第二数据进行应用层的数据处理，并将处理后的第二数据通过接口模块41发送给节点设备，实现节点设备之间的数据传输。
进一步可选地，考虑到不同节点设备之间可能会涉及多种事务(Transaction)类型，不同事务类型下的数据处理会有所不同。在本申请实施例中，可设置事务类型与第二处理命令之间的映射关系，并以配置信息的方式将该映射关系预先配置到节点设备中。基于此，传输协议单元431在对第二数据进行传输层的解封装的过程中，还可以根据预先配置的事务类型字段的偏移和大小，对经过网络传输协议解封装后的第二数据进行解析，得到第二数据的事务类型，例如可以提取自第54个字节(byte)开始的1个字节进行解析得到事务类型，进而可拉取该事务类型对应的第二处理命令，将第二处理命令和经过传输层解封装后的第二数据发送给应用处理模块42。应用处理模块42根据第二处理命令对经过网络传输协议解封装后的第二数据进行应用层的数据处理，并将处理后的第二数据通过接口模块41发送给节点设备，实现节点设备之间的数据传输。或者，传输协议单元431也可以将第二数据的事务类型和经过传输层解封装后的第二数据发送给应用处理模块42；应用处理模块42去配置模块中拉取该事务类型对应的第二处理命令，根据第二处理命令对经过网络传输协议解封装后的第二数据进行应用层的数据处理，并将处理后的第二数据通过接口模块41发送给节点设备。
再者，本申请实施例还提供了数据发送方法和数据接收方法实施例，这些实施例是从网络接口设备的角度进行的描述，下面分别进行详细说明。
图5a为本申请示例性实施例提供的一种数据发送方法的流程示意图。如图5a所示，该数据发送方法包括：
51a、获取网络接口设备所属节点设备要传输的第一数据和第一处理命令，第一处理 命令指示数据发送方向上至少一种应用层的数据处理。
52a、根据第一处理命令，对第一数据进行数据发送方向上至少一种应用层的数据处理。
53a、对经过至少一种应用层的数据处理后的第一数据进行网络传输协议的封装，将封装后的第一数据发送出去。
可选地，根据第一处理命令，对第一数据进行数据发送方向上至少一种应用层的数据处理，包括以下至少一种：
在第一处理命令指示数字签名处理的情况下，对第一数据进行数字签名；
在第一处理命令指示传输层加密处理的情况下，根据传输层使用的安全协议对第一数据或数字签名后的第一数据进行传输层的加密处理；
在第一处理命令指示广播加速处理的情况下，根据网络系统中多个节点设备的信息，为第一数据或数字签名后的第一数据或加密处理后的第一数据生成广播所需的多个传输层协议头，以将第一数据或数字签名后的第一数据或加密处理后的第一数据广播出去。
可选地，结合图4b所示的网络接口设备的实现结构，本实施例提供的数据发送方法的一种详细流程如下：
1、节点设备通过网络接口设备中的接口模块初始化配置系统中各节点设备的信息、网络系统在传输层使用的安全协议、摘要算法和数字签名算法等。
2、节点设备准备要发送的第一数据以及第一处理命令，并将第一数据和第一处理命令所在的地址通过接口模块通知网络接口设备。
3、网络接口设备根据上述地址获取节点设备要发送的第一数据以及第一处理命令。
4、第一数据和第一处理命令进入网络接口设备中的签名认证模块中；若第一处理命令中包含针对签名认证单元的操作码，意味着指示数字签名处理，则根据预先配置的数字签名算法对第一数据实现指定的数字签名处理；若第一处理命令未包含针对签名认证单元的操作码，意味着没有指示数字签名处理，则将第一数据直通给安全协议单元。
5、第一数据和第一处理命令进入安全协议单元中；若第一处理命令中包含针对安全协议单元的操作码，意味着指示传输层加密处理，则根据预先配置的安全协议对第一数据实现指定的安全加密处理；若第一处理命令中未包含针对安全协议单元的操作码，意味着未指示传输层加密处理，则将第一数据直通给广播加速单元。
6、第一数据和第一处理命令进入广播加速单元中；若第一处理命令中包含针对广播加速单元的操作码，意味着指示广播加速处理，则根据预先配置的各节点设备的信息， 生成向各节点设备发送第一数据所需的TCP/IP包头；若第一处理命令中未包含针对广播加速单元的操作码，意味着未指示广播加速处理，则将第一数据直通给传输协单元。
7、第一数据进入传输协议单元中；传输协议单元为第一数据封装不同的TCP/IP包头，并通过MAC接口单元发送出去。
图5b为本申请示例性实施例提供的一种数据接收方法的流程示意图。如图5b所示，该数据接收方法包括：
51b、接收发往网络接口设备所属节点设备的第二数据，对第二数据进行网络传输协议的解封装处理；
52b、根据节点设备预先提供的第二处理命令，对解封装后的第二数据进行数据接收方向上至少一种应用层的数据处理；
53b、将经过数据接收方向上至少一种应用层的数据处理后的第二数据发送给节点设备。
可选地，根据第二处理命令，对解封装后的第二数据进行数据接收方向上至少一种应用层的数据处理，包括以下至少一种：
