WO2021027035A1

WO2021027035A1 - Network security ipsec acceleration processing method and system

Info

Publication number: WO2021027035A1
Application number: PCT/CN2019/108933
Authority: WO
Inventors: 刘刚
Original assignee: 苏州浪潮智能科技有限公司
Priority date: 2019-08-09
Filing date: 2019-09-29
Publication date: 2021-02-18
Also published as: CN110535834B; CN110535834A

Abstract

A network security IPsec acceleration processing method. The key exchange process between a sender and a receiver has low real-time requirements; therefore, a software is used in the present application to run a key exchange protocol. The data transmission process between the sender and the receiver has high real-time requirements; therefore, hardware having a plurality of pipelines is used in the present application to complete the data transmission process, and in this process, the plurality of pipelines can be used to complete the encryption and decryption process of different data IP packets in parallel (i.e., the hardware is used to run a network security service protocol in parallel), thereby improving the processing speed of a network security IPsec, reducing the utilization rate of a software resource, and improving the network bandwidth. Also disclosed is a network security IPsec acceleration processing system, which has the same beneficial effects as the acceleration processing method.

Description

A method and system for accelerating network security IPsec processing

This application claims the priority of a Chinese patent application filed to the Chinese Patent Office on August 9, 2019, with the application number 201910736381.2 and the invention title "A network security IPsec accelerated processing method and system", the entire content of which is incorporated by reference Incorporated in this application.

Technical field

The invention relates to the field of server networks, in particular to a method and system for accelerating network security IPsec.

Background technique

In the field of server networks, network security is becoming more and more important. At present, IPsec (Internet Protocol Security) is usually run at the software level to achieve network security, that is, the key exchange between the sender and the receiver and the encryption and decryption of transmitted data are realized through software. However, due to the serial execution characteristics of the software, the processing speed of network security IPsec is slow, and at the same time it occupies a lot of software resources and cannot effectively use network bandwidth.

Therefore, how to provide a solution to the above technical problems is a problem that needs to be solved by those skilled in the art.

Summary of the invention

The purpose of the present invention is to provide a method and system for accelerating network security IPsec processing, using software to run key exchange protocols, and hardware to run network security service protocols in parallel, thereby increasing the processing speed of network security IPsec and reducing software resources. The utilization rate of, and increase the network bandwidth.

To solve the above technical problems, the present invention provides a network security IPsec acceleration processing method, including:

Use the first sender software to generate a key exchange IP packet, and transparently transmit the key exchange IP packet to the first receiver's hardware through the first sender's hardware; wherein, the key exchange IP packet includes key data And the first IP address of both parties in the key exchange;

Use the second sender software to perform IP packet processing on the transmission data to obtain a data IP packet, and send the data IP packet to the second sender hardware; wherein, the data IP packet includes the second data transmission and the second data transmission parties. IP address;

Determine whether the second IP address exists in the first IP address;

If yes, then use the corresponding target key data to encrypt the data IP packet on any idle pipeline among the multiple pipelines of the second sender hardware, and send the encrypted data IP packet to the second receiver Third party hardware, to use the target key data to decrypt the data IP packet on any one of the idle pipelines among the multiple pipelines of the second receiver hardware;

If not, the data IP packet is directly transparently transmitted to the second receiver hardware through the second sender hardware.

Preferably, after the data IP packet is directly transparently transmitted to the second receiver's hardware through the second sender's hardware, the network security IPsec acceleration processing method further includes:

Detecting the format of the data IP packet received by the second receiver hardware;

When the format of the data IP packet is a network security service protocol format, the data IP packet is discarded.

Preferably, the accelerated processing method of network security IPsec further includes:

Reserve a first storage space for the sender hardware in the system for storing the state of each pipeline of the sender hardware;

When the system is operating, storing each pipeline state of the sender's hardware in the first storage space in real time;

Correspondingly, the process of using the corresponding target key data to encrypt the data IP packet on any one of the idle pipelines of the multiple pipelines of the second sender hardware includes:

Determine the idle pipeline of the second sender hardware according to the pipeline states of the second sender hardware currently stored in the first storage space;

On any idle pipeline of the second sender hardware, encrypt the data IP packet with the corresponding target key data.

