WO2021249028A1 - 数据加密或解密的方法、装置和系统 - Google Patents

数据加密或解密的方法、装置和系统 Download PDF

Info

Publication number
WO2021249028A1
WO2021249028A1 PCT/CN2021/088551 CN2021088551W WO2021249028A1 WO 2021249028 A1 WO2021249028 A1 WO 2021249028A1 CN 2021088551 W CN2021088551 W CN 2021088551W WO 2021249028 A1 WO2021249028 A1 WO 2021249028A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
encryption
processing
processed
decryption
Prior art date
Application number
PCT/CN2021/088551
Other languages
English (en)
French (fr)
Inventor
朱明明
杨仲凯
邓师平
郑卫炎
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CN202011426126.7A external-priority patent/CN113836543A/zh
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP21822921.9A priority Critical patent/EP4148606A4/en
Publication of WO2021249028A1 publication Critical patent/WO2021249028A1/zh
Priority to US18/062,944 priority patent/US20230102374A1/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/065—Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/12—Transmitting and receiving encryption devices synchronised or initially set up in a particular manner
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/12—Details relating to cryptographic hardware or logic circuitry
    • H04L2209/125—Parallelization or pipelining, e.g. for accelerating processing of cryptographic operations

Definitions

  • This application relates to the computer field, in particular to a method, device and system for data encryption or decryption.
  • data encryption is achieved through a designated software code library to encrypt data, for example, using open secure sockets (open secure sockets layer, OpenSSL) to achieve data encryption; accordingly, receiving encrypted data is received
  • OpenSSL open secure sockets layer
  • the end will perform decryption operations based on open secure sockets.
  • the data to be encrypted or decrypted includes data for executing instructions or transmitting messages.
  • the data can include multiple types.
  • the data is data in a streaming mode including multiple data blocks.
  • CPU can use a designated software program or process to sequentially complete the encryption or decryption of the data of each data block in the streaming mode, and store the encrypted or decrypted data to the designated address, so as to send the encrypted or decrypted data to the sender Get the result of data encryption or decryption.
  • a designated software program or process to sequentially complete the encryption or decryption of the data of each data block in the streaming mode, and store the encrypted or decrypted data to the designated address, so as to send the encrypted or decrypted data to the sender Get the result of data encryption or decryption.
  • This application provides a method, device, system, and computer-readable storage medium for data encryption and decryption, so as to reduce the time delay of data encryption or decryption operations and improve the efficiency of data processing.
  • a method for data encryption or decryption is provided.
  • the data processing request is first obtained; one of the first processing method and the second processing method is selected as the processing method of the data to be processed; the selected processing method is used for the data to be processed Perform encryption or decryption operations.
  • the data processing request carries the data to be processed, the first processing mode is processed by the encryption and decryption chip, and the second processing mode is processed by a software program running on the central processing unit.
  • the data encryption or decryption system supports two data encryption or decryption processing methods.
  • One processing method can be selected according to the data processing request to complete the encryption or decryption operation of the data to be processed, so as to ensure that different data processing requests are shared.
  • a more efficient way can be used for encryption or decryption processing to improve the efficiency of data processing.
  • the processing method of the data to be processed is selected according to the size of the data to be processed and the first parameter, where the first parameter includes the processing delay of encryption or decryption of a data block of unit length. From the description of the above method, it can be seen that the processing method can be selected according to the size of the data to be processed and the time delay of the encryption or decryption of the data block of unit length, and then a more efficient processing method is selected to encrypt or decrypt the data to be processed, reducing the time of data processing. Extension.
  • the first processing delay and the second processing delay are predicted according to the size of the data to be processed and the first parameter, where the first parameter includes the data block of unit length in the first processing mode.
  • the processing delay and the processing delay of a unit-length data block in the second processing mode are the processing delay of the data to be processed in the first processing mode
  • the second processing delay is the processing delay of the data to be processed in the first processing mode.
  • the processing delay of the data in the second processing mode; the processing method is selected according to the comparison result of the first processing delay and the second processing delay.
  • the processing delay of the two processing methods can be predicted, and then the processing delay difference of the two processing methods can be compared, and one of the processing methods that matches the data processing request can be selected to perform the encryption or decryption of the data to be processed Operation, thereby improving the data processing efficiency of the system.
  • the processing method of the data to be processed is selected according to the size of the data to be processed. From the description of the above method, it can be seen that the processing method can also be selected directly according to the size of the data to be processed to ensure that large data blocks can be processed by hardware encryption and decryption, so as to give full play to the computing power of the hardware encryption and decryption chip, and further improve the hardware encryption and decryption. Way of processing speed.
  • the first processing method when the size of the data to be processed is greater than the preset size threshold, the first processing method is selected; when the size of the data to be processed is less than or equal to the preset size threshold , Select the second processing method. From the description of the above method, it can be seen that the processing method can be selected directly according to the size of the data to be processed, so as to give full play to the processing capability of the encryption and decryption chip, and improve the overall processing efficiency of the system.
  • the data to be processed is fragmented; multiple processor cores in the encryption and decryption chip are used to perform encryption or decryption operations on different fragments, respectively. From the description of the above method, it can be seen that in the hardware encryption and decryption mode, the data to be processed can be further fragmented, and then multiple processor cores in the encryption and decryption chip are used to perform encryption or decryption operations on each fragment in parallel to maximize The computing power of the hardware encryption and decryption chip improves the processing efficiency of data encryption or decryption.
  • the method of fragmenting the data to be processed includes: fragmenting the data to be processed according to the hardware processing capability of the encryption and decryption chip. From the description of the above method, it can be seen that the fragmentation method can be divided according to the processing capacity of the encryption and decryption chip, so that multiple processor cores in the encryption and decryption chip can perform encryption or decryption operations on multiple fragments in parallel, improving data encryption or The processing speed of decryption reduces the time delay of data processing.
  • the method of slicing the data to be processed includes: according to the size of the data to be processed, the number of processor cores in the encryption and decryption chip, the number of data channels, and the unit length of each processor check
  • the processing delay of the data block determines the number of fragments; the data to be processed is divided according to the determined number of fragments to obtain two or more fragments.
  • the hardware processing capability of the encryption and decryption chip includes the number of processor cores, the number of data channels, and the processing delay of each processor to check the unit length of the data block, which can integrate the size and size of the data to be processed. The above factors determine the number of fragments, and then give full play to the hardware unloading capabilities of the encryption and decryption chip, and accelerate the data processing efficiency of the system.
  • the first set of processor cores is selected from among the multiple processor cores of the encryption and decryption chip, and the number of processor cores in the first set of processor cores is greater than or equal to splitting the data to be processed The number of fragments obtained; sending the two or more fragments to the processor cores of the first processor core set, so that each processor core in the first processor core set compares all the Different fragments of the two or more fragments perform encryption or decryption operations.
  • multiple processor cores can execute encryption or decryption operations of different slices in parallel, which further improves the ability of hardware offloading and improves the efficiency of data processing.
  • the encryption results of each segment of the data to be processed are sorted according to the order of the segments to obtain the encryption result of the data to be processed. Therefore, it is ensured that the encryption results of each piece of data of the data to be processed can be sorted according to the segmentation order, so as to ensure the accuracy of the encryption results of the data to be processed.
  • this application provides a data encryption or decryption method to obtain an encryption and decryption request, and when a preset condition is met, the first processing method is selected to perform an encryption or decryption operation on the data to be processed, wherein the data processing request carries For the data to be processed, the first processing method is to be processed by the encryption and decryption chip.
  • this application provides two data encryption or decryption processing methods. One processing method can be selected to perform encryption or decryption operations according to the pending request, thereby providing a hardware offloading capability and maximizing the use of encryption and decryption chips. The computing power to improve the efficiency of data processing.
  • the first processing mode is selected to perform an encryption or decryption operation on the data to be processed, where the first parameter includes the encryption or decryption of a unit-length data block Processing time delay.
  • the first processing delay and the second processing delay are predicted according to the size of the data to be processed and the first parameter, where the first parameter includes the data block of unit length in the first The processing delay in the processing mode and the processing delay of a unit-length data block in the second processing mode.
  • the first processing delay is the processing delay of the data to be processed in the first processing mode
  • the second processing delay is The processing delay of the data to be processed in the second processing mode; the processing method is selected according to the comparison result of the first processing delay and the second processing delay.
  • the processing delay of the two processing methods can be predicted, and then the processing delay difference of the two processing methods can be compared, and one of the processing methods can be selected as the processing method of the data to be processed, thereby improving the data processing efficiency of the system .
  • the processing method of the data to be processed is selected according to the size of the data to be processed.
  • the first processing mode is selected; when the size of the data to be processed is less than or equal to the preset size threshold.
  • the second processing mode is selected, and the second processing mode is processed by a software program running on the central processing unit.
  • the data to be processed is fragmented; multiple processor cores in the encryption and decryption chip are used to perform encryption or decryption operations on different fragments, respectively. From the description of the above method, it can be seen that in the hardware encryption and decryption mode, the data to be processed can be further fragmented, and then multiple processor cores in the encryption and decryption chip are used to perform encryption or decryption operations on each fragment in parallel to maximize The computing power of the hardware encryption and decryption chip improves the processing efficiency of data encryption or decryption.
  • the number of fragments is determined according to the size of the data to be processed and the processing capability of the hardware encryption and decryption engine; the data to be processed is divided according to the determined number of fragments to obtain two or more Fragmentation. From the description of the above method, it can be seen that the fragmentation method can be divided according to the processing capacity of the encryption and decryption chip, so that multiple processor cores in the encryption and decryption chip can perform encryption or decryption operations on multiple fragments in parallel, improving data encryption or The processing speed of decryption reduces the time delay of data processing.
  • the data to be processed can be fragmented in the following manner, including: according to the number of processor cores in the encryption and decryption chip, the number of data channels, and the processing of unit-length data by each processor Delay, fragment the data to be processed.
  • the hardware processing capability of the encryption and decryption chip includes the number of processor cores, the number of data channels, and the processing delay of each processor to check the unit length of the data block, which can integrate the size and size of the data to be processed. The above factors determine the number of fragments, and then give full play to the hardware unloading capabilities of the encryption and decryption chip, and accelerate the data processing efficiency of the system.
  • the first set of processor cores is selected from among the multiple processor cores of the encryption and decryption chip, and the number of processor cores in the first set of processor cores is greater than or equal to splitting the data to be processed The number of fragments obtained; sending the two or more fragments to the processor cores of the first processor core set, so that each processor core in the first processor core set compares all the Different fragments of the two or more fragments perform encryption or decryption operations.
  • multiple processor cores can execute encryption or decryption operations of different slices in parallel, which further improves the ability of hardware offloading.
  • the encryption results of each segment of the data to be processed are sorted according to the order of the segments to obtain the encryption result of the data to be processed. Therefore, it is ensured that the encryption results of each piece of data of the data to be processed can be sorted according to the segmentation order, so as to ensure the accuracy of the encryption results of the data to be processed.
  • this application provides a device for data encryption or decryption.
  • the device includes any one of the possible implementation manners of the first aspect or the first aspect, and any one of the second aspect or the second aspect. Implementation of the various modules of the method of data encryption or decryption.
  • this application provides a data encryption or decryption system, the system includes a central processing unit and a hardware encryption and decryption chip, the system is used to execute the first aspect or any one of the possible implementations of the first aspect, and The operation steps of the method for encrypting or decrypting data in the second aspect or any one of the possible implementation manners of the second aspect.
  • the present application provides a computer-readable storage medium having computer instructions stored in the computer-readable storage medium, which when run on a computer, cause the computer to execute the operation steps of the methods described in the above aspects.
  • this application provides a computer program product containing instructions, which when run on a computer, causes the computer to execute the methods described in the above aspects.
  • FIG. 1 is a schematic diagram of the logical structure of a data encryption or decryption system 10 provided by this application;
  • FIG. 2 is a schematic flowchart of a method 200 for encrypting or decrypting data provided by this application;
  • FIG. 3 is a schematic flowchart of another method for encrypting or decrypting data provided by this application.
  • Figure 4 is a schematic diagram of an optimal evaluation model for constructing a hardware encryption and decryption method provided by this application;
  • FIG. 5 is a schematic flowchart of another method for encrypting or decrypting data provided by this application.
  • FIG. 6 is a schematic structural diagram of an encryption and decryption device 500 provided by this application.
  • FIG. 7 is a schematic structural diagram of an encryption and decryption system 600 provided by this application.
  • Stream cipher also called data stream encryption, is a symmetric encryption and decryption (also called encryption or decryption) algorithm. Specifically, each execution subject that performs encryption or decryption uses the same key. For example, a pseudo-random encrypted data stream (pseudo-random stream) is used as a key, and the encrypted execution subject uses the key to treat encrypted data (also called plaintext data). ) Encryption to obtain the encrypted result of the data to be encrypted (also called ciphertext data). Correspondingly, after obtaining the ciphertext data, the decryption execution subject can use the same key to decrypt the ciphertext data.