在第二处理命令指示传输层解密处理的情况下，根据传输层使用的安全协议对解封装后的第二数据进行传输层的解密处理；
在第二处理命令指示签名验证处理的情况下，对解封装后的第二数据或解密处理后的第二数据进行签名验证。
可选地，结合图4b所示的网络接口设备的实现结构，本实施例提供的数据接收方法的一种详细流程如下：
1、节点设备通过网络接口设备中的接口模块初始化配置第二处理命令、第二处理命令对应的事务类型以及事务类型字段在数据报文中的偏移和大小等信息。
2、从网络接口设备中的MAC接口单元接收其它节点设备发往其所属节点设备的第二数据，对第二数据进行数据链路层的解封装，主要是指移除第二数据中的以太网包头，将解封装后的第二数据发送给传输协议单元。
3、传输协议单元对MAC接口单元解封装后的第二数据进行传输层解封装，获取TCP/IP包头、事务类型等，根据事务类型从配置模块获取第二处理命令，将解封装后的第二数据和第二处理命令传递给安全协议单元。
4、解封装后的第二数据和第二处理命令进入安全协议单元；若第二处理命令包含针 对安全协议单元的操作码，意味着指示传输层解密处理，则根据预先配置的安全协议对解封装后的第二数据实现指定的安全解密处理，并将解密后的第二数据和第二处理命令传输给签名认证单元；若第二处理命令未包含针对安全协议单元的操作码，意味着未指示传输层解密处理，将接封装后的第二数据和第二处理命令直通给签名认证单元。
5、解封装后的第二数据或解密后的第二数据和第二处理命令进入签名认证单元；若第二处理命令包含针对签名认证单元的操作码，意味着指示签名验证，则对解封装后的第二数据或解密后的第二数据指定的签名验证，并将通过签名验证的第二数据发送给接口模块；若第二处理命令未包含针对签名认证单元的操作码，意味着未指示签名验证，则将解封装后的第二数据或解密后的第二数据直通给接口模块。
6、接口模块将接收到的第二数据及签名认证结果发送给其所属节点设备，供上层应用进一步处理。
在本申请上述实施例中，通过将网络系统或区块链系统中应用层的一些数据处理卸载到数据传输通道上的网络接口设备中，利用网络接口设备的硬件优势在数据传输路径上对数据进行应用层的处理，可实现飞行(in-flight)中的加速，一方面可以提升系统的TPS通量和规模可扩展性，另一方面还能释放节点设备或区块链节点的CPU资源，让CPU更高效地执行其它操作，全方位提升网络系统或区块链系统的性能。
需要说明的是，上述实施例所提供方法的各步骤的执行主体均可以是同一设备，或者，该方法也由不同设备或同一设备中的不同模块作为执行主体。比如，步骤51a至步骤51c的执行主体可以为网络接口设备中的不同模块；其中，步骤51a的执行主体可以为网络接口设备中的接口模块41，步骤52a的执行主体可以为网络接口设备中的应用处理模块42，步骤53a的执行主体可以为网络接口设备中的传输模块43；等等。
另外，在上述实施例及附图中的描述的一些流程中，包含了按照特定顺序出现的多个操作，但是应该清楚了解，这些操作可以不按照其在本文中出现的顺序来执行或并行执行，操作的序号如51a、52a等，仅仅是用于区分开各个不同的操作，序号本身不代表任何的执行顺序。另外，这些流程可以包括更多或更少的操作，并且这些操作可以按顺序执行或并行执行。需要说明的是，本文中的“第一”、“第二”等描述，是用于区分不同的消息、设备、模块等，不代表先后顺序，也不限定“第一”和“第二”是不同的类型。
本领域内的技术人员应明白，本发明的实施例可提供为方法、系统、或计算机程序产品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的 计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
在一个典型的配置中，计算设备包括一个或多个处理器(CPU)、输入/输出接口、网络接口和内存。
内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括暂存电脑可读媒体 (transitory media)，如调制的数据信号和载波。
还需要说明的是，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、商品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、商品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、商品或者设备中还存在另外的相同要素。
以上所述仅为本申请的实施例而已，并不用于限制本申请。对于本领域技术人员来说，本申请可以有各种更改和变化。凡在本申请的精神和原理之内所作的任何修改、等同替换、改进等，均应包含在本申请的权利要求范围之内。