Preferably, the first storage space reserved for the sender hardware in the system for storing the pipeline states of the sender hardware; when the system is operating, the pipeline states of the sender hardware are stored in real time The process to the first storage space includes:

Preliminarily set status flag bits for each pipeline of the sender hardware in the system, and store them in the first storage space reserved for the sender hardware;

When the system is operating, when any pipeline of the sender's hardware is in the working state, the status flag corresponding to this pipeline is set to 1. When any pipeline of the sender's hardware is in an idle state, the pipeline The corresponding status flag position is 0.

Reserve a second storage space for the receiver's hardware in the system for storing each pipeline state of the receiver's hardware;

When the system is operating, storing each pipeline state of the receiver's hardware in the second storage space in real time;

Correspondingly, the process of using the target key data to decrypt the data IP packet on any one of the idle pipelines among the multiple pipelines of the second receiver hardware includes:

Determine the idle pipeline of the second receiver's hardware according to each pipeline state of the second receiver's hardware currently stored in the second storage space;

Use the target key data to decrypt the data IP packet on any idle pipeline of the second receiver hardware.

Preferably, the second storage space reserved for the receiver hardware in the system for storing the pipeline states of the receiver hardware; while the system is operating, the pipeline states of the receiver hardware are stored in real time The process to the second storage space includes:

Pre-set status flag bits for each pipeline of the receiver hardware in the system one by one, and store them in the second storage space reserved for the receiver hardware;

When the system is operating, when any pipeline of the receiver's hardware is in the working state, the status flag corresponding to this pipeline is set to 1; when any pipeline of the receiver's hardware is in an idle state, the pipeline The corresponding status flag position is 0.

Pre-set the key expiration time of the system;

Starting from the operation of the system, at intervals of the expiration time of the key, re-execute the use of the first sender software to generate a key exchange IP packet, and pass the key exchange IP packet to the first sender The step of transparently transmitting the hardware to the hardware of the first receiver.

Preferably, data transmission is performed between the sender's software and the sender's hardware through a PCIE interface.

In order to solve the above technical problems, the present invention also provides a network security IPsec accelerated processing system, including:

The key exchange module is used to generate a key exchange IP packet by using the software of the first sender, and transparently transmit the key exchange IP packet to the hardware of the first receiver through the hardware of the first sender; wherein, the key The exchanged IP packet includes key data and the first IP addresses of both parties in the key exchange;

The data transmission module is configured to use the second sender software to perform IP packet processing on the transmission data to obtain a data IP packet, and send the data IP packet to the second sender hardware; wherein, the data IP packet includes transmission data and The second IP address of the data transmission parties;

The judging module is used to judge whether the second IP address exists in the first IP address; if so, execute the data encryption and decryption module; if not, execute the transparent transmission module;

The data encryption and decryption module is configured to use the corresponding target key data to encrypt the data IP packet on any idle pipeline among the multiple pipelines of the second sender hardware, and to encrypt the encrypted data IP The packet is sent to the second receiver's hardware to decrypt the data IP packet using the target key data on any idle pipeline among the multiple pipelines of the second receiver's hardware;

The transparent transmission module is configured to transparently transmit the data IP packet directly to the second receiver hardware through the second sender hardware.

Preferably, the network security IPsec accelerated processing system further includes:

Time setting module, used to set the key expiration time of the system in advance;

The key exchange trigger module is configured to re-execute the key exchange module every time the key expires from the time the system is operating.

The present invention provides an accelerated processing method for network security IPsec. Because the key exchange process between the sender and the receiver has low real-time requirements, this application uses software to run the key exchange protocol; because the data between the sender and the receiver The transmission process requires high real-time performance, so this application uses hardware with multiple pipelines to complete the data transmission process, and in this process, multiple pipelines can be used to complete the encryption and decryption process of different data IP packets in parallel (that is, hardware parallel operation is used Network Security Service Protocol), thereby improving the processing speed of network security IPsec, reducing the utilization rate of software resources, and increasing network bandwidth.

The present invention also provides a network security IPsec accelerated processing system, which has the same beneficial effects as the aforementioned accelerated processing method.

Description of the drawings

In order to more clearly describe the technical solutions in the embodiments of the present invention, the following will briefly introduce the prior art and the drawings needed in the embodiments. Obviously, the drawings in the following description are only some of the present invention. Embodiments, for those of ordinary skill in the art, without creative work, other drawings can be obtained from these drawings.