  • block encryption also known as block encryption or block encryption
  • the execution body of the encryption and decryption can divide the plaintext data into multiple blocks of equal length, using The definite algorithm and symmetric key encrypt each group separately; the decryption execution subject can use the same key to decrypt the ciphertext data into plaintext data.
  • block encryption is an extremely important encryption method.
  • Typical block encryption algorithms include standard encryption algorithms approved by the U.S. government: data encryption standard (DES) and advanced encryption standard (AES), It has a wide range of applications, from email encryption to banking transactions.
  • DES data encryption standard
  • AES advanced encryption standard
  • my country's National Cryptographic Administration has also released a block encryption algorithm (also known as SM), which mainly includes SM1, SM2, SM3 and SM4, which are also widely used in various fields.
  • Kernel mode, kernel mode and user mode are the two operating levels of the operating system. There are mainly two permission states, one is the core mode (also called the management mode), which is also called the privileged mode; the other is the privileged mode. It is the user state (also called the target state).
  • the core state is the mode in which the kernel of the operating system runs. Code running in this mode can access system storage and external devices without restrictions.
  • User mode is an unprivileged state.
  • the kernel of the operating system can prohibit the code in this state from performing potentially dangerous operations, such as writing system configuration files, terminating other user processes, and restarting the system.
  • FIG. 1 is a logical architecture diagram of a data encryption or decryption system 10 provided by an embodiment of the application.
  • the system 10 includes a central processing unit (CPU) 100 and an encryption and decryption chip 200.
  • the processor 100 and the encryption and decryption chip 200 are connected through a network 300, where the network 300 may be a communication network inside the device, such as a bus.
  • the bus may be a Peripheral Component Interconnect Express (Peripheral Component Interconnect Express, PCIe).
  • PCIe Peripheral Component Interconnect Express
  • the system 10 may be a computing device (for example, a server), a storage device (for example, a storage array), a network device (for example, a switch), or a smart device.
  • Equipment for example, smart terminals, smart cars
  • the network 300 may also be a communication network between devices, for example, a communication structure composed of Ethernet (Ethernet), fiber channel (FC), InfiniBand, etc.
  • the central processing unit 100 and the encryption and decryption chip 200 are located in different locations.
  • the system 10 may be a system composed of two or more devices.
  • the central processing unit 100 in the system shown in FIG. 1 may also be other types of processors, for example, digital signal processing (DSP) and application-specific integrated circuit (ASIC). , Field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. Or, other types of processors such as graphics processing units (GPUs) and neural network processors (neural processing units, NPUs).
  • DSP digital signal processing
  • ASIC application-specific integrated circuit
  • FPGA Field-programmable gate array
  • GPUs graphics processing units
  • NPUs neural network processors
  • the central processing unit is used as an example to further explain the data encryption or decryption method provided in the embodiments of the present application.
  • the central processing unit 100 may also run an operating system.
  • the central processing unit 100 includes an application program 101, a user mode driver 102, and a kernel mode driver 103.
  • the application program 101 is a computer program (or called program code) running on the central processing unit 100, which can generate a data processing request, and the data processing request carries data to be processed.
  • the same data processing request can include one or more data blocks, Data processing includes encryption or decryption.
  • the application program 101 is an application program that runs a streaming media scene, it can also generate streaming data (also called a streaming mode).
  • streaming data also called a streaming mode.
  • the application program of the streaming media scene is a video encryption application.
  • the application program 101 will As the video recording or sending image changes, the data to be processed is continuously generated. At this time, the data to be processed is continuously generated in a similar "streaming" form.
  • a stream cipher can be used to perform an encryption or decryption operation on the above-mentioned data.
  • the user-mode driver 102 and the kernel-mode driver 103 are driver programs that the encryption and decryption chip 200 (also referred to as an accelerator) runs in the central processing unit 100, and are used to implement the communication between the encryption and decryption chip 200 and the central processing unit 100.
  • the user mode driver 102 and the kernel mode driver 103 are respectively used to implement special programs with different permissions at the operating system level, which are equivalent to the interface of the encryption and decryption chip 200, and the operating system can communicate with the encryption and decryption chip 200 through this interface.
  • the user mode driver 102 is used to select the processing method of the data to be processed, and perform software encryption and decryption processing or hardware encryption and decryption processing according to the selected processing method.
  • the hardware encryption and decryption processing method can also be referred to as the first processing Method
  • the software encryption and decryption processing method is called the second processing method.
  • the user driver 102 includes a decision module 1021, a software encryption/decryption module 1022, a state synchronization module 1023, and an encryption/decryption uninstallation module 1024.
  • the decision module 1021 is used to select the processing method of the data to be processed, and instruct the software encryption and decryption module 1022 or the encryption and decryption uninstallation module 1024 to perform the encryption or decryption operation of the data to be processed according to the selected processing method.
  • the software encryption and decryption The processing method is that the software encryption and decryption module 1022 performs encryption or decryption operations on the data to be processed, and the hardware encryption and decryption processing method is that the encryption and decryption offloading module 1024, the kernel driver 103 and the encryption and decryption chip 200 jointly complete the encryption or decryption of the data to be processed. operate.
  • the encryption result of the previous data to be processed will be used as a part of the next data to be processed. If the two data to be processed are encrypted or decrypted using different processing methods, it is necessary to use the state synchronization module 1023 to ensure that the data to be processed can be encrypted or decrypted one by one in the order of the data to be processed generated by the application program to ensure the data processing process Accuracy and relevance.
  • the software encryption and decryption module 1022 and the encryption and decryption unloading module 1024 may also obtain the processing status of the streaming data from the state synchronization module 1023 before performing the encryption or decryption operation of the current to-be-processed data, so as to determine whether the current to-be-processed data and the The relationship between the data that has been encrypted or decrypted in the streaming data, and after the encryption or decryption operation of the current data to be processed is completed, the state synchronization module 1023 is notified that the data encryption or decryption processing has been completed, thereby avoiding affecting the streaming data processing process Accuracy.
  • the state synchronization module 1023 can also be deployed in one with the decision-making module 1021.
  • the decision-making module 1021 is used to ensure the accuracy and relevance of the data processing process in addition to implementing the selection processing method.
  • the kernel mode driver 103 includes an initialization and data transparent transmission module 1031, which is used to implement the initialization processing of the encryption and decryption chip 200, including in the system startup phase, the central processing unit 100 recognizes the location of the encryption and decryption chip 200 (for example, in the PCIe bus Number) and hardware configuration (for example, the number of processors included in the encryption and decryption chip, the number of processor cores included in each processor), and the process of applying hardware encryption and decryption resources for the hardware chip 200, so that the encryption and decryption resources can be used later
  • the chip 200 completes the encryption or decryption operation of the data to be processed.
  • the hardware encryption and decryption resources include a queue (for example, the queue 105 in FIG.
  • the application program 101 can store the to-be-processed data in a data buffer of the to-be-processed data, so that the decision-making module 1021 can obtain the to-be-processed data, and then select a processing method to perform an encryption or decryption operation on the to-be-processed data.
  • the queue 105 is a logical storage unit for storing the data to be processed or the fragments of the data to be processed, and the data to be processed or the result of encryption or decryption of each fragment.
  • the storage space (for example, memory) accessible to the central processing unit 100 may be divided into a storage area of a preset size.
  • the queue 105 can be divided into a queue for storing fragmented data and a queue for storing the encryption result of the fragmented data.
  • the data buffer of the data to be processed can be set in a memory accessible by the central processing unit, and the size of the data buffer can be set according to business requirements, which is not limited in this application.
  • the number of queues and the queue depth of each queue do not constitute a limitation to this application. In the specific implementation process, it can be divided according to the hardware processing capability of the encryption and decryption chip.
  • the initialization and data transparent transmission module 1031 is also used to realize data transparent transmission in hardware encryption or decryption processing. Specifically, when the hardware encryption and decryption method is used to perform encryption or decryption operations on the data to be processed, the initialization and data transparent transmission module 1031 can move the to-be-processed data or the fragments of the to-be-processed data in the queue 105 to the queue 106, and then the encryption and decryption The chip 200 performs encryption or decryption operations; then stores the encryption or decryption results of the data to be processed in the queue 106; then the initialization and data transparent transmission module 1031 moves the encryption or decryption results of the data to be processed to the queue 105; When the data is fragmented, the encryption, decryption, and unloading module 1024 also needs to complete the sorting of the fragments in the order of fragmentation; finally, the decision module 1021 sends the processed result to the application 101.
  • the user mode driver 102 and the kernel mode driver 103 can share data through the technology of data transparent transmission.
  • memory-mapped input/output (memory-mapped input/output, MMIO) mode also known as address mapping mode
  • MMIO memory-mapped input/output
  • a storage space of a specified size is divided in a memory (for example, memory) accessible by the central processing unit, and the storage space is established and the encryption and decryption chip 200 is available for the central processing unit
  • the mapping relationship of the storage space accessed by 100 realizes the address mapping between the storage space of the memory and the memory (not shown in FIG. 1) of the encryption and decryption chip 200, so as to realize the communication between the central processing unit 100 and the encryption and decryption chip 200 Shared access to data.
  • DMA direct memory access
  • Encryption and decryption chip 200 (also known as hardware encryption and decryption engine or encryption and decryption unloading card or encryption and decryption accelerator) is a dedicated data encryption or decryption chip used to encrypt and decrypt software executed by the central processing unit 100 Perform function uninstallation, that is, when the data to be processed is large, the encryption and decryption chip 200 replaces the central processing unit 100 to perform the encryption or decryption operation of the data to be processed, thereby implementing the function uninstallation of the data encryption or decryption operation.
  • the encryption and decryption chip 200 can be provided with a processor and memory for data encryption or decryption processing.
  • the encryption and decryption process needs to be realized by means of the processor and the external memory of the processor.
  • the processor inside the chip 200 can directly access the memory, the access path is short, and the data processing speed is faster; moreover, multiple processors can be set in the encryption and decryption chip 200, and different processor cores in each processor can execute the data to be processed separately
  • the decryption or decryption operation is more efficient.
  • each module in the central processing unit 100 in the system shown in FIG. 1 is a kind of software module, which may be implemented by computer program code, or may be implemented by dedicated hardware to implement the functions of each module.
  • Figure 2 is a method for data encryption or decryption provided by this application. As shown in the figure, the method includes:
  • the data processing request may be a data processing request generated by the application program 101 running on the central processing unit 100 shown in FIG.
  • the decision module 1021 in the processor 100 executes; it can also be a data processing request generated by an application program running on another processor.
  • the operation of obtaining the data processing request can be executed by the system 10, specifically by the central processing unit in the system. 100 execution.
  • the execution of a data acquisition processing request by the decision module 1021 of the central processing unit 100 is taken as an example for description.
  • the data to be processed may be a data block or multiple data blocks.
  • the data to be processed is an example of a data block, and the data block is referred to as the first data block. data block.
  • the application 101 in FIG. 1 may actively send a data processing request carrying data to be processed to the decision module 1021; or, the decision module 1021 may periodically query the application 101 whether there is a data processing request to be processed.
  • the data to be processed uses a stream cipher to encrypt the data to be processed.
  • the data processing request may also carry an operation type indicating the data to be processed, where the operation type includes encryption and decryption.
  • the decision-making module can complete the processing of the data to be processed according to the operation type of the data processing request.
  • the specific encryption algorithm can be a symmetric encryption and decryption algorithm, such as AES and SM4.
  • any symmetric encryption algorithm can be used to implement the encryption processing of the data to be processed.
  • the data processing request also carries the input address and output address of the encrypted data, and the length of the data to be processed.
  • the input address is used to indicate the storage location of the data to be processed.
  • it is the address of the storage space for storing the data to be processed in the memory connected to the central processing unit.
  • the input address can also be other storage accessible to the central processing unit.
  • the address of the space; the output address is used to indicate the storage location of the encryption result of the data to be processed.
  • the storage location may also be the address of the storage space for storing the encryption result of the data to be processed in the memory connected to the central processing unit; Alternatively, the storage location may also be an accessible storage location designated by the application, so that the application can obtain the encryption result of the data to be processed through the storage location.
  • the first processing method is processed by the encryption and decryption chip
  • the second processing method is processed by software programs or instructions running on the central processing unit.
  • the first processing method can also be called the hardware encryption and decryption method
  • the second processing method can also be called the hardware encryption and decryption method.
  • Encryption and decryption methods for software refers to the process of using a software program running in a processor (for example, a central processing unit (CPU)) to perform encryption or decryption of the first data block.
  • the hardware encryption and decryption method uses a dedicated encryption and decryption chip (for example, the encryption and decryption chip 200 in FIG. 1) to perform the encryption or decryption processing of the first data block.
  • the process of selecting the processing method of the data to be processed can be performed in any of the following ways:
  • Method 1 Select the processing method of the data to be processed according to the size of the data to be processed and the first parameter.
  • the first parameter includes the encryption or decryption processing time delay of a unit length data block.
  • a data block of unit length refers to a data block of a fixed size, such as a data block of 512M in size.
  • the first parameter can be the time delay for the encryption and decryption chip to perform encryption or decryption operations on a fixed-size data block.