Claims (25)

  1. 一种网络系统，其特征在于，包括：多个节点设备；每个节点设备包含网络接口设备，并通过其包含的网络接口设备向其它节点设备传输数据；
    每个网络接口设备作为数据传输通道上的硬件设备，用于根据其所属节点设备提供的指示应用层的数据处理的命令，利用其内部的硬件模块对其所属节点设备要传输的数据进行应用层的数据处理，并将处理后的数据进行网络传输协议的封装后发送出去。
  2. 根据权利要求1所述的系统，其特征在于，每个网络接口设备包括以下硬件模块：接口模块、应用处理模块和传输模块；
    所述接口模块，用于获取其所属节点设备要传输的第一数据和第一处理命令，所述第一处理命令指示数据发送方向上至少一种应用层的数据处理；
    所述应用处理模块，用于根据所述第一处理命令，对所述第一数据进行数据发送方向上至少一种应用层的数据处理；
    所述传输模块，用于对所述应用处理模块处理后的第一数据进行网络传输封装，并将封装后的第一数据发送出去。
  3. 根据权利要求2所述的系统，其特征在于，
    所述传输模块还用于：接收发往其所属节点设备的第二数据，并对所述第二数据进行网络传输协议的解封装；
    所述应用处理模块还用于：根据其所属节点设备预先提供的第二处理命令，对所述传输模块解封装后的第二数据进行数据接收方向上至少一种应用层的数据处理；所述第二处理命令指示数据接收方向上至少一种应用层的数据处理；
    所述接口模块还用于：将所述应用处理模块处理后的第二数据发送给其所属节点设备。
  4. 根据权利要求3所述的系统，其特征在于，所述应用处理模块依次包括：签名认证单元、安全协议单元和广播加速单元；
    所述签名认证单元，用于在所述第一处理命令指示数字签名处理的情况下，对所述接口模块传输来的第一数据进行数字签名，并将数字签名后的第一数据传输给所述安全协议单元；或者，在所述第二处理命令指示签名验证处理的情况下，对所述安全协议单元传输来的第二数据进行签名验证，并将通过签名验证的第二数据传输给所述接口模块；
    所述安全协议单元，用于在所述第一处理命令指示传输层加密处理的情况下，根据 传输层使用的安全协议对所述签名认证单元传输来的第一数据进行传输层的加密处理，并将加密处理后的第一数据传输给所述广播加速单元；或者，在所述第二处理命令指示传输层解密处理的情况下，根据传输层使用的安全协议对所述传输模块传输来的第二数据进行传输层的解密处理；
    所述广播加速单元，用于在所述第一处理命令指示广播加速处理的情况下，根据所述多个节点设备的信息，为所述安全协议单元传输来的第一数据生成广播所需的多个传输层协议头，以供所述传输模块根据所述多个传输层协议头将所述安全协议单元传输来的第一数据广播出去。
  5. 根据权利要求4所述的系统，其特征在于，
    所述签名认证单元还用于：在所述第一处理命令未指示数字签名处理的情况下，直接将所述接口模块传输来的第一数据传输给所述安全协议单元；或者，在所述第二处理命令未指示签名验证处理的情况下，直接将所述安全协议单元传输来的第二数据传输给所述接口模块；
    所述安全协议单元还用于：在所述第一处理命令未指示传输层加密处理的情况下，直接将所述签名认证单元传输来的第一数据传输给所述广播加速单元；或者，在所述第二处理命令未指示传输层解密处理的情况下，直接将所述传输模块传输来的第二数据传输给所述签名认证单元；
    所述广播加速单元还用于：在所述第一处理命令未指示广播加速处理的情况下，直接将所述安全协议单元传输来的第一数据传输给所述传输模块。
  6. 根据权利要求4所述的系统，其特征在于，所述应用处理模块还包括：
    加解密单元，用于为所述签名认证单元和/或所述安全协议单元提供的哈希计算和加解密计算。
  7. 根据权利要求4所述的系统，其特征在于，所述应用处理模块还包括：
    配置单元，用于接收其所属节点设备通过所述接口模块发送的配置信息，为所述签名认证单元、所述安全协议单元和/或所述广播加速单元提供相应配置信息；
    其中，所述配置信息包括以下至少一种：哈希算法、数字签名算法、传输层使用的安全协议、加密算法、各节点设备的信息以及所述第二处理命令。
  8. 根据权利要求3所述的系统，其特征在于，所述传输模块包括：传输协议单元和MAC接口单元；