FIG. 1 is a flowchart of a method for accelerating network security IPsec processing according to an embodiment of the present invention;

2 is a schematic structural diagram of a network security IPsec accelerated processing system provided by an embodiment of the present invention.

detailed description

The core of the present invention is to provide an accelerated processing method and system for network security IPsec, using software to run the key exchange protocol and hardware to run the network security service protocol in parallel, thereby improving the processing speed of network security IPsec and reducing software resources. The utilization rate of, and increase the network bandwidth.

In order to make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be described clearly and completely in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of the embodiments of the present invention, not all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of the present invention.

Please refer to FIG. 1. FIG. 1 is a flowchart of a network security IPsec acceleration processing method according to an embodiment of the present invention.

The accelerated processing method of the network security IPsec includes:

Step S1: Use the first sender software to generate a key exchange IP packet, and transparently transmit the key exchange IP packet to the first receiver's hardware through the first sender's hardware; wherein, the key exchange IP packet includes key data and The first IP address of the key exchange parties.

Specifically, different senders and receivers in the system have different requirements for data transmission security. For senders and receivers that require higher data transmission security, the transmission data needs to be encrypted and decrypted between the two Processing: For the sender and receiver with low data transmission security requirements, there is no need to encrypt and decrypt the transmitted data between the two. It is understandable that for the sender and receiver (called the first sender and the first receiver) that require high data transmission security, they must exchange keys before data transmission for subsequent encryption and decryption. Lay the foundation for data transmission.

Considering that the key exchange process between the first sender (first sender software + first sender hardware) and the first receiver (first receiver software + first receiver hardware) in the system requires low real-time performance, Therefore, this application uses the software of the first sender to generate a key exchange IP package that includes the key data and the first IP (Internet Protocol, network protocol) address of the key exchange parties (that is, the software runs the key exchange protocol). Among them, the key data is used for subsequent encryption and decryption of data transmitted between the first sender and the first receiver; the first IP addresses of both parties in the key exchange include the IP address of the first sender and the IP of the first receiver address.

After the key exchange IP packet is generated by the first sender software, the key exchange IP packet is sent to the first sender's hardware to be transparently transmitted to the first receiver's hardware through the first sender's hardware to complete the key exchange .

Step S2: Use the second sender software to perform IP packaging processing on the transmission data to obtain the data IP packet, and send the data IP packet to the second sender hardware; wherein the data IP packet includes the transmission data and the second IP of the data transmission parties address.

Specifically, when data is transmitted between the sender and the receiver in the system (referred to as the second sender and the second receiver), first use the second sender software to perform IP packet processing on the transmission data, and obtain the data including the transmission data. And the data IP packet of the second IP address of both parties of the data transmission; then the data IP packet is sent to the second sender hardware. Wherein, the second IP addresses of the data transmission parties include the second IP address of the second sender and the second IP address of the second receiver, so as to lay a foundation for the subsequent determination of whether the transmitted data needs to be encrypted or decrypted.

Step S3: Determine whether there is a second IP address in the first IP address; if yes, execute step S4; if not, execute step S5.

Specifically, it can be understood that if the second sender and the second receiver belong to the first sender and the first receiver mentioned in step S1, then the transmission data needs to be encrypted and decrypted later; if the second sender If the party and the second receiver do not belong to the first sender and the first receiver mentioned in step S1, there is no need to perform encryption and decryption processing on the transmission data subsequently.

Based on this, this application should determine whether the second sender and the second receiver belong to the first sender and the first receiver mentioned in step S1, specifically based on the IP address. If one IP address can match the second IP address of both parties to the data transmission, the second sender and the second receiver belong to the first sender and the first receiver mentioned in step S1; otherwise, the second sender And the second receiver does not belong to the first sender and the first receiver mentioned in step S1.

Step S4: On any idle pipeline among the multiple pipelines of the second sender's hardware, encrypt the data IP packet with the corresponding target key data, and send the encrypted data IP packet to the second receiver's hardware to On any idle pipeline among the multiple pipelines of the second receiver's hardware, use the target key data to decrypt the data IP packet.

Specifically, considering that the same sender may want to transmit data with different receivers, the same receiver may also transmit data with different senders, and the data transmission process between the sender and the receiver requires high real-time performance, Therefore, the sender's hardware and receiver's hardware of this application are both set as hardware with multiple pipelines, which can transmit multiple channels of data in parallel, and can encrypt and decrypt multiple channels of data in parallel (that is, the hardware runs the network security service protocol in parallel) .