  • the delay can be obtained through the manual of the encryption and decryption chip; and for software encryption and decryption Mode, the first parameter may be the time delay for performing encryption or decryption on data blocks of the same fixed size using software encryption and decryption, and is usually a statistical value of historical data.
  • the first processing delay and the second processing delay can be predicted according to the size of the data to be processed and the first parameter.
  • the first parameter can include the processing delay and unit length of a unit-length data block in the first processing mode.
  • the first processing delay is the processing delay of the data to be processed in the first processing mode
  • the second processing delay is the processing delay of the data to be processed in the second processing mode.
  • the processing method is selected according to the comparison result of the first processing delay and the second processing delay, for example, when the first processing delay is greater than the first preset delay threshold, the hardware encryption and decryption method is selected Perform encryption or decryption operations on the data to be processed; when the second processing delay is less than or equal to the second preset delay threshold, select the software encryption and decryption mode to perform encryption or decryption operations on the data to be processed, where the first preset delay threshold It can be less than or equal to the second preset delay threshold.
  • the specific values of the first preset delay threshold and the second preset delay threshold can be set according to empirical values, or can be set differently according to software encryption and decryption methods and hardware encryption and decryption methods.
  • the processing efficiency setting for the size of the data block is selected according to the comparison result of the first processing delay and the second processing delay, for example, when the first processing delay is greater than the first preset delay threshold, the hardware encryption and decryption method is selected Perform encryption or decryption operations on the data
  • Method 2 select the processing method of the data to be processed according to the size of the data to be processed.
  • the first processing mode is selected; when the size of the data to be processed is less than or equal to the preset size threshold, the second processing mode is selected.
  • the processing efficiency can be determined by combining the size of the data to be processed and the processing delay of the two processing methods, and then select a processing method that matches the data to be processed to perform encryption or decryption operations. It is also possible to construct different models in advance to evaluate the processing efficiency of the software encryption and decryption methods and the hardware encryption and decryption methods for the data to be processed of different sizes, and then determine the selection of different processing methods for the data to be processed of different sizes. For example, when the data to be processed is large, the data to be processed can be divided into multiple fragments, and different processors in the hardware encryption and decryption chip are used to encrypt or decrypt each fragment, thereby giving full play to the hardware encryption and decryption.
  • the processing capability of the chip improves the efficiency of the entire encryption or decryption process and reduces the processing delay.
  • the data to be processed is small, if the hardware encryption and decryption method is also adopted, although the data encryption delay per unit length is relatively low, in the hardware encryption and decryption method, data transmission and other technologies need to be used to realize the data relocation, including the The process of moving each piece of processed data to the memory on the side of the encryption and decryption chip, and the process of moving the result of the encryption processing to the memory side, the entire relocation process requires the hardware resources of the encryption and decryption chip and the network resources of the system.
  • the hardware The processing efficiency of the encryption or decryption of the data to be processed by the chip may be lower than the processing efficiency of the encryption or decryption of the data to be processed in the software method. Therefore, for the data to be processed of different sizes, different processing methods can be selected separately, so as to select a matching processing method for each data to be processed, so as to give full play to the processing capabilities of the hardware encryption and decryption chip and minimize the time required for data processing. Extension.
  • S203 Perform an encryption operation on the data to be processed using the selected processing mode.
  • the decision module 101 may instruct the software encryption and decryption module 1022 or the encryption and decryption uninstallation module 1024 to perform encryption or decryption processing on the first data block according to the processing mode of the data to be processed selected in step S202.
  • the method shown in Figure 2 mainly takes the data processing request as an encryption operation as an example.
  • the decryption operation is similar to the above method.
  • the decision module first obtains the data processing request, and the data processing request carries the data processing request.
  • To process data select one of the first processing method and the second processing method as the processing method of the data to be processed, and use the selected processing method to perform a decryption operation on the data to be processed.
  • I will not repeat them here.
  • the data to be processed in the data processing request is the first data block
  • the data processing is encryption
  • the above method 2 is used as an example to select the processing method.
  • the encryption or decryption method of the provided data includes:
  • the decision module obtains a data processing request, where the data processor request carries the data to be processed.
  • the decision-making module selects one of the first processing method and the second processing method as a processing method of the to-be-processed data.
  • the decision module selects the software encryption and decryption mode, and informs the software encryption and decryption module to perform encryption processing on the first data block.
  • the first threshold may also be referred to as a preset size threshold, and the first threshold may be determined in any of the following ways:
  • Method 1 can be determined according to empirical values.
  • Method 2 can also be obtained based on historical data statistics.
  • the optimal evaluation model of the hardware encryption and decryption method can also be constructed in advance to determine it, so as to maximize the processing capacity of the hardware encryption and decryption chip.
  • the processing delay of the data to be processed is F(n);
  • the hardware offload cost is t1, and t1 mainly includes the computing resources and network resources required for the process of sending the data to be processed by the encryption and decryption offloading module to the hardware encryption and decryption chip;
  • the size of the data to be processed is L;
  • the delay cost of processing a unit-length data block in the hardware encryption and decryption mode is k1, which can be obtained according to statistical data or can be obtained according to the configuration manual of the hardware encryption and decryption chip; software encryption and decryption mode
  • the delay cost of processing a unit-length data block is k2, and k2 can be obtained from statistical data;
  • the number of slices is n, n refers to the number of data to be processed divided into multiple slices, for example, n can be greater than Or a positive integer equal to 2, so that multiple processor cores of the hardware encryption and decryption chip perform encryption or decryption operations on the sliced data in parallel.
  • Scenario 1 the processing method is hardware encryption and decryption, and the application has waiting.
  • the size of the data to be processed is usually large.
  • different processor cores in the encryption and decryption chip are used to process each slice of the data to be processed in parallel, the delay required by the hardware encryption and decryption method is limited by The number of processor cores in the encryption and decryption chip and the number of data migration channels.
  • the hardware encryption and decryption chip cannot quickly complete the encryption or decryption operation of the data to be processed, and the application inevitably needs to wait.
  • the number of channels for data relocation refers to the number of channels that can relocate the data to be processed from the memory to the memory of the encryption and decryption chip.
  • the data to be processed is divided into 3 pieces, and the hardware offload cost t1 includes dividing each piece, and moving each piece between the storage of the memory and the encryption and decryption chip.
  • the sum of the cost of slices; the cost of encryption and decryption chip data processing is k1*the number of slices.
  • the following formula 1 can be used to express F(n) and its constraints:
  • the processing method is hardware encryption and decryption, and the application has waiting.
  • the size of the data to be processed is usually small.
  • the data to be processed is divided into multiple slices, and the processor cores in multiple encryption and decryption chips are used to parallelize different Encryption or decryption of sliced data can minimize the delay of data processing.
  • the critical case for the optimal number of slices in this scenario is that the application has no waiting. Similar to scenario 1, the following formula 1 can be used to express F(n) and its constraints:
  • the processing method is software encryption and decryption.
  • the data to be processed is usually very small, usually tens or hundreds of bytes in size, as shown in Figure 4(c).
  • the hardware encryption and decryption chip cannot perform the encryption or decryption operation of the central processing unit.
  • the benefits brought by software encryption and decryption can be used to encrypt the data to be processed.
  • the following formula 3 can be used to express F(n) and its constraints:
  • the optimal evaluation model for hardware encryption and decryption methods can be constructed as follows:
  • the software encryption and decryption method is used to perform the encryption or decryption operation on the data to be processed:
  • the hardware encryption and decryption method is used to perform the encryption or decryption operation on the data to be processed:
  • the first threshold can be When the size of the data to be processed meets formula 5, the software encryption and decryption method is used to perform encryption or decryption operations on the data to be processed; when the size of the data to be processed meets the formula 6, the hardware encryption and decryption method is used to perform encryption or decryption operations on the data to be processed .
  • the decision module selects the software encryption and decryption mode, and informs the software encryption and decryption module to encrypt or decrypt the first data block.
  • the decision-making module manages the encryption result of the first data block and sends the encryption result of the data to be processed to the application program. That is to say, in this application, the decision module selects the processing method according to the preset rules, instructs the software encryption and decryption module or the encryption and decryption uninstallation module to perform encryption or decryption operations on the data to be processed respectively, and summarizes the software encryption and decryption module or the encryption and decryption uninstallation module to return The encryption result of each data block, and finally, the encryption result of the data to be processed is returned to the application.
  • the decision-making module can use the data buffer applied during the initialization process to store the encryption result of the first data block.
  • the data block a1 is encrypted by software encryption and decryption, and the encryption and decryption are stored in the initialization phase applied for.
  • the encrypted result of the data to be processed will be stored to the output address specified by the application according to the output address of the data to be processed in the data processing request.
  • the decision module sends the encryption status of the first data block to the status synchronization module.
  • adjacent data to be processed may use different processing methods to perform encryption or decryption operations, and there may be an association relationship between adjacent data to be processed, it is impossible to know the currently processed data for the software encryption and decryption module and the encryption and decryption uninstallation module.
  • steps S303 to S305 can also be referred to as the software encryption and decryption process, that is, when the size of the first data block is less than or equal to the first threshold, the software encryption and decryption mode is selected to execute the processing of the first data block.
  • the hardware encryption and decryption method is selected to execute the processing of the first data block.
  • S306 When the first data block is greater than the first threshold, select a hardware encryption and decryption mode, and notify the encryption and decryption unloading module to perform an encryption operation on the first data block.
  • step S303 if the size of the data to be processed satisfies formula 6, then the hardware encryption and decryption method is used to perform an encryption or decryption operation on the first data block.
  • the encryption, decryption and unloading module fragments the first data block, and stores each fragment in the first queue respectively.
  • the data to be processed can be further divided to obtain multiple slices, and multiple processor cores in the encryption and decryption chip are used to perform parallel processing on each slice. In turn, the processing efficiency of hardware encryption and decryption methods is improved.
  • the number of fragments can be determined according to the size of the first data block and the processing capability of the hardware encryption and decryption chip; then the first data block can be divided according to the determined number of fragments to obtain two or more fragments .
  • the processing capability of the hardware encryption and decryption chip includes the number of processor cores in the encryption and decryption chip, the number of data channels, and the processing delay for each processor to check a unit-length data block.
  • formula 7 can also be determined according to the above-mentioned optimal evaluation model of the hardware encryption and decryption mode, and the first data block can be divided according to formula 7:
  • the queue 105 as shown in FIG. 5 applied in the initialization phase can be used to store each fragmented data and the encrypted result of the fragmented data.
  • the queue 105 can also be referred to as the first A queue.
  • the encryption and decryption unloading module instructs the encryption and decryption chip to perform encryption and decryption processing on the fragments in the encryption and decryption engine queue respectively.
  • the encryption and decryption chip After the encryption and decryption chip obtains the instruction of the encryption and decryption unloading module, it can select the first processor core set from among the multiple processor cores of the encryption and decryption chip, and the number of processor cores in the first processor core set is greater than or equal to cut. The number of fragments obtained by dividing the data to be processed.
  • the encryption and decryption chip may select the first set of processor cores among the processor cores in the idle state. Further, the encryption and decryption chip can also determine the matching relationship between the processor cores in the first processor core set and each fragment, that is, the relationship between the fragment and the processor core that executes each fragment, and then send it to the first processor core set.
  • the processor cores of the processor core set send two or more fragments obtained by the above-mentioned segmentation, so that each processor core in the first processor core set performs encryption or decryption operations on different fragments respectively.
  • the matching relationship between the processor core and each fragment in the first processor core set can be determined according to the computing power and fragment size of each processor core in the encryption and decryption chip.
  • each fragment of the data to be processed may be It is not the same, and the matching processor core can be selected according to the computing power of the processor core in the idle state to improve the processing speed of each shard.
  • the encryption and decryption offloading module may also record the number of processor cores in the encryption and decryption chip and the working status of each processor core.
  • the encryption/decryption unloading module can also select the first processor core set according to its record, and determine the matching relationship between the processor cores in the first processor core set and each fragment , And then notify the encryption and decryption chip that the processor cores in the first set of processor cores respectively execute the encryption or decryption operations of different fragments according to the above-mentioned matching relationship.
  • the fragmentation process of the to-be-processed data in step S307 can also be that the encryption and decryption offloading module 1023 directly sends the to-be-processed data to the encryption and decryption chip 200, and the encryption and decryption chip divides the to-be-processed data according to the above formula 7 , And select the first processor core set, and then determine the association relationship between the processor cores and the shards in the first processor core set.
  • the encryption and decryption chip performs encryption processing on each fragment.
  • the encryption and decryption chip returns the encryption result of each segment to the encryption and decryption unloading module.
  • the encryption and decryption chip includes multiple processor cores, and different processor cores can execute encryption processing of different fragments in parallel, thereby improving the encryption efficiency of the first data block and reducing the encryption processing delay of the first data block.
  • each processor core encrypts each segment according to a specific algorithm.
  • the encryption or decryption of each segment can be completed according to the requirements of the specific algorithm. deal with.
  • FIG. 5 is a schematic flow diagram of another data encryption and decryption processing provided by this application.
  • the queue 105 includes a queue for storing fragments and a queue for storing encryption results.