    所述传输协议单元，用于对所述应用处理模块处理后的第一数据进行传输层的封 装，并将封装后的第一数据传输给所述MAC接口单元；或者，对所述MAC接口单元传输来的第二数据进行传输层的解封装，并将解封装后的第二数据传输给所述应用处理模块；
    所述MAC接口单元，用于对所述传输协议单元传输来的第一数据进行数据链路层的封装，并将封装后的第一数据发送出去；或者，接收所述第二数据，对所述第二数据进行数据链路层的解封装，并将解封装后的第二数据传输给所述传输协议单元。
  9. 根据权利要求1-8任一项所述的系统，其特征在于，每个网络接口设备采用FPGA或ASIC实现。
  10. 根据权利要求1-8任一项所述的系统，其特征在于，所述网络接口设备为网卡。
  11. 一种区块链系统，其特征在于，包括：多个区块链节点；每个区块链节点包含网络接口设备，并通过其包含的网络接口设备向其它区块链节点广播共识消息；
    每个网络接口设备作为共识消息传输通道上的硬件设备，用于根据其所属区块链节点提供的数据处理命令，利用其内部的硬件模块对其所属区块链节点要广播的共识消息进行共识过程中的数据处理，并将处理后的共识消息进行网络传输协议的封装后发送出去。
  12. 根据权利要求11所述的区块链系统，其特征在于，所述共识过程中的数据处理包括安全加密处理和/或广播通信加速处理。
  13. 根据权利要求11或12所述的系统，其特征在于，所述网络接口设备为网卡。
  14. 一种网络接口设备，其特征在于，至少包括以下硬件模块：接口模块、应用处理模块和传输模块；
    所述接口模块，用于获取其所属节点设备要传输的第一数据和第一处理命令，所述第一处理命令指示数据发送方向上至少一种应用层的数据处理；
    所述应用处理模块，用于根据所述第一处理命令，对所述第一数据进行数据发送方向上至少一种应用层的数据处理；
    所述传输模块，用于对所述应用处理模块处理后的第一数据进行网络传输封装，并将封装后的第一数据发送出去。
  15. 根据权利要求14所述的设备，其特征在于，
    所述传输模块还用于：接收发往其所属节点设备的第二数据，并对所述第二数据进行网络传输协议的解封装；
    所述应用处理模块还用于：根据其所属节点设备预先提供的第二处理命令，对所述 传输模块解封装后的第二数据进行数据接收方向上至少一种应用层的数据处理；所述第二处理命令指示数据接收方向上至少一种应用层的数据处理；
    所述接口模块还用于：将所述应用处理模块处理后的第二数据发送给其所属节点设备。
  16. 根据权利要求15所述的设备，其特征在于，所述应用处理模块依次包括签名认证单元、安全协议单元和广播加速单元；
    所述签名认证单元，用于在所述第一处理命令指示数字签名处理的情况下，对所述接口模块传输来的第一数据进行数字签名，并将数字签名后的第一数据传输给所述安全协议单元；或者，在所述第二处理命令指示签名验证处理的情况下，对所述安全协议单元传输来的第二数据进行签名验证，并将通过签名验证的第二数据传输给所述接口模块；
    所述安全协议单元，用于在所述第一处理命令指示传输层加密处理的情况下，根据传输层使用的安全协议对所述签名认证单元传输来的第一数据进行传输层的加密处理，并将加密处理后的第一数据传输给所述广播加速单元；或者，在所述第二处理命令指示传输层解密处理的情况下，根据传输层使用的安全协议对所述传输模块传输来的第二数据进行传输层的解密处理；
    所述广播加速单元，用于在所述第一处理命令指示广播加速处理的情况下，根据网络系统中多个节点设备的信息，为所述安全协议单元传输来的第一数据生成广播所需的多个传输层协议头，以供所述传输模块根据所述多个传输层协议头将所述安全协议单元传输来的第一数据广播出去。
  17. 根据权利要求16所述的设备，其特征在于，所述签名认证单元还用于：在所述第一处理命令未指示数字签名处理的情况下，直接将所述接口模块传输来的第一数据传输给所述安全协议单元；或者，在所述第二处理命令未指示签名验证处理的情况下，直接将所述安全协议单元传输来的第二数据传输给所述接口模块；
    所述安全协议单元还用于：在所述第一处理命令未指示传输层加密处理的情况下，直接将所述签名认证单元传输来的第一数据传输给所述广播加速单元；或者，在所述第二处理命令未指示传输层解密处理的情况下，直接将所述传输模块传输来的第二数据传输给所述签名认证单元；