It is understandable that when the second sender and the second receiver belong to the first sender and the first receiver mentioned in step S1, the transmission data needs to be encrypted and decrypted. Specifically, since the second sender and the second receiver have exchanged keys, the target key data in the key exchange IP packets corresponding to the second sender and the second receiver can be obtained. When the second sender transmits data to the second receiver, select an idle pipeline from the multiple pipelines of the second sender's hardware, and use the acquired target key data to encrypt the data IP packet on the idle pipeline, and then The encrypted data IP packet is sent to the second receiver hardware.

When the second receiver's hardware receives the encrypted data IP packet, it selects an idle pipeline from the multiple pipelines of the second receiver's hardware, and uses the obtained target key data to decrypt the data IP packet on this idle pipeline , So as to get the transmission data.

Step S5: Transparently transmit the data IP packet directly to the second receiver's hardware through the second sender's hardware.

Specifically, when the second sender and the second receiver do not belong to the first sender and the first receiver mentioned in step S1, there is no need to encrypt and decrypt the transmission data, and the data IP packet is directly sent through the second The hardware of the third party can be transparently transmitted to the hardware of the second receiver.

In addition, the present application may use the second sender's hardware to determine whether to perform encryption processing on the transmission data, and use the second receiver's hardware to determine whether to perform decryption processing on the transmission data. For the second sender's hardware, if the first IP addresses of the two parties in the key exchange can match the second IP addresses of the two parties in the data transmission, the transmitted data will be encrypted, otherwise it will be transmitted directly. For the second receiver's hardware, it receives both the encrypted data IP packet and the unencrypted data IP packet, so the second receiver's hardware first unpacks the data IP packet to obtain the first data transmission of both parties. Two IP addresses, if the first IP addresses of the two parties in the key exchange can match the second IP addresses of the two parties in the data transmission, the transmitted data will be decrypted, otherwise no decryption will be performed.

The present invention provides an accelerated processing method for network security IPsec. Because the key exchange process between the sender and the receiver has low real-time requirements, this application uses software to run the key exchange protocol; because the data between the sender and the receiver The transmission process requires high real-time performance, so this application uses hardware with multiple pipelines to complete the data transmission process, and in this process, multiple pipelines can be used to complete the encryption and decryption process of different data IP packets in parallel (that is, hardware parallel operation is used Network Security Service Protocol), thereby improving the processing speed of network security IPsec, reducing the usage rate of software resources, and increasing network bandwidth.

On the basis of the above embodiment:

As an optional embodiment, after the data IP packet is directly transparently transmitted to the second receiver's hardware through the second sender's hardware, the network security IPsec acceleration processing method further includes:

Detecting the format of the data IP packet received by the second receiver's hardware;

When the format of the data IP packet is the network security service protocol format, the data IP packet is discarded.

Further, considering that in the process of transparently transmitting the data IP packet directly to the second receiver's hardware through the second sender's hardware, there may be errors, causing the second sender's hardware to incorrectly encrypt the data IP packet and send it to the second receiver. The hardware of the receiver. At this time, the hardware of the second receiver cannot decrypt the received data IP packet. Therefore, this application will detect the second receiver’s hardware after transparently transmitting the data IP packet directly to the second receiver’s hardware through the second sender’s hardware. 2. The format of the data IP packet received by the receiver's hardware. If the format of the data IP packet is a normal format, it means that the data IP packet is not encrypted, that is, there is no error in the process of transmitting the data IP packet directly to the second receiver's hardware through the second sender's hardware; if the data IP When the packet format is the network security service protocol format, it means that the data IP packet is encrypted, that is, there is an error in the process of transmitting the data IP packet directly through the second sender's hardware to the second receiver's hardware, then the data IP The packet can be discarded.

As an optional embodiment, the method for accelerating network security IPsec further includes:

Reserve the first storage space for the sender's hardware in the system to store each pipeline state of the sender's hardware;

When the system is operating, store the status of each pipeline of the sender's hardware in the first storage space in real time;

Correspondingly, the process of using the corresponding target key data to encrypt the data IP packet on any idle pipeline among the multiple pipelines of the second sender hardware includes:

Determine the idle pipeline of the second sender's hardware according to each pipeline state of the second sender's hardware currently stored in the first storage space;

On any idle pipeline of the second sender's hardware, use the corresponding target key data to encrypt the data IP packet.