  • the encryption and decryption chip 200 includes a queue 106 (also called a second queue), and the structure of the queue 106 may be the same or similar to the queue 105.
  • the queue 106 and the queue 105 may have the same number and the same queue depth; or, The number of queues 106 is greater than or equal to the number of queues 105, and the queue depth of queue 106 is greater than or equal to the queue depth of queue 105.
  • the initialization and data transparent transmission module 1031 can relocate data in the implementation queue 105 and the queue 106.
  • the encryption and decryption chip 200 may also implement data transfer between the queue 106 and the queue 105 through a direct memory access (DMA) controller.
  • DMA direct memory access
  • the encryption and decryption chip 200 can use the direct memory access mode to relocate the slice data in the queue 105 to the memory of the encryption and decryption chip 200, and use the processor core 201-the processor core 20s of the encryption and decryption chip 200 to separate each of the slices.
  • the slice performs an encryption operation.
  • the initialization and data transparent transmission module 1031 shown in FIG. Queue 105 so that the application can obtain the encryption result of the data to be processed.
  • the encryption, decryption and unloading module sorts the encryption results of the fragmented data in the first data block to obtain the encryption result of the first data block.
  • the encryption/decryption unloading module may also record the fragmentation order of the first data block, and store the fragment encryption results respectively according to the fragmentation order of each fragment.
  • the decision module 1021 selects the hardware encryption and decryption method to encrypt the data block a2, and instructs the encryption and decryption unloading module 1024 to perform an encryption operation on the data block a2.
  • the encryption and decryption offloading module 1024 can perform fragmentation processing on a2, such as dividing a2 into a21-a2n, a total of n fragments, each fragment has a unique serial number, and each fragment is stored in the queue 105 respectively.
  • the encryption and decryption chip 200 or the kernel mode driver 103 can store the encryption result of each sliced data in a designated location according to the sequence number of the slice order through direct memory access or data transparent transmission.
  • n storage spaces are pre-divided according to the slicing order, and each storage space is used to store the encryption result associated with the sequence number of a slice of data.
  • the encryption result of the a22 slice is stored in the queue 105 and is associated with the sequence number 22.
  • the add-2 storage location of a22 is received, it can be directly stored in the storage space corresponding to the add-2 storage address.
  • the encryption results of each segment can be sequentially obtained according to the n pre-divided storage spaces, and the aforementioned encryption results can be merged, and the merged result can be stored as the encryption result of a2 to the output address designated by the application.
  • the merging of the encryption results includes reading the encryption results in turn, and storing each read result one by one to the output address designated by the application program.
  • the merging of the encryption results can also be the data buffer of the to-be-processed data applied for in the initialization phase to splice the encryption results, that is, to compose the complete encryption result of a2 according to the order of the fragments. Finally, store the complete encryption result to the output address specified by the application.
  • the encryption, decryption and unloading module notifies the decision-making module to complete the encryption operation of the first data block.
  • the encryption, decryption and unloading module sends a notification to the decision-making module to inform the decision-making module that the encryption operation of the first data block has been completed.
  • the encryption/decryption/unloading module may send a storage address for storing the encryption result of the first data block to the decision module.
  • the encryption/decryption/unloading module may also directly send the encryption result of the first data block to the decision-making module.
  • the decision-making module sends the encryption state of the first data block to the state synchronization module.
  • steps S312-S313 is similar to the operation process of steps S304-S305.
  • the encryption state of the first data block can also be synchronized by the decision module to the state synchronization module. , In order to ensure the consistency of the data blocks in the data to be processed.
  • the decision module sends the encryption result of the data to be processed to the application program.
  • the decision-making module can directly send the encryption result of the data to be processed to the application program; it can also send the address where the encryption result is stored to the application program; it can also store the encryption result in advance to the pre-appointed output address, and send the encryption result to the decision-making module Notification so that the application can obtain the encrypted result of the data to be processed from the output address as scheduled.
  • each data block can follow the software encryption and decryption process described in steps S303 to S305 or steps S306 to S306.
  • the hardware encryption and decryption process described in S313 completes the encryption or decryption processing.
  • the decision module 1021 can determine whether each data block to be processed in the data processing request has completed the encryption process by periodically detecting the queue 105. When it is determined that all the data blocks of the data to be processed have completed the encryption or decryption process, the data is processed
  • the encryption results of all data blocks included in the request are stored in the output address specified by the application program to complete the encryption processing operation of the data to be processed in the encryption and decryption request.
  • the data processing request includes two to-be-processed data a1 and a2.
  • the decision module 1021 stores the encryption results of a1 and a2 to the output location designated by the application program, and the application program obtains the encryption result of the data processing request.
  • the decision-making module 1021 can also release software and hardware resources, for example, software resources such as processor processes, and hardware such as data buffers and processor cores of encryption and decryption chips requested in the initialization phase. Resources, so that the system shown in Figure 1 can also handle data processing requests from the same application or other applications.
  • the above-mentioned Figures 3 to 5 illustrate the method of data encryption or decryption of this application with encryption as an example. This method is also applicable to the decryption process. Similar to the above method, the decryption process can also be used Similar methods perform encryption or decryption operations on the data to be processed.
  • this application provides two data encryption or decryption processing methods.
  • the processing method can be selected according to the size of the data to be processed, and the software encryption and decryption module or the encryption and decryption uninstallation module can be instructed to execute the data to be processed according to the selected processing method.
  • Encryption or decryption operation For larger data to be processed, the hardware unloading capability of the encryption and decryption chip can be fully utilized to reduce the processing delay of the data processing process and improve efficiency; for smaller data to be processed, software encryption and decryption can be used to perform encryption or decryption operations.
  • the processing method for the size of different data blocks it is possible to select the processing method for the size of different data blocks, to give full play to the processing capacity of the encryption and decryption chip, to improve the data processing efficiency, and to reduce the data processing delay.
  • the data to be processed can also be fragmented, and multiple processor cores in the encryption and decryption chip can be used to perform encryption or decryption operations on each fragmented data in parallel, so as to give full play to the decryption of the encryption and decryption chip.
  • the processing efficiency in the process reduces the processing delay of the decryption operation, thereby improving the data processing performance of the entire system.
  • FIG. 6 is a schematic structural diagram of a data encryption or decryption device 600 provided by this application. As shown in the figure, the device 600 includes an acquisition unit 601, a decision unit 602, and a processing unit 603. Among them,
  • the obtaining unit 601 is configured to obtain a data processing request, and the data processing request carries the data to be processed;
  • the decision unit 602 is configured to select one of the first processing method and the second processing method as the processing method of the to-be-processed data.
  • the first processing method is processed by the encryption and decryption chip, and the second processing method is processed by the running Software program processing on the central processing unit;
  • the processing unit 603 uses the selected processing mode to perform an encryption or decryption operation on the data to be processed.
  • the apparatus 600 of the embodiment of the present application may be implemented by an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), and the above PLD may be a complex program logic device. (complex programmable logical device, CPLD), field-programmable gate array (field-programmable gate array, FPGA), general array logic (generic array logic, GAL) or any combination thereof.
  • ASIC application-specific integrated circuit
  • PLD programmable logic device
  • CPLD complex programmable logical device
  • FPGA field-programmable gate array
  • GAL general array logic
  • the device 600 and its various modules can also be software modules.
  • the decision unit 602 is further configured to select a processing mode of the data to be processed according to the size of the data to be processed and a first parameter, wherein the first parameter includes encryption or encryption of a data block of unit length. Decryption processing time delay.
  • the decision unit 602 is further configured to predict the first processing delay and the second processing delay according to the size of the to-be-processed data and the first parameter, where the first parameter includes a unit length
  • the processing delay of a data block in the first processing mode and the processing delay of a unit-length data block in the second processing mode is that the data to be processed is in the first processing mode.
  • the processing delay in the first processing mode, the second processing delay is the processing delay of the data to be processed in the second processing mode; according to the first processing delay and the second processing time Select the processing method for the delayed comparison result.
  • the decision unit 602 is further configured to select a processing mode of the data to be processed according to the size of the data to be processed.
  • the decision unit 602 is further configured to select the first processing method when the size of the data to be processed is greater than the preset size threshold; when the size of the data to be processed is less than or equal to When the preset size threshold is used, the second processing mode is selected.
  • the processing unit 603 is further configured to fragment the data to be processed; and use multiple hardware encryption and decryption engines in the encryption and decryption chip to perform the encryption or decryption operation on different fragments, respectively.
  • the processing unit 603 is further configured to check the data block of unit length according to the size of the data to be processed, the number of processor cores in the encryption and decryption chip, the number of data channels, and each processor The processing delay determines the number of fragments; the first data block is divided according to the determined number of fragments to obtain two or more fragments.
  • the processing unit 603 is further configured to select a first set of processor cores among multiple processor cores of the hardware encryption and decryption engine, and the number of processor cores in the first set of processor cores Greater than or equal to the number of fragments obtained by slicing the data to be processed; sending the two or more fragments to the processor cores of the first set of processor cores, so that the first Each processor core in the set of processor cores respectively performs encryption or decryption operations on different fragments of the two or more fragments.
  • the processing unit 603 is further configured to respectively sort the encryption results of the respective fragments of the data to be processed according to the order of the fragments, to obtain the encryption results of the data to be processed.
  • the device 600 may correspond to the execution of the method described in the embodiment of the present application, and the above and other operations and/or functions of each unit in the device 600 are used to implement the respective methods in FIGS. 2 to 5 For the sake of brevity, the corresponding process will not be repeated here.
  • the data to be processed can be further divided into multiple fragments, and multiple processor cores respectively perform encryption or decryption operations on different fragments to achieve parallelism between the fragments.
  • the processing process further improves the efficiency of data processing.
  • FIG. 7 is a schematic structural diagram of a data encryption or decryption system 700 provided by this application.
  • the system 700 includes a processor 701, a memory unit 702, a memory 703, a communication interface 704, an encryption and decryption chip 705, and a bus. 706, where the processor 701, the memory unit 702, the memory 703, the communication interface 704, and the encryption and decryption chip 705 communicate through the bus 706, and the communication may also be implemented through other means such as wireless transmission.
  • the memory unit 702 is used to store program codes, and the processor 701 is used to execute the program codes stored in the memory unit 702.
  • the processor 701 may call the program code stored in the memory unit 702 to perform the following operations:
  • the data processing request carries data to be processed, and the data processing includes encryption or decryption;
  • the first processing method is processed by an encryption and decryption chip, and the second processing method is processed by a central processing unit Software program processing;
  • the memory 703 may also be used to store program codes. According to the processing method of the processor 701 in the computer for reading and writing the memory unit and the memory, the processor 701 may first load the program code in the memory 703 to the memory unit 702, and then load it from the memory unit 702. The unit 702 calls specific instructions in the program code to implement the operation process of the above method.
  • the processor 701 may be a CPU, and the processor 701 may also be a digital signal processing (DSP), an application-specific integrated circuit (ASIC), Field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. It may also be other types of processors, such as GPUs, NPUs, and other processors with computing capabilities.
  • DSP digital signal processing
  • ASIC application-specific integrated circuit
  • FPGA Field-programmable gate array
  • GPUs GPUs, NPUs, and other processors with computing capabilities.
  • the memory unit 702 includes the kernel mode driver 7021 of the system shown in FIG. 1, the user mode driver 7022, the program code 7023, and the first queue 7024 described in step S307.
  • the memory 703 may include a read-only memory and a random access memory, and provides instructions and data to the processor 701.
  • the memory 703 may also include a non-volatile random access memory.
  • the memory 703 may also store device type information.
  • the memory 703 may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory can be read-only memory (ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), and electrically available Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • the volatile memory may be random access memory (RAM), which is used as an external cache.
  • RAM random access memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • SDRAM synchronous dynamic random access memory
  • Double data rate synchronous dynamic random access memory double data date SDRAM, DDR SDRAM
  • enhanced SDRAM enhanced synchronous dynamic random access memory
  • SLDRAM synchronous connection dynamic random access memory
  • direct ram bus RAM direct ram bus RAM
  • the communication interface 704 is used to implement communication between the system 700 and other devices or systems outside the system.
  • the communication interface 704 may be a network card.
  • the encryption and decryption chip 705 includes a processor 7051, a memory 7052, a communication interface 7053, and a bus 7054.
  • the processor 7051, the memory 7052, and the communication interface 7053 are connected by the bus 7054.
  • processor cores such as processor core 1 and processor core 2.
  • the communication interface 7053 is used to implement communication between the encryption and decryption chip 705 and other components and/or devices.
  • the memory 7052 includes program code 70521 and a second queue 70522, so that the encryption and decryption chip 705 implements the operation steps of the method executed by the corresponding subject in the methods shown in FIGS. 2 to 5 above.
  • processors and each processor core in the processor 7051 does not constitute a limitation to this application.
  • the number of processors in the encryption and decryption chip can be configured according to specific business requirements, and each The number of processor cores in a processor.
  • bus 706 may also include a power bus, a control bus, a status signal bus, and the like. However, for clear description, various buses are marked as bus 703 in the figure.