    所述广播加速单元还用于：在所述第一处理命令未指示广播加速处理的情况下，直接将所述安全协议单元传输来的第一数据传输给所述传输模块。
  18. 根据权利要求16所述的设备，其特征在于，所述应用处理模块还包括：
    加解密单元，用于用于为所述签名认证单元和/或所述安全协议单元提供的哈希计算和加解密计算。
  19. 根据权利要求16所述的设备，其特征在于，所述应用处理模块还包括：
    配置单元，用于接收其所属节点设备通过所述接口模块发送的配置信息，为所述签名认证单元、所述安全协议单元和/或所述广播加速单元提供相应配置信息；
    其中，所述配置信息包括以下至少一种：数字签名算法、传输层使用的安全协议、各节点设备的信息以及所述第二处理命令。
  20. 根据权利要求15所述的设备，其特征在于，所述传输模块包括：传输协议单元和MAC接口单元；
    所述传输协议单元，用于对所述应用处理模块处理后的第一数据进行传输层的封装，并将封装后的第一数据传输给所述MAC接口单元；或者，对所述MAC接口单元传输来的第二数据进行传输层的解封装，并将解封装后的第二数据传输给所述应用处理模块；
    所述MAC接口单元，用于对所述传输协议单元传输来的第一数据进行数据链路层的封装，并将封装后的第一数据发送出去；或者，接收所述第二数据，对所述第二数据进行数据链路层的解封装，并将解封装后的第二数据传输给所述传输协议单元。
  21. 根据权利要求14-20任一项所述的设备，其特征在于，所述网络接口设备采用FPGA或ASIC实现。
  22. 一种数据发送方法，适用于网络接口设备，其特征在于，所述方法包括：
    获取所述网络接口设备所属节点设备要传输的第一数据和第一处理命令，所述第一处理命令指示数据发送方向上至少一种应用层的数据处理；
    根据所述第一处理命令，对所述第一数据进行数据发送方向上至少一种应用层的数据处理；
    对经过所述至少一种应用层的数据处理后的第一数据进行网络传输协议的封装，并将封装后的第一数据发送出去。
  23. 根据权利要求22所述的方法，其特征在于，根据所述第一处理命令，对所述第一数据进行数据发送方向上至少一种应用层的数据处理，包括以下至少一种：
    在所述第一处理命令指示数字签名处理的情况下，对所述第一数据进行数字签名；
    在所述第一处理命令指示传输层加密处理的情况下，根据传输层使用的安全协议对 所述第一数据或数字签名后的第一数据进行传输层的加密处理；
    在所述第一处理命令指示广播加速处理的情况下，根据网络系统中多个节点设备的信息，为所述第一数据或数字签名后的第一数据或加密处理后的第一数据生成广播所需的多个传输层协议头，以将所述第一数据或数字签名后的第一数据或加密处理后的第一数据广播出去。
  24. 一种数据接收方法，适用于网络接口设备，其特征在于，所述方法包括：
    接收发往所述网络接口设备所属节点设备的第二数据，对所述第二数据进行网络传输协议的解封装处理；
    根据所述节点设备预先提供的第二处理命令，对解封装后的第二数据进行数据接收方向上至少一种应用层的数据处理；
    将经过数据接收方向上至少一种应用层的数据处理后的第二数据发送给所述节点设备。
  25. 根据权利要求24所述的方法，其特征在于，根据所述节点设备预先提供的第二处理命令，对解封装后的第二数据进行数据接收方向上至少一种应用层的数据处理，包括以下至少一种：
    在所述第二处理命令指示传输层解密处理的情况下，根据传输层使用的安全协议对解封装后的第二数据进行传输层的解密处理；
    在所述第二处理命令指示签名验证处理的情况下，对解封装后的第二数据或解密处理后的第二数据进行签名验证。
PCT/CN2020/089721 2019-05-22 2020-05-12 区块链与网络系统、数据接收与发送方法及设备 WO2020233442A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910431080.9 2019-05-22
CN201910431080.9A CN111988264A (zh) 2019-05-22 2019-05-22 区块链与网络系统、数据接收与发送方法及设备