Further, this application may reserve a first storage space for each sender's hardware in the system to store the state of multiple pipelines of each sender's hardware. When the system is operating, the state of the multiple pipelines of each sender's hardware is updated to the first storage space in real time, so that the first storage space retains the latest state of the multiple pipelines of each sender's hardware.

When looking for an idle pipeline from the multiple pipelines of the second sender's hardware, the idle pipeline of the second sender's hardware can be determined according to the state of the multiple pipelines of the second sender's hardware currently stored in the first storage space. The subsequent selection of idle pipelines to encrypt data IP packets lays the foundation.

As an optional embodiment, reserve the first storage space for the sender's hardware in the system to store each pipeline state of the sender's hardware; while the system is operating, store each pipeline state of the sender's hardware in the first storage space in real time. A process of storing space, including:

Pre-set status flags for each pipeline of the sender's hardware in the system one by one, and store them in the first storage space reserved for the sender's hardware;

When the system is operating, when any pipeline of the sender's hardware is in working state, the state flag corresponding to this pipeline is set to 1; when any pipeline of the sender's hardware is idle, the state flag corresponding to this pipeline is set to 0 .

Specifically, this application can set status flags one by one for multiple pipelines of each sender's hardware in the system, and store these status flags in the first storage space reserved for each sender's hardware. When the system is operating, when any pipeline of a sender's hardware is in working state, the status flag position corresponding to this pipeline is "1"; when any pipeline of a sender's hardware is in an idle state, the corresponding pipeline The status flag position is "0", so that the status of multiple pipelines of each sender's hardware is determined according to the value of the status flag bit stored in the first storage space.

Reserve a second storage space for the receiver's hardware in the system to store each pipeline state of the receiver's hardware;

When the system is operating, store the state of each pipeline of the receiver's hardware in the second storage space in real time;

Correspondingly, the process of using the target key data to decrypt the data IP packet on any idle pipeline among the multiple pipelines of the second receiver's hardware includes:

On any idle pipeline of the second receiver's hardware, use the target key data to decrypt the data IP packet.

Furthermore, this application may reserve a second storage space for each receiver's hardware in the system to store the status of multiple pipelines of each receiver's hardware. When the system is operating, the status of the multiple pipelines of each receiver's hardware is updated to the second storage space in real time, so that the second storage space retains the latest state of the multiple pipelines of each receiver's hardware.

When looking for an idle pipeline from the multiple pipelines of the second receiver's hardware, the idle pipeline of the second receiver's hardware can be determined according to the status of the multiple pipelines of the second receiver's hardware currently stored in the second storage space, Then choose an idle pipeline to lay the foundation for decrypting data IP packets.

As an optional embodiment, reserve a second storage space for the receiver's hardware in the system to store each pipeline state of the receiver's hardware; when the system is operating, store each pipeline state of the receiver's hardware in the first 2. The process of storing space, including:

Pre-set status flags for each pipeline of the receiver's hardware in the system one by one, and store them in the second storage space reserved for the receiver's hardware;

When the system is operating, when any pipeline of the receiver's hardware is in working state, the status flag corresponding to this pipeline is set to 1; when any pipeline of the receiver's hardware is idle, the status flag corresponding to this pipeline is set to 0 .

Specifically, this application may set status flags one by one for multiple pipelines of each receiver's hardware in the system, and store these status flags in the second storage space reserved for each receiver's hardware. When the system is operating, when any pipeline of a receiver's hardware is in working state, the status flag position corresponding to this pipeline is "1"; when any pipeline of a receiver's hardware is in idle state, the corresponding pipeline The status flag position is "0", so that the status of multiple pipelines of each receiver's hardware is determined according to the value of the status flag bit stored in the second storage space.

Pre-set the key expiration time of the system;

From the beginning of the system operation, at every key expiration time, re-execute the use of the first sender’s software to generate the key exchange IP package, and transparently transmit the key exchange IP package to the first receiver through the first sender’s hardware Hardware steps.