  • system 700 may correspond to the device 600 in the embodiment of the present application, and may correspond to the corresponding subject in the method 100 that executes the method 100 according to the embodiment of the present application, and the above-mentioned various modules in the system 700
  • the other operations and/or functions are used to implement the corresponding processes of the methods in FIG. 2 to FIG. 5. For the sake of brevity, details are not repeated here.
  • the system 700 can also provide two data encryption or decryption processing methods, and select one method as the processing method of the data to be processed according to the specific situation, and then use different processing methods to perform encryption for different data to be processed. Or decryption operation to improve the efficiency of data processing.
  • the data to be processed in the hardware encryption and decryption processing mode, can also be divided into multiple fragments, and multiple processor cores in the encryption and decryption chip are used to perform encryption or decryption operations on different fragments respectively to achieve Parallel processing of multiple shards, thereby improving the efficiency of data processing, can further increase the processing speed of the system and reduce the processing delay.
  • this application also provides a system for data encryption or decryption.
  • the difference from the system 700 is that the processor 701 and the encryption and decryption chip 705 are connected via an external network other than the bus.
  • the external network includes an Ethernet network.
  • the fifth generation (5G) mobile communication technology wireless network.
  • the system includes at least two devices, the processor 701 and the encryption and decryption chip 705 are located in different devices, and the processor 701 and the encryption and decryption chip 705 communicate through an external network.
  • the system can also be used to implement the methods shown in Figs. 2 to 5 above. To solve the problem, it will not be repeated here.
  • the foregoing embodiments may be implemented in whole or in part by software, hardware, firmware or any other combination.
  • the above-mentioned embodiments may be implemented in the form of a computer program product in whole or in part.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions may be transmitted from a website, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that includes one or more sets of available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium.
  • the semiconductor medium may be a solid state drive (SSD).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • General Physics & Mathematics (AREA)
  • Bioethics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Databases & Information Systems (AREA)
  • Computing Systems (AREA)
  • Storage Device Security (AREA)

Abstract

一种数据的加密或解密的方法，该方法包括：获取携带待处理数据的数据处理请求；从第一处理方式和第二处理方式中选择一种作为待处理数据的处理方式，其中，第一处理方式由加解密芯片处理，第二处理方式由运行在中央处理器上的软件程序处理；利用选择的处理方式对待处理数据执行加密或解密的操作，由此解决传统技术中CPU的处理能力无法满足数据加密或解密处理时延的要求，影响数据处理效率的问题。

Description

数据加密或解密的方法、装置和系统 技术领域
本申请涉及计算机领域，尤其涉及一种数据加密或解密的方法、装置和系统。
背景技术
随着大数据时代的发展，基础设施中的数据安全性得到越来越多的关注，而数据加密是数据安全的重中之重。通常地，数据加密是通过指定的软件代码库实现对数据的加密，例如，利用开放式安全套接字(open secure sockets layer,OpenSSL)实现对数据的加密处理；相应地，接收加密数据的接收端会基于开放式安全套接字执行解密操作。在具体实施中，待加密或解密的数据包括执行指令或传送消息的数据，该数据可以包括多种类型，例如，该数据为包括多个数据块的流模式的数据，中央处理单元(central processing unit,CPU)可以利用指定软件程序或进程依次完成流模式中各个数据块的数据的加密或解密，并将加密或解密处理后的数据存储至指定地址，以便发送加密或解密的数据的发送端获取数据的加密或解密的结果。但是，当待加密或解密的数据较多时，CPU的处理能力无法满足数据加密或解密处理时延的要求，影响数据处理的效率。因此，如何提供一种高效的数据处理方法成为亟待解决的技术问题。
发明内容
本申请提供了一种数据加解密的方法、装置、系统和计算机可读存储介质，以此降低数据加密或解密操作的时延，提升数据处理的效率。
第一方面，提供一种数据加密或解密的方法，先获取数据处理请求；从第一处理方式和第二处理方式中选择一种作为待处理数据的处理方式；利用选择的处理方式对待处理数据执行加密或解密的操作。其中，数据处理请求中携带待处理数据，第一处理方式由加解密芯片处理，第二处理方式由运行在中央处理器上的软件程序处理。通过上述方法，数据加密或解密的系统支持两种数据加密或解密的处理方式，可以根据数据处理请求选择一种处理方式完成待处理数据的加密或解密操作，以此保障不同的数据处理请求均可以使用一种更高效的方式进行加密或解密处理，提升数据处理的效率。
在一种可能的实现方式中，根据待处理数据的大小和第一参数，选择待处理数据的处理方式，其中，第一参数包括单位长度的数据块的加密或解密处理时延。通过上述方法的描述可知，可以根据待处理数据的大小和单位长度的数据块的加密或解密处理时延选择处理方式，进而选择更高效的处理方式对待处理数据加密或解密，降低数据处理的时延。
在另一种可能的实现方式中，根据待处理数据的大小和第一参数预测得到第一处理时延和第二处理时延，其中，第一参数包括单位长度的数据块在第一处理方式下的处理时延和单位长度的数据块在第二处理方式下的处理时延，第一处理时延为待处理 数据在第一处理方式下的处理时延，第二处理时延为待处理数据在第二处理方式下的处理时延；根据第一处理时延和第二处理时延的比较结果选择处理方式。通过上述方法的描述可知，可以预测两种处理方式的处理时延，进而比较两种处理方式的处理时延差异，选择其中一种与数据处理请求匹配的处理方式执行待处理数据的加密或解密操作，由此提升系统的数据处理效率。
在另一种可能的实现方式中，根据待处理数据的大小选择待处理数据的处理方式。通过上述方法的描述可知，也可以直接根据待处理数据的大小选择处理方式，保证大块数据块可以采用硬件加解密方式处理，以此充分发挥硬件加解密芯片的算力，进一步提升硬件加解密方式的处理速度。
在另一种可能的实现方式中，当待处理数据的大小大于所述预设的大小阈值时，选择所述第一处理方式；当所述待处理数据的大小小于或等于预设的大小阈值时，选择所述第二处理方式。通过上述方法的描述可知，可以直接根据待处理数据的大小选择处理方式，进而充分发挥加解密芯片的处理能力，提升系统的整体处理效率。
在另一种可能的实现方式中，对待处理数据进行分片；利用加解密芯片中的多个处理器核分别对不同分片执行加密或解密操作。通过上述方法的描述可知，在硬件加解密方式中，还可以进一步对待处理数据进行分片，进而使用加解密芯片中多个处理器核并行对各个分片执行加密或解密操作，以此最大化硬件加解密芯片的算力，提升数据的加密或解密的处理效率。
在另一种可能的实现方式中，对待处理数据进行分片方式包括：根据所述加解密芯片的硬件处理能力对待处理数据进行分片。通过上述方法的描述可知，分片的方式可以根据加解密芯片的处理能力切分，以使得加解密芯片中多个处理器核可以并行对多个分片执行加密或解密操作，提升数据加密或解密的处理速度，降低数据处理的时延。
在另一种可能的实现方式中，对待处理数据进行分片方式包括：根据待处理数据的大小、加解密芯片中处理器核的个数、数据通道数、以及每个处理器核对单位长度的数据块的处理时延确定分片的数量；根据确定的分片的数量切分待处理数据，获得两个或两个以上分片。通过上述方法的描述可知，加解密芯片的硬件处理能力包括处理器核的个数、数据通道数、以及每个处理器核对单位长度的数据块的处理时延，可以综合待处理数据的大小和上述因素确定分片的数量，进而充分发挥加解密芯片的硬件卸载能力，加速系统的数据处理效率。
在另一种可能的实现方式中，在加解密芯片的多个处理器核中选择第一处理器核集合，第一处理器核集合中处理器核的个数大于或等于切分待处理数据所获得的分片的个数；向第一处理器核集合的处理器核发送所述两个或两个以上分片，以使得所述第一处理器核集合中各个处理器核分别对所述两个或两个以上分片中不同分片执行加密或解密操作。由此实现多个处理器核并行执行不同分片的加密或解密操作，进一步提升硬件卸载的能力，提升数据处理的效率。
在另一种可能的实现方式中，根据分片顺序分别对待处理数据的各个分片的加密结果进行排序，获得待处理数据的加密结果。由此保证待处理数据的各个分片数据的加密结果可以按照切分顺序进行排序，以此保证待处理数据的加密结果的准确性。
第二方面，本申请提供一种数据加密或解密的方法，获取加解密请求，当满足预设条件时，选择第一处理方式对待处理数据执行加密或解密的操作，其中，数据处理请求中携带待处理数据，第一处理方式是由加解密芯片处理。通过上述内容可知，本申请提供两种数据加密或解密的处理方式，可以根据待处理请求选择一种处理方式执行加密或解密操作，以此提供一种硬件卸载能力，并最大化发挥加解密芯片的算力，提升数据处理的效率。
在一种可能的实现方式中，根据待处理数据的大小和第一参数，选择第一处理方式对待处理数据执行加密或解密的操作，其中，第一参数包括单位长度的数据块的加密或解密处理时延。通过上述方法的描述可知，可以根据待处理数据的大小和单位长度的数据块的加密或解密处理时延选择待处理数据的处理方式，进而选择更高效的处理方式对待处理数据加密或解密，降低数据处理的时延。
在另一种可能的实现方式中，根据待处理数据的大小和第一参数预测得到第一处理时延和第二处理时延，其中，第一参数包括单位长度的数据块在所述第一处理方式下的处理时延和单位长度的数据块在第二处理方式下的处理时延，第一处理时延为待处理数据在第一处理方式下的处理时延，第二处理时延为待处理数据在第二处理方式下的处理时延；根据第一处理时延和第二处理时延的比较结果选择处理方式。通过上述方法的描述可知，可以预测两种处理方式的处理时延，进而比较两种处理方式的处理时延差异，选择其中一种作为待处理数据的处理方式，由此提升系统的数据处理效率。