Publications (1)

Publication Number Publication Date
WO2020233442A1 true WO2020233442A1 (zh) 2020-11-26

Family

ID=73436629

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/089721 WO2020233442A1 (zh) 2019-05-22 2020-05-12 区块链与网络系统、数据接收与发送方法及设备

Country Status (2)

Country Link
CN (1) CN111988264A (zh)
WO (1) WO2020233442A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113037824B (zh) * 2021-03-02 2022-04-08 山东大学 一种面向云计算的高性能区块链的构建方法
CN114331732B (zh) * 2022-03-15 2022-05-24 北京微芯感知科技有限公司 一种共识报文压缩方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1516386A (zh) * 2003-08-26 2004-07-28 ����ͨѶ�ɷ����޹�˾ 网络通信安全处理器及其数据处理方法
US20050071628A1 (en) * 2003-09-30 2005-03-31 Cisco Technology, Inc. Method and apparatus of communicating security/encryption information to a physical layer transceiver
CN103703441A (zh) * 2013-05-20 2014-04-02 华为技术有限公司 一种硬盘和数据处理方法
CN107426193A (zh) * 2017-06-30 2017-12-01 重庆大学 一种https应用中针对硬件加速的新型I/O通路设计
CN109246061A (zh) * 2017-07-10 2019-01-18 比亚迪股份有限公司 数据安全传输方法及其装置