Further, considering that the security of data transmission between the sender and receiver will be reduced after a certain period of key exchange, this application sets a key expiration time in advance, starting from the time the system is operating, every When the key expires, re-execute the steps of using the first sender’s software to generate the key exchange IP package, and transparently transmit the key exchange IP package to the first receiver’s hardware through the first sender’s hardware, that is, the software is regenerated Key exchange protocol, thereby improving system security.

As an optional embodiment, data transmission is performed between the sender's software and the sender's hardware through a PCIE interface.

Specifically, in each sender of the system, the sender’s software and the sender’s hardware can transmit data through but not limited to PCIE (peripheral component interconnect express, high-speed serial computer expansion bus standard) interface, which is not described in this application. Special restrictions.

Please refer to FIG. 2, which is a schematic structural diagram of a network security IPsec acceleration processing system provided by an embodiment of the present invention.

The network security IPsec accelerated processing system includes:

The key exchange module 1 is used to generate a key exchange IP packet by using the software of the first sender, and transparently transmit the key exchange IP packet to the hardware of the first receiver through the hardware of the first sender; wherein, the key exchange IP packet Including the key data and the first IP addresses of both parties in the key exchange;

The data transmission module 2 is used to use the second sender software to perform IP packet processing on the transmission data to obtain the data IP packet, and send the data IP packet to the second sender hardware; wherein, the data IP packet includes the transmission data and both parties of the data transmission The second IP address;

The judgment module 3 is used to judge whether there is a second IP address in the first IP address; if it is, execute the data encryption and decryption module 4; if not, execute the transparent transmission module 5;

The data encryption and decryption module 4 is used to encrypt the data IP packet with the corresponding target key data on any one of the multiple pipelines of the second sender's hardware, and send the encrypted data IP packet to the second The receiver's hardware uses the target key data to decrypt the data IP packet on any idle pipeline among the multiple pipelines of the second receiver's hardware;

The transparent transmission module 5 is used to transparently transmit the data IP packet directly to the second receiver's hardware through the second sender's hardware.

As an optional embodiment, the network security IPsec acceleration processing system further includes:

The key exchange trigger module is used to re-execute the key exchange module every key expiration time from the time the system is operating.

For the introduction of the accelerated processing system provided by the present invention, please refer to the foregoing embodiment of the accelerated processing method, and the present invention will not be repeated here.

It should also be noted that in this specification, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply these entities or operations. There is any such actual relationship or sequence between operations. Moreover, the terms "include", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device that includes a series of elements includes not only those elements, but also includes Other elements of the process, method, article, or equipment are inherent elements. If there are no more restrictions, the element defined by the sentence "including a..." does not exclude the existence of other same elements in the process, method, article, or equipment including the element.

The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be obvious to those skilled in the art, and the general principles defined in this document can be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown in this document, but should conform to the widest scope consistent with the principles and novel features disclosed in this document.

Claims

An accelerated processing method for network security IPsec, which is characterized in that it comprises:

Use the first sender software to generate a key exchange IP packet, and transparently transmit the key exchange IP packet to the first receiver's hardware through the first sender's hardware; wherein, the key exchange IP packet includes key data And the first IP address of both parties in the key exchange;

Use the second sender software to perform IP packet processing on the transmission data to obtain a data IP packet, and send the data IP packet to the second sender hardware; wherein, the data IP packet includes the second data transmission and the second data transmission parties. IP address;

Determine whether the second IP address exists in the first IP address;

If yes, then use the corresponding target key data to encrypt the data IP packet on any idle pipeline among the multiple pipelines of the second sender hardware, and send the encrypted data IP packet to the second receiver Third party hardware, to use the target key data to decrypt the data IP packet on any one of the idle pipelines among the multiple pipelines of the second receiver hardware;

If not, the data IP packet is directly transparently transmitted to the second receiver hardware through the second sender hardware.
The network security IPsec acceleration processing method of claim 1, wherein after the data IP packet is directly transparently transmitted to the second receiver hardware through the second sender hardware, the network The accelerated processing method of secure IPsec also includes:

Detecting the format of the data IP packet received by the second receiver hardware;

When the format of the data IP packet is a network security service protocol format, the data IP packet is discarded.
8. The accelerated processing method of network security IPsec according to claim 1, wherein the accelerated processing method of network security IPsec further comprises:

Reserve a first storage space for the sender hardware in the system for storing the state of each pipeline of the sender hardware;