在另一种可能的实现方式中，根据待处理数据的大小选择待处理数据的处理方式。
在另一种可能的实现方式中，当所述待处理数据的大小大于所述预设的大小阈值时，选择所述第一处理方式；当所述待处理数据的大小小于或等于预设的大小阈值时，选择所述第二处理方式，第二处理方式由运行在中央处理器上的软件程序处理。通过上述方法的描述可知，也可以直接根据待处理数据的大小选择处理方式，进而充分发挥加解密芯片的处理能力，提升系统的整体处理效率。
在另一种可能的实现方式中，对待处理数据进行分片；利用加解密芯片中的多个处理器核分别对不同分片执行加密或解密操作。通过上述方法的描述可知，在硬件加解密方式中，还可以进一步对待处理数据进行分片，进而使用加解密芯片中多个处理器核并行对各个分片执行加密或解密操作，以此最大化硬件加解密芯片的算力，提升数据的加密或解密的处理效率。
在另一种可能的实现方式中，根据待处理数据的大小和硬件加解密引擎的处理能力确定分片的数量；根据确定的分片的数量切分待处理数据，获得两个或两个以上分片。通过上述方法的描述可知，分片的方式可以根据加解密芯片的处理能力切分，以使得加解密芯片中多个处理器核可以并行对多个分片执行加密或解密操作，提升数据加密或解密的处理速度，降低数据处理的时延。
在另一种可能的实现方式中，可以采用以下方式对待处理数据进行分片包括：根据加解密芯片中处理器核的个数、数据通道数、以及每个处理器核对单位长度的数据的处理时延，对待处理数据进行分片。通过上述方法的描述可知，加解密芯片的硬件处理能力包括处理器核的个数、数据通道数、以及每个处理器核对单位长度的数据块 的处理时延，可以综合待处理数据的大小和上述因素确定分片的数量，进而充分发挥加解密芯片的硬件卸载能力，加速系统的数据处理效率。
在另一种可能的实现方式中，在加解密芯片的多个处理器核中选择第一处理器核集合，第一处理器核集合中处理器核的个数大于或等于切分待处理数据所获得的分片的个数；向第一处理器核集合的处理器核发送所述两个或两个以上分片，以使得所述第一处理器核集合中各个处理器核分别对所述两个或两个以上分片中不同分片执行加密或解密操作。由此实现多个处理器核并行执行不同分片的加密或解密操作，进一步提升硬件卸载的能力。
在另一种可能的实现方式中，根据分片顺序分别对待处理数据的各个分片的加密结果进行排序，获得待处理数据的加密结果。由此保证待处理数据的各个分片数据的加密结果可以按照切分顺序进行排序，以此保证待处理数据的加密结果的准确性。
第三方面，本申请提供一种数据加密或解密的装置，所述装置包括用于执行第一方面或第一方面任一种可能实现方式，以及第二方面或第二方面任一种可能的实现方式中的数据的加密或解密的方法的各个模块。
第四方面，本申请提供一种数据加密或解密的系统，该系统包括中央处理器和硬件加解密芯片，所述系统用于执行上述第一方面或第一方面任一种可能实现方式，以及第二方面或第二方面任一种可能的实现方式中的数据的加密或解密的方法的操作步骤。
第五方面，本申请提供一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机指令，当其在计算机上运行时，使得计算机执行上述各方面所述的方法的操作步骤。
第六方面，本申请提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述各方面所述的方法。
本申请在上述各方面提供的实现方式的基础上，还可以进行进一步组合以提供更多实现方式。
附图说明
图1为本申请提供的一种数据加密或解密的系统10的逻辑结构的示意图；
图2为本申请提供的一种数据的加密或解密的方法200的流程示意图；
图3为本申请提供的另一种数据的加密或解密的方法的流程示意图；
图4为本申请提供的一种构建硬件加解密方式最优评估模型的示意图；
图5为本申请提供的另一种数据的加密或解密的方法的流程示意图；
图6为本申请提供的一种加解密装置500的结构示意图；
图7为本申请提供的一种加解密系统600的结构示意图。
具体实施方式
为了便于理解，首先对本申请所涉及的术语进行解释。
流密码(stream cipher)，也称为数据流加密，是一种对称加解密(也可以称为加密或解密)算法。具体地，执行加密或解密的各个执行主体使用相同密钥，例如，将伪随机加 密数据流(pseudo-random stream)作为密钥，加密的执行主体使用密钥对待加密数据(也称为明文数据)加密，得到待加密数据加密后的结果(也可以称为密文数据)。相应地，解密的执行主体在获取到密文数据后，可以使用相同的密钥对密文数据进行解密。示例地，以对称加解密算法为分组加密(block cipher)(又称为分块加密或块加密)为例，加解的执行主体可以将明文数据分成多个等长的模块(block)，使用确定的算法和对称密钥对每组分别加密；解密的执行主体则可以使用相同的密钥将密文数据解密为明文数据。其中，分组加密是一种极其重要的加密方法，典型的分组加密的算法包括美国政府核定的标准加密算法：数据加密标准(data encryption standard，DES)和高级加密标准(advanced encryption standard，AES)，应用非常广泛，从电子邮件加密到银行交易等场景。我国的国家密码管理局也发布了一种分组加密算法(也称为SM)，主要包括SM1、SM2、SM3和SM4，也被广泛应用在各个领域。
内核态(kernel mode)，内核态与用户态是操作系统的两种运行级别，主要有两种权限状态，一种是核心态(也称为管态)，也被称为特权态；一种是用户态(也称为目态)。核心态是操作系统的内核所运行的模式，运行在该模式的代码，可以无限制地对系统存储、外部设备进行访问。
用户态(user mode)，是一种非特权状态，操作系统的内核可以禁止此状态下的代码进行潜在危险的操作，比如写入系统配置文件、终止其他用户的进程、重启系统等。
下面结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚描述。
图1为本申请实施例提供的一种数据加密或解密的系统10的逻辑架构图，如图所示，该系统10包括中央处理器(central processing unit，CPU)100和加解密芯片200，中央处理器100和加解密芯片200通过网络300连接，其中，网络300可以是一种设备内部的通信网络，例如，总线，具体地，该总线可以为快捷外围部件互连标准(Peripheral Component Interconnect Express，PCIe)，此时，中央处理器100和加解密芯片200位于同一设备内，系统10可以是计算设备(例如，服务器)、存储设备(例如，存储阵列)、网络设备(例如，交换机)或智能设备(例如，智能终端、智能车)等设备。网络300也可以是设备间的通信网络，例如，以太网(Ethernet)、光纤通道(fiber channel，FC)、InfiniBand等构成的通信结构，此时，中央处理器100和加解密芯片200分别位于不同设备，系统10可以是由两个或两个以上设备构成的系统。
值得说明的是，图1所示系统中中央处理器100还可以是其他类型的处理器，例如，数字信号处理器(digital signal processing，DSP)、专用集成电路(application-specific integrated circuit，ASIC)、现场可编程门阵列(field-programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。或者，图形处理器(graphics processing unit，GPU)，神经网络处理器(neural processing unit，NPU)等其他类型的处理器。为了便于描述，以中央处理器为例进一步解释本申请实施例提供的数据加密或解密的方法。
可选地，中央处理器100中还可以运行操作系统。
中央处理器100中包括应用程序101、用户态驱动102、内核态驱动103。
应用程序101为运行在中央处理器100中计算机程序(或称为程序代码)，可以生成数据处理请求，该数据处理请求中携带待处理数据，同一数据处理请求可以包括一个或多 个数据块，数据处理包括加密或解密。此外，如果应用程序101为运行流媒体场景的应用程序，还可以生成流式(也可以称为流模式)的数据，例如，流媒体场景的应用是视频加密应用，此时，应用程序101会随着视频记录或发送图像的变化不断产生待处理数据，此时，待处理数据是以类似“流”形式不断生成。可选地，可以采用流密码对上述数据执行加密或解密操作。
用户态驱动102和内核态驱动103是加解密芯片200(也可以称为加速器)在中央处理器100中运行的驱动程序，用于实现加解密芯片200和中央处理器100的通信。用户态驱动102和内核态驱动103分别用于在操作系统层面实现不同权限的特殊程序，相当于加解密芯片200的接口，操作系统可以通过这个接口与加解密芯片200进行通信。
用户态驱动102，用于选择待处理数据的处理方式，并依据所选择的处理方式执行软件加解密处理或硬件加解密处理，为了便于描述，也可以将硬件加解密处理方式称为第一处理方式，将软件加解密处理方式称为第二处理方式。具体地，用户驱动102包括决策模块1021、软件加解密模块1022、状态同步模块1023和加解密卸载模块1024。其中，决策模块1021，用于选择待处理数据的处理方式，并依据所选择的处理方式指示软件加解密模块1022或加解密卸载模块1024执行待处理数据的加密或解密操作，其中，软件加解密处理方式是由软件加解密模块1022对待处理数据执行加密或解密操作，硬件加解密处理方式则是由加解密卸载模块1024，内核态驱动103和加解密芯片200共同完成对待处理数据的加密或解密操作。
进一步地，由于流式数据中相邻的待处理数据之间可能存在关联关系，例如，前一个待处理数据的加密结果会作为后一个待处理数据的一部分，此时，如果分别对相邻的两个待处理数据采用不同的处理方式加密或解密，则需要利用状态同步模块1023保证待处理数据能够按照应用程序生成的待处理数据的顺序逐一执行加密或解密的操作，以此保证数据处理过程的准确性和关联性。可选地，软件加解密模块1022和加解密卸载模块1024也可以在执行当前待处理数据的加密或解密操作之前，向状态同步模块1023获取流式数据的处理状态，以确定当前待处理数据与流式数据中已完成加密或解密的数据的关系，并在完成当前待处理数据的加密或解密操作之后，通知状态同步模块1023已完成数据的加密或解密处理，进而避免影响流式数据处理过程的准确性。
可选地，状态同步模块1023也可以和决策模块1021合一部署，此时，决策模块1021除了实现选择处理方式外，还用于保证数据处理过程的准确性和关联性。
内核态驱动103包括初始化和数据透传模块1031，用于实现加解密芯片200的初始化处理，包括在系统启动阶段，由中央处理器100识别加解密芯片200的位置(例如，在PCIe总线中总线号)和硬件配置(例如，加解密芯片中包括的处理器个数，每个处理器包括的处理器核数)、以及为硬件芯片200申请硬件加解密资源的过程，以便后续可以利用加解密芯片200完成待处理数据的加密或解密操作。其中，硬件加解密资源包括用于实现存储加密或解密的队列(例如，图5中队列105)和待处理数据的数据缓冲区。应用程序101可以将待处理数据存储在待处理数据的数据缓冲区，以便决策模块1021获取待处理数据，进而选择处理方式对待处理数据执行加密或解密的操作。其中，队列105，是用于存储待处理数据或待处理数据的分片，以及待处理数据或每个分片加密或解密的结果的逻辑存储单元。具体实施中，可以在初始化过程中，在中央处理器100可以访问的存储空间(例如， 内存)中划分预设大小的存储区域，该存储区域用于在选择硬件加解密方式时，存储待处理数据或待处理数据的分片数据，以及待处理数据或待处理数据的分片数据的加密或解密的结果。进一步地，从队列105存储数据的类型区分，又可以将队列105分为用于存储分片数据的队列和用于存储分片数据的加密结果的队列。待处理数据的数据缓冲区可以设置在中央处理器可访问的存储器中，数据缓冲区的大小可以根据业务需求设置，本申请对此不做限定。
值得说明的是，队列的个数和每个队列的队列深度不构成对本申请的限定，具体实施过程中，可以根据加解密芯片的硬件处理能力划分。
此外，初始化和数据透传模块1031，还用于实现硬件加密或解密处理中数据透传。具体地，当采用硬件加解密方式对待处理数据执行加密或解密操作时，初始化和数据透传模块1031可以将队列105中待处理数据或待处理数据的分片搬迁至队列106，进而由加解密芯片200执行加密或解密操作；然后将待处理数据的加密或解密结果存储至队列106；再由初始化和数据透传模块1031将上述待处理数据的加密或解密结果搬迁至队列105；当对待处理数据执行分片处理时，还需要由加解密卸载模块1024按照切分顺序完成各个分片的排序；最终，由决策模块1021将处理后的结果发送给应用程序101。
值得说明的是，用户态驱动102和内核态驱动103之间可以通过数据透传的技术实现数据的共享，具体实施中，可以在系统初始化阶段利用内存映射输入输出(memory-mapped input/output,MMIO)方式(也可以称为地址映射方式)，在中央处理器可访问的存储器(例如，内存)中划分指定大小的存储空间，并建立该存储空间和加解密芯片200中可供中央处理器100访问的存储空间的映射关系，实现内存的存储空间与加解密芯片200的存储器(图1中未示出)之间的地址映射，以此实现中央处理器100和加解密芯片200之间的数据的共享访问。或者，在上述使用内存映射输入输出技术基础上，再利用直接内存访问(direct memory access，DMA)方式实现数据透传，使得加解密芯片200可以快速获取待处理数据的分片数据，以便利用加解密芯片200中处理器核(例如，处理器核201-处理器核20s)实现分片数据的加密和解密操作。
加解密芯片200(也可以称为硬件加解密引擎或加解密卸载卡或加解密加速器)，是一种专用的数据加密或解密的芯片，用于对由中央处理器100执行的软件加解密方式进行功能卸载，也就是在待处理数据较大时，由加解密芯片200替代中央处理器100执行待处理数据的加密或解密操作，由此实现数据加密或解密操作的功能卸载。具体地，加解密芯片200内部可以设置用于数据加密或解密处理的处理器和存储器，相比于软件加解密方式需要借助于处理器和处理器的外部存储器实现加密和解密的过程，加解密芯片200内部的处理器可以直接访问存储器，访问路径短，数据处理速度更快；而且，加解密芯片200中可以设置多个处理器，每个处理器中不同处理器核可以分别执行待处理数据的解密或解密操作，效率更高。