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150033222A1 (en) * 2013-07-25 2015-01-29 Cavium, Inc. Network Interface Card with Virtual Switch and Traffic Flow Policy Enforcement
CN107528923B (zh) * 2017-09-30 2020-08-25 江苏农林职业技术学院 一种网络适配器的数据传输方法及网络适配器
CN109714302B (zh) * 2017-10-25 2022-06-14 阿里巴巴集团控股有限公司 算法的卸载方法、装置和系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1516386A (zh) * 2003-08-26 2004-07-28 ����ͨѶ�ɷ����޹�˾ 网络通信安全处理器及其数据处理方法
US20050071628A1 (en) * 2003-09-30 2005-03-31 Cisco Technology, Inc. Method and apparatus of communicating security/encryption information to a physical layer transceiver
CN103703441A (zh) * 2013-05-20 2014-04-02 华为技术有限公司 一种硬盘和数据处理方法
CN107426193A (zh) * 2017-06-30 2017-12-01 重庆大学 一种https应用中针对硬件加速的新型I/O通路设计
CN109246061A (zh) * 2017-07-10 2019-01-18 比亚迪股份有限公司 数据安全传输方法及其装置

Also Published As

Publication number Publication date
CN111988264A (zh) 2020-11-24

Similar Documents

Publication Publication Date Title
US10630654B2 (en) Hardware-accelerated secure communication management
US11171936B2 (en) Method, device, and system for offloading algorithms
US20190171612A1 (en) Network adapter with a common queue for both networking and data manipulation work requests
TWI499342B (zh) 網路卸載方法與系統
US11757973B2 (en) Technologies for accelerated HTTP processing with hardware acceleration
US20150229568A1 (en) Stateless Fibre Channel Sequence Acceleration for Fibre Channel Traffic Over Ethernet
EP3211852A1 (en) Ssh protocol-based session parsing method and system
US20120287944A1 (en) RoCE PACKET SEQUENCE ACCELERATION
WO2020233442A1 (zh) 区块链与网络系统、数据接收与发送方法及设备
EP1614250A2 (en) Transparent ipsec processing inline between a framer and a network component
CN106790221B (zh) 一种英特网协议安全IPSec协议加密方法和网络设备
WO2015025845A1 (ja) 通信システム、スイッチ、コントローラ、アンシラリデータ管理装置、データ転送方法及びプログラム
JP2007512764A (ja) 無線局の暗号化及び復号化をインラインする方法及び装置
US9240952B2 (en) System and method for communication between networked applications
CN112737932B (zh) 一种基于dpdk实现高性能ipsce网关
US11677727B2 (en) Low-latency MACsec authentication
CN113839923B (zh) 一种面向多节点的高性能处理方法
US11599649B2 (en) Method and apparatus for managing transmission of secure data packets
JP2002026927A (ja) カプセリング方法及び装置並びにプログラム記録媒体
US20240048543A1 (en) Encryption acceleration for network communication packets
CN110601950B (zh) 一种基于dtls协议的vpn网关系统和实现方法
CN116232944A (zh) 用于传输层安全协议报文业务的方法、设备及介质
CN117749480A (zh) 一种基于MACSec的多通道数据安全传输方法和装置
KR20240042765A (ko) 모바일 에지 컴퓨팅 시스템 및 이를 이용한 데이터 셋 구성방법
Li et al. A NoC-based multi-core architecture for IEEE 802.11 i CCMP

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20810175

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20810175

Country of ref document: EP

Kind code of ref document: A1