When the system is operating, storing each pipeline state of the sender's hardware in the first storage space in real time;

Correspondingly, the process of using the corresponding target key data to encrypt the data IP packet on any one of the idle pipelines of the multiple pipelines of the second sender hardware includes:

Determine the idle pipeline of the second sender hardware according to the pipeline states of the second sender hardware currently stored in the first storage space;

On any idle pipeline of the second sender hardware, encrypt the data IP packet with the corresponding target key data.
The network security IPsec acceleration processing method of claim 3, wherein the first storage space reserved for the sender hardware in the system for storing the pipeline states of the sender hardware; When the system is operating, the process of storing each pipeline state of the sender's hardware in the first storage space in real time includes:

Pre-set status flag bits for each pipeline of the sender hardware in the system one by one, and store them in the first storage space reserved for the sender hardware;

When the system is operating, when any pipeline of the sender's hardware is in the working state, the status flag corresponding to this pipeline is set to 1. When any pipeline of the sender's hardware is in an idle state, the pipeline The corresponding status flag position is 0.
8. The accelerated processing method of network security IPsec according to claim 1, wherein the accelerated processing method of network security IPsec further comprises:

Reserve a second storage space for the receiver's hardware in the system for storing each pipeline state of the receiver's hardware;

When the system is operating, storing each pipeline state of the receiver's hardware in the second storage space in real time;

Correspondingly, the process of using the target key data to decrypt the data IP packet on any one of the idle pipelines among the multiple pipelines of the second receiver hardware includes:

Determine the idle pipeline of the second receiver's hardware according to each pipeline state of the second receiver's hardware currently stored in the second storage space;

Use the target key data to decrypt the data IP packet on any idle pipeline of the second receiver hardware.
The method for accelerating network security IPsec processing according to claim 5, wherein the second storage space reserved for the receiver hardware in the system for storing the pipeline states of the receiver hardware; When the system is operating, the process of storing each pipeline state of the receiver's hardware in the second storage space in real time includes:

Pre-set status flag bits for each pipeline of the receiver hardware in the system one by one, and store them in the second storage space reserved for the receiver hardware;

When the system is operating, when any pipeline of the receiver's hardware is in the working state, the status flag corresponding to this pipeline is set to 1; when any pipeline of the receiver's hardware is in an idle state, the pipeline The corresponding status flag position is 0.
7. The method for accelerating network security IPsec processing according to any one of claims 1 to 6, wherein the method for accelerating network security IPsec processing further comprises:

Pre-set the key expiration time of the system;

Starting from the operation of the system, at intervals of the expiration time of the key, re-execute the use of the first sender software to generate a key exchange IP packet, and pass the key exchange IP packet to the first sender The step of transparently transmitting the hardware to the hardware of the first receiver.
8. The method for accelerating network security IPsec processing according to claim 7, wherein the software of the sender and the hardware of the sender perform data transmission through a PCIE interface.
A network security IPsec accelerated processing system, which is characterized in that it comprises:

The key exchange module is used to generate a key exchange IP packet by using the software of the first sender, and transparently transmit the key exchange IP packet to the hardware of the first receiver through the hardware of the first sender; wherein, the key The exchanged IP packet includes key data and the first IP addresses of both parties in the key exchange;

The data transmission module is configured to use the second sender software to perform IP packet processing on the transmission data to obtain a data IP packet, and send the data IP packet to the second sender hardware; wherein, the data IP packet includes transmission data and The second IP address of the data transmission parties;

The judging module is used to judge whether the second IP address exists in the first IP address; if so, execute the data encryption and decryption module; if not, execute the transparent transmission module;

The data encryption and decryption module is configured to use the corresponding target key data to encrypt the data IP packet on any idle pipeline among the multiple pipelines of the second sender hardware, and to encrypt the encrypted data IP The packet is sent to the second receiver's hardware to decrypt the data IP packet using the target key data on any idle pipeline among the multiple pipelines of the second receiver's hardware;

The transparent transmission module is configured to transparently transmit the data IP packet directly to the second receiver hardware through the second sender hardware.
9. The network security IPsec acceleration processing system of claim 9, wherein the network security IPsec acceleration processing system further comprises:

Time setting module, used to set the key expiration time of the system in advance;

The key exchange trigger module is configured to re-execute the key exchange module every time the key expires from the time the system is operating.