值得说明的是，图1所示系统中中央处理器100中各个模块为一种软件模块，可以由计算机程序代码实现，也可以由专用硬件分别实现各个模块的功能。
接下来，结合图1所示的系统架构，以数据处理请求为对待处理数据的加密处理过程为例进一步解释本申请提供的数据加密或解密的方法，该方法可以由图1所示的系统执行。
图2为本申请提供的一种数据加密或解密的方法，如图所示，该方法包括：
S201、获取数据处理请求，数据处理请求中携带待处理数据。
其中，数据处理请求可以是运行在图1所示的中央处理器100上的应用程序101生成的数据处理请求，此时，获取数据处理请求的操作可以由中央处理器100执行，具体可以由中央处理器100中决策模块1021执行；也可以是运行在其他处理器上的应用程序生成的数据处理请求，此时，获取数据处理请求的操作可以由系统10执行，具体可以由系统中中央处理器100执行。为了便于描述，本申请的以下实施例中，以中央处理器100中决策模块1021执行获取数据处理请求为例进行描述。待处理数据可以是一块数据块，也可以是多块数据块，为便于描述，本申请的以下描述中，以待处理数据为一块数据块为例进行说明，并将该数据块简称为第一数据块。
图1中应用程序101可以主动将携带待处理数据的数据处理请求发送至决策模块1021；也可以是，决策模块1021周期性向应用程序101查询是否有待处理的数据处理请求。其中，待处理数据采用流密码对待处理数据进行加密操作。
数据处理请求还可以携带指示待处理数据的操作类型，其中，操作类型包括加密和解密两种。决策模块可以根据数据处理请求的操作类型完成待处理数据的处理。具体加密的算法可以为对称加解密算法，例如，AES和SM4。
值得说明的是，对称加密算法的具体实现过程不构成对本申请的限定，具体实施中，可以采用任意一种对称加密算法实现对待处理数据的加密处理。
可选地，数据处理请求中还携带有加密数据的输入地址和输出地址，以及待处理数据的长度。其中，输入地址，用于指示待处理数据的存储位置，一般为与中央处理器连接的内存中用于存储待处理数据的存储空间的地址，该输入地址也可以是中央处理可访问的其他存储空间的地址；输出地址，则用于指示待处理数据的加密结果的存储位置，该存储位置也可以为与中央处理器连接的内存中用于存储待处理数据的加密结果的存储空间的地址；或者，该存储位置还可以是应用程序指定的可访问的存储位置，以便应用程序可以通过该存储位置获得待处理数据的加密结果。
S202、从第一处理方式和第二处理方式中选择一种作为待处理数据的处理方式。
其中，第一处理方式由加解密芯片处理，第二处理方式由运行在中央处理器上的软件程序或指令处理，第一处理方式也可以称为硬件加解密方式，第二处理方式也可以称为软件加解密方式。软件加解密方式是指利用运行在处理器(例如，中央处理器(central processing unit,CPU))中的软件程序执行第一数据块的加密或解密的处理。而硬件加解密方式则是利用专用的加解密芯片(例如，图1中加解密芯片200)执行第一数据块的加密或解密的处理。
待处理数据的处理方式的选择过程可以按照如下方式中任意一种执行：
方式1，根据待处理数据的大小和第一参数选择待处理数据的处理方式。
其中，第一参数包括单位长度的数据块的加密或解密处理时延。单位长度的数据块是指固定大小的数据块，如512M大小的数据块。对于硬件加解密方式，第一参数可以是加解密芯片对固定大小的数据块的执行加密或解密操作的时延，通常地，该时延可以通过加解密芯片的手册获得；而对于软件加解密方式，第一参数则可以是采用软件加解密方式对相同固定大小的数据块执行加密或解密的时延，通常为历史数据的统计值。
进一步地，可以根据待处理数据的大小和第一参数预测第一处理时延和第二处理时延， 第一参数可以包括单位长度的数据块在第一处理方式下的处理时延和单位长度的数据块在第二处理方式下的处理时延，第一处理时延为待处理数据在第一处理方式下的处理时延，第二处理时延为待处理数据在第二处理方式下的处理时延；进一步地，根据第一处理时延和第二处理时延的比较结果选择处理方式，示例地，当第一处理时延大于第一预设时延阈值时，选择硬件加解密方式对待处理数据执行加密或解密操作；当第二处理时延小于或等于第二预设时延阈值时，选择软件加解密方式对待处理数据执行加密或解密操作，其中，第一预设时延阈值可以小于或等于第二预设时延阈值，第一预设时延阈值和第二预设时延阈值的具体值可以根据经验值设置，也可以根据软件加解密方式和硬件加解密方式对不同大小的数据块的处理效率设置。
方式2，根据待处理数据的大小选择待处理数据的处理方式。
具体地，当待处理数据的大小大于预设的大小阈值时，选择第一处理方式；当待处理数据的大小小于或等于预设的大小阈值时，选择第二处理方式。
可以结合待处理数据的大小和两种处理方式的处理时延确定处理效率，进而选择一种与待处理数据匹配的处理方式执行加密或解密操作。也可以根据预先构建不同模型，评估软件加解密方式和硬件加解密方式对于不同大小的待处理数据的处理效率，进而确定针对不同大小的待处理数据选择不同处理方式。例如，当待处理数据较大时，可以将待处理数据切分为多个分片，分别利用硬件加解密芯片中不同处理器核对各个分片进行加密或解密处理，由此充分发挥硬件加解密芯片的处理能力，提升整个加密或解密处理过程的效率，降低处理时延。而当待处理数据较小时，如果同样采用硬件加解密方式，虽然单位长度的数据加密时延较低，但是，硬件加解密方式中，需利用数据透传等技术实现数据的搬迁，包括将待处理数据的各个分片搬迁至加解密芯片侧的存储器，以及将加密处理后的结果搬迁至内存侧的过程，整个搬迁过程需占用加解密芯片的硬件资源以及系统的网络资源，此时，硬件芯片对待处理数据的加密或解密的处理效率可能低于软件方式中对待处理数据的加密处理效率。因此，针对不同大小的待处理数据，可以分别选择不同处理方式，以此为每个待处理数据选择匹配的处理方式，以此充分发挥硬件加解密芯片的处理能力，最大化降低数据处理的时延。
S203、利用选择的处理方式对待处理数据执行加密操作。
决策模块101可以根据步骤S202中选择的待处理数据的处理方式，指示软件加解密模块1022或加解密卸载模块1024对第一数据块执行加密或解密的处理。
值得说明的是，图2所示的方法主要是以数据处理请求为加密操作为例进行说明，对于解密的操作与上述方法类似，也是由决策模块先获得数据处理请求，数据处理请求中携带待处理数据，从第一处理方式和第二处理方式中选择一种作为待处理数据的处理方式，并利用选择的处理方式对待处理数据执行解密操作。为了简洁，在此不再赘述。
由上述数据加密或解密的处理过程的描述可知，本申请所要保护的数据的加密或解密方法中，提供由加解密芯片处理的第一处理方式和由中央处理器上的软件程序处理的第二处理方式，可以从上述两种处理方式中选择一种处理方式对待处理数据执行加密或解密操作，以此充分发挥软件加解密方式和硬件加解密方式的优势，降低加密或解密处理过程的时延，提升数据处理的效率。
接下来，基于图1所示的系统，以数据处理请求中携带的待处理数据为第一数据块， 数据处理为加密，且采用上述方式2选择处理方式为例，结合图3进一步解释本申请提供的数据的加密或解密的方法，如图所示，该方法包括：
S301、决策模块获取数据处理请求，其中，数据处理器请求中携带待处理数据。
S302、决策模块从第一处理方式和第二处理方式中选择一种作为待处理数据的处理方式。
上述步骤S301和S302的处理过程与图2中步骤S201和S202相同，为了简洁，在此不再赘述。
S303、当第一数据块的大小小于或等于第一阈值时，决策模块选择软件加解密方式，通知软件加解密模块对第一数据块进行加密处理。
第一阈值也可以称为预设的大小阈值，第一阈值的确定方式可以采用以下方式中任意一种：
方式1，可以按照经验值确定。
方式2，也可以是根据历史数据的统计情况获得。
方式3，还可以预先构建硬件加解密方式最优评估模型进行确定，进而实现最大化发挥硬件加解密芯片的处理能力。
例如，假设待处理数据的处理时延为F(n)；硬件卸载成本为t1，t1主要包括加解密卸载模块向硬件加解密芯片发送待处理数据的过程所需占用的计算资源和网络资源；待处理数据的大小为L；硬件加解密方式中处理单位长度的数据块的时延成本为k1，k1可以根据统计数据获得，也可以根据硬件加解密芯片的配置手册查询获得；软件加解密方式中处理单位长度的数据块的时延成本为k2，k2可以根据统计数据获得；切片数为n，n是指将待处理数据切分为多个分片的数量，示例地，n可以是大于或等于2的正整数，以便硬件加解密芯片的多个处理器核并行对分片数据执行加密或解密操作。那么，可以依据以下三种场景计算F(n)，具体如下：
场景1，处理方式为硬件加解密方式，应用程序有等待。
在场景1中，待处理数据的大小通常较大，虽然利用加解密芯片中不同处理器核对待处理数据的各个分片并行处理，但是，由于采用硬件加解密方式所需要的时延受限于加解密芯片中处理器核的个数以及数据搬迁的通道数，在该场景中，硬件加解密芯片无法快速完成待处理数据的加密或解密操作，应用程序不可避免的需要等待的情况。其中，数据搬迁的通道数是指可将待处理数据从内存搬迁至加解密芯片的存储器的通道数。示例地，如图4(a)所示，待处理数据被切分为3个分片，则硬件卸载成本t1包括切分各个分片，以及在内存和加解密芯片的存储之间搬迁各个分片的成本之和；加解密芯片数据处理的开销为k1*分片个数，此时，可以采用如下公式1表示F(n)及其约束条件：
Figure PCTCN2021088551-appb-000001
约束条件：
Figure PCTCN2021088551-appb-000002
场景2，处理方式为硬件加解密方式，应用程序有等待。
在场景2中，待处理数据的大小通常较小，如图4(b)所示，通过将待处理数据切分为多个分片，并利用多个加解密芯片中处理器核并行对不同分片数据执行加密或解密操作，能够最大限度降低数据处理的时延，该场景最优切片数量的临界情况是应用程序无等待。与场景1类似，可以采用如下公式1表示F(n)及其约束条件：
F(n)＝n*t1+n*t1约束条件：
Figure PCTCN2021088551-appb-000003
场景3，处理方式为软件加解密方式。
场景3中，待处理数据通常非常小，一般为几十或几百字节大小，如图4(c)所示，这种情况无法发挥硬件加解密芯片对中央处理器加密或解密操作卸载所带来的好处，可通过软件加解密方式对待处理数据进行加密，此时，可以采用如下公式3表示F(n)及其约束条件：
F(n)＝L*k1约束条件：L*k1≤L*k1+2*t1          公式3
综合上述三种场景，可以构建硬件加解密方式最优评估模型如下：
Figure PCTCN2021088551-appb-000004
根据上述硬件加解密方式最优评估模型可以确定如下策略：
当待处理数据的大小满足如下公式5时，采用软件加解密方式对待处理数据执行加密或解密操作：
Figure PCTCN2021088551-appb-000005
当待处理数据的大小满足如下公式6时，采用硬件加解密方式对待处理数据执行加密或解密操作：
Figure PCTCN2021088551-appb-000006
综上所述，采用构建硬件加解密方式最优评估模型的方式，第一阈值可以为
Figure PCTCN2021088551-appb-000007
当待处理数据的大小满足公式5时，采用软件加解密方式对待处理数据执行加密或解密操作；当待处理数据的大小满足公式6时，则采用硬件加解密方式对待处理数据执行加密或解密操作。
进一步地，当第一数据块的大小小于或等于第一阈值时，决策模块选择软件加解密方式，通知软件加解密模块对第一数据块进行加密或解密处理。
S304、当完成第一数据块的加密时，软件加解密模块向决策模块返回第一数据块的加密结果。
软件加解密模块完成第一数据块的加密后，会将第一数据块的加密结果返回给决策模块，由决策模块管理第一数据块的加密结果，并将待处理数据的加密结果发送给应用程序。也就是说，本申请中由决策模块根据预设规则选择处理方式，指示软件加解密模块或加解密卸载模块分别对待处理数据执行加密或解密操作，以及汇总软件加解密模块或加解密卸载模块返回各个数据块的加密结果，最终，将待处理数据的加密结果返回给应用程序。其中，决策模块可以利用初始化过程中申请的数据缓冲区存储第一数据块的加密结果，例如，如图5中，数据块a1采用软件加解密方式进行加密，加密解密被存储至初始化阶段申请的数据缓冲区中，最终，会按照数据处理请求中待处理数据的输出地址将待处理数据的加密结果存储至应用程序指定的输出地址。
S305、决策模块向状态同步模块发送第一数据块的加密状态。
由于相邻的待处理数据可能采用不同处理方式执行加密或解密操作，且相邻待处理数据之间可能存在关联关系，对于软件加解密模块和加解密卸载模块而言，无法获知当前处 理的数据块在整个流模式的数据处理过程中所处的位置和与其他待处理数据的关联关系。此时，需要利用状态同步模块记录相邻待处理数据中各个待处理数据的加密状态，以此保证待处理数据之间可以按照顺序逐个完成加密或解密处理。
上述步骤S303至S305也可以称为软件加解密流程，也就是说，当第一数据块的大小小于或等于第一阈值时，则选择软件加解密方式执行第一数据块的处理。而当第一数据块的大小大于第一阈值时，则选择硬件加解密方式执行第一数据块的处理，具体参见步骤S306至S313，步骤S306至S313也可以称为硬件加解密流程，详细操作过程如下：
S306、当第一数据块大于第一阈值时，选择硬件加解密方式，通知加解密卸载模块对第一数据块执行加密操作。
如上述步骤S303中，如待处理数据的大小满足公式6，则采用硬件加解密方式对第一数据块执行加密或解密操作。
S307、加解密卸载模块对第一数据块进行分片，并将每个分片分别存储至第一队列。
作为一种可能的实现方式，当选择硬件加解密方式时，还可以进一步切分待处理数据获得多个分片，并利用加解密芯片中多个处理器核分别对各个分片执行并行处理，进而提升硬件加解密方式的处理效率。
具体地，可以先根据第一数据块的大小和硬件加解密芯片的处理能力确定分片的数量；再根据确定的分片的数量切分第一数据块，获得两个或两个以上分片。其中，硬件加解密芯片的处理能力包括加解密芯片中处理器核的个数、数据通道数、以及每个处理器核对单位长度的数据块的处理时延。
可选地，也可以根据上述硬件加解密方式最优评估模型确定公式7，并按照公式7切分第一数据块：
Figure PCTCN2021088551-appb-000008
在第一数据块的分片过程中，可以利用初始化阶段申请的如图5所示的队列105存储各个分片数据和分片数据的加密结果，为了便于表述，也可以将队列105称为第一队列。
S308、加解密卸载模块指示加解密芯片分别对加解密引擎队列中分片执行加解密处理。
加解密芯片在获取加解密卸载模块的指示后，可以在加解密芯片的多个处理器核中选择第一处理器核集合，第一处理器核集合中处理器核的个数大于或等于切分待处理数据切分所获得的分片的个数。可选地，加解密芯片可以在空闲状态的处理器核中选择第一处理器核集合。进一步地，加解密芯片还可以确定第一处理器核集合中处理器核和各个分片的匹配关系，即分片和执行每个分片的处理器核之间的关系，进而向第一处理器核集合的处理器核发送上述切分获得的两个或两个以上分片，以便第一处理器核集合中各个处理器核分别对不同分片执行加密或解密操作。其中，第一处理器核集合中处理器核和各个分片的匹配关系可以根据加解密芯片中各个处理器核的算力和分片大小确定，具体地，待处理数据的各个分片有可能并不相同，可以根据空闲状态的处理器核的算力选择匹配的处理器核，以提升每个分片的处理速度。
可选地，除了由加解密芯片选择第一处理器核集合外，加解密卸载模块也可以记录加解密芯片中处理器核个数，以及每个处理器核的工作状态，当需要利用硬件加解密方式对第一数据块加密或解密时，加解密卸载模块也可以根据其记录的情况选择第一处理器核集 合，并确定第一处理器核集合中处理器核和各个分片的匹配关系，进而通知加解密芯片按照上述匹配关系，由第一处理器核集合中处理器核分别执行不同分片的加密或解密操作。
作为一种可能的实现方式，步骤S307中待处理数据的分片过程也可以是加解密卸载模块1023直接向加解密芯片200发送待处理数据，由加解密芯片按照上述公式7切分待处理数据，并选择第一处理器核集合，进而确定第一处理器核集合中处理器核和分片的关联关系。
S309、加解密芯片对每个分片进行加密处理。
S310、加解密芯片向加解密卸载模块返回每个分片的加密结果。
加解密芯片包括多个处理器核，不同处理器核可以并行执行不同分片的加密处理，以此提升第一数据块的加密效率，降低第一数据块的加密处理时延。
值得说明的是，本申请对每个处理器核如何按照具体算法对各个分片进行加密的过程不做限定，具体实施过程中，可以根据具体算法的要求完成对每个分片的加密或解密处理。
参见图5，图5为本申请提供的另一种数据加解密处理的流程示意图，如图所示，以系统包括队列105(也可以称为第一队列)、加解密芯片200包括s个处理器核为例进行说明。队列105包括用于存储分片的队列和用于存储加密结果的队列。加解密芯片200中包括队列106(也可以称为第二队列)，队列106的结构可以与队列105相同或相似，例如，队列106可以与队列105的个数相同，且队列深度相同；或者，队列106的个数大于或等于队列105的个数，且队列106的队列深度大于或等于队列105的队列深度。初始化和数据透传模块1031可以将实现队列105和队列106中数据搬迁。可选地，加解密芯片200也可以通过直接内存访问(direct memory access，DMA)控制器实现数据在队列106和队列105之间的搬迁。具体地，加解密芯片200可以利用直接内存访问方式将队列105中分片数据搬迁至加解密芯片200的存储器中，并利用加解密芯片200的处理器核201-处理器核20s分别对各个分片执行加密操作。然后，在完成分片的加密处理后，在利用类似上述方法，由图1所示的初始化和数据透传模块1031或加解密芯片200中直接内存访问控制器把分片数据的加密结果搬迁至队列105，以便于应用程序可以获得待处理数据的加密结果。
S311、加解密卸载模块对第一数据块中分片数据的加密结果进行排序，获得第一数据块的加密结果。
由于第一数据块被切分为多个分片，数据搬迁的速度和各个处理器核的处理能力可能存在差异，各个分片数据的加密结果并不能按照切分顺序先后完成加密或解密操作，为了保证第一数据块加密结果的准确性，加解密卸载模块还可以记录第一数据块的分片顺序，并根据各个分片的切分顺序分别存储分片加密结果。
示例地，如图5所示，决策模块1021选择硬件加解密方式对数据块a2进行加密，并指示加解密卸载模块1024对数据块a2执行加密操作。当加解密卸载模块1024可以对a2执行分片处理，如将a2切分为a21-a2n，共n个分片，每个分片具有一个唯一的序号，各个分片分别被存储至队列105。当完成分片数据的加密操作时，加解密芯片200或内核态驱动103可以通过直接内存访问方式或数据透传方式，按照分片顺序的序号将各个切片数据的加密结果存储至指定位置。例如，在队列105中按照切片顺序预先划分n个存储空间，每个存储空间分别用于存储一个分片数据的序号关联的加密结果，如a22分片的加密结果存在队列105中与序号22关联的add-2存储位置，当接收到a22的加密结果时，则可以直 接将其存储至add-2存储地址对应的存储空间。当监测到队列105中预先约定的n个存储空间均存储有数据时，则可以判定a2的各个分片数据均已完成加密操作。此时，可以按照预先划分的n个存储空间依次获取各个分片的加密结果，并对上述加密结果执行合并，将合并后的结果作为a2的加密结果存储至应用程序指定的输出地址。其中，对各个加密结果的合并包括依次读取各个加密结果，并将每次读取结果逐个存储至应用程序指定的输出地址。可选地，对各个加密结果的合并也可以是在初始化阶段申请的待处理数据的数据缓冲区将各个加密结果进行拼接，也即按照分片顺序将各个分片结果组成a2的完整加密结果，最后，将完整加密结果存储至应用程序指定的输出地址。
S312、加解密卸载模块通知决策模块完成第一数据块的加密操作。
当完成第一数据块的加密操作后，加解密卸载模块向决策模块发送通知，以告知决策模块已完成第一数据块的加密操作。可选地，加解密卸载模块可以向决策模块发送存储第一数据块的加密结果的存储地址。可选地，加解密卸载模块也可以直接向决策模块发送第一数据块的加密结果。
S313、决策模块向状态同步模块发送第一数据块的加密状态。
步骤S312-S313的执行过程与步骤S304-S305的操作过程类似，当采用硬件加解密方式对第一数据块进行加密时，也可以由决策模块将第一数据块的加密状态同步至状态同步模块，以此保证待处理数据中个数据块的一致性。
S314、决策模块向应用程序发送待处理数据的加密结果。
决策模块可以直接向应用程序发送待处理数据的加密结果；也可以将存储加密结果的地址发送至应用程序；还可以预先将加密结果存储至预先约定的输出地址，向决策模块发送完成加密操作的通知，以便应用程序按照预定从输出地址获取待处理数据的加密结果。
作为一种可能的实现方式，当数据处理请求中携带的待处理数据为多个第一数据块时，每个数据块均可以按照上述步骤S303至S305所述的软件加解密流程或步骤S306至S313所述的硬件加解密流程完成加密或解密处理。决策模块1021可以通过对队列105的周期性检测确定数据处理请求中各个待处理数据块是否均已完成加密处理，当确定待处理数据的所有数据块均完成加密或解密处理时，则将数据处理请求所包含的所有数据块的加密结果存储至应用程序指定的输出地址，以完成加解密请求对待处理数据的加密处理操作。示例地，如图5所示，数据处理请求包括两个待处理数据a1和a2。当a1和a2均完成加密操作后，决策模块1021将a1和a2的加密结果存储至应用程序指定的输出位置，进而由应用程序获取该数据处理请求的加密结果。
作为一种可能的实现方式，在步骤S314之后，决策模块1021还可以释放软硬件资源，例如，处理器进程等软件资源，以及初始化阶段申请的数据缓冲区和加解密芯片的处理器核等硬件资源，以便如图1所示的系统还可以处理同一应用程序或其他应用程序的数据处理请求。
作为一种可能的实施例，上述图3至图5是以加密为例介绍本申请的数据加密或解密的方法，该方法同样适用于解密的处理过程，与上述方法类似，解密过程同样可以采用类似方法执行待处理数据的加密或解密操作。
通过上述描述可知，本申请提供两种数据加密或解密的处理方式，可以根据待处理数据的大小选择处理方式，并依据所选择的处理方式指示软件加解密模块或加解密卸载模块 执行对待处理数据的加密或解密操作。对于较大待处理数据可以充分利用加解密芯片的硬件卸载能力，降低数据处理过程的处理时延，提升效率；而对于较小的待处理数据，则可以利用软件加解密方式执行加密或解密操作，由此实现针对不同数据块的大小选择处理方式，充分发挥加解密芯片的处理能力，提升数据处理效率，降低数据处理时延。同时，在硬件加解密方式中，还可以对待处理数据进行分片，并利用加解密芯片中多个处理器核并行对各个分片数据执行加密或解密操作，以此充分发挥加解密芯片在解密过程中处理效率，降低解密操作的处理时延，进而提升整个系统的数据处理性能。
值得说明的是，对于上述方法实施例，为了简单描述，故将其都表述为一系列的动作组合，但是本领域技术人员应该知悉，本申请并不受所描述的动作顺序的限制，其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作并不一定是本申请所必须的。
本领域的技术人员根据以上描述的内容，能够想到的其他合理的步骤组合，也属于本申请的保护范围内。其次，本领域技术人员也应该熟悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作并不一定是本申请所必须的。
上文中结合图1至图5，详细描述了根据本申请所提供数据加密或解密的方法，下面将结合图6至图7，描述根据本申请所提供的数据加密或解密的装置和系统。
图6为本申请提供的一种数据加密或解密的装置600的结构示意图，如图所示，装置600包括获取单元601、决策单元602和处理单元603，其中，
获取单元601，用于取数据处理请求，所述数据处理请求中携带待处理数据；
决策单元602，用于从第一处理方式和第二处理方式中选择一种作为所述待处理数据的处理方式，所述第一处理方式由加解密芯片处理，所述第二处理方式由运行在中央处理器上的软件程序处理；
处理单元603，利用选择的所述处理方式对所述待处理数据执行加密或解密的操作。
应理解的是，本申请实施例的装置600可以通过专用集成电路(application-specific integrated circuit，ASIC)实现，或可编程逻辑器件(programmable logic device，PLD)实现，上述PLD可以是复杂程序逻辑器件(complex programmable logical device，CPLD)，现场可编程门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(generic array logic，GAL)或其任意组合。也可以通过软件实现图2至图5所示的数据处理方法时，装置600及其各个模块也可以为软件模块。
可选地，决策单元602，还用于根据所述待处理数据的大小和第一参数，选择所述待处理数据的处理方式，其中，所述第一参数包括单位长度的数据块的加密或解密处理时延。
可选地，决策单元602，还用于根据所述待处理数据的大小和所述第一参数预测得到第一处理时延和第二处理时延，其中，所述第一参数包括单位长度的数据块在所述第一处理方式下的处理时延和单位长度的数据块在所述第二处理方式下的处理时延，所述第一处理时延为所述待处理数据在所述第一处理方式下的处理时延，所述第二处理时延为所述待处理数据在所述第二处理方式下的处理时延；根据所述第一处理时延和所述第二处理时延的比较结果选择所述处理方式。
可选地，所述决策单元602，还用于根据所述待处理数据的大小选择所述待处理数据的处理方式。
可选地，所述决策单元602，还用于当所述待处理数据的大小大于所述预设的大小阈值时，选择所述第一处理方式；当所述待处理数据的大小小于或等于预设的大小阈值时，选择所述第二处理方式。
可选地，所述处理单元603，还用于对所述待处理数据进行分片；利用所述加解密芯片中的多个硬件加解密引擎分别对不同分片执行所述加密或解密操作。
可选地，所述处理单元603，还用于根据所述待处理数据的大小、所述加解密芯片中处理器核的个数、数据通道数、以及每个处理器核对单位长度的数据块的处理时延确定分片的数量；根据所述确定的分片的数量切分所述第一数据块，获得两个或两个以上分片。
可选地，所述处理单元603，还用于在所述硬件加解密引擎的多个处理器核中选择第一处理器核集合，所述第一处理器核集合中处理器核的个数大于或等于切分所述待处理数据所获得的分片的个数；向所述第一处理器核集合的处理器核发送所述两个或两个以上分片，以使得所述第一处理器核集合中各个处理器核分别对所述两个或两个以上分片中不同分片执行加密或解密操作。
可选地，所述处理单元603，还用于根据分片顺序分别对所述待处理数据的各个分片的加密结果进行排序，获得所述待处理数据的加密结果。
根据本申请实施例的装置600可对应于执行本申请实施例中描述的方法，并且装置600中的各个单元的上述和其它操作和/或功能分别为了实现图2至图5中的各个方法的相应流程，为了简洁，在此不再赘述。
通过上述装置600，也可以提供数据加密或解密的两种处理方式，并可以依据具体情况选择不同处理方式，进而充分发挥加解密芯片的处理能力，提升数据处理的效率。进一步地，在硬件加解密方式中，还可以进一步将待处理数据切分为多个分片，由多个处理器核分别对不同分片执行加密或解密操作，以此实现分片间的并行处理过程，进一步提升数据处理的效率。
图7为本申请提供的一种数据加密或解密的系统700的结构示意图，如图所示，该系统700包括处理器701、内存单元702、存储器703、通信接口704、加解密芯片705和总线706，其中，处理器701、内存单元702、存储器703、通信接口704和加解密芯片705通过总线706相通信，也可以通过无线传输等其他手段实现通信。该内存单元702用于存储程序代码，处理器701用于执行该内存单元702存储的程序代码。处理器701可以调用内存单元702中存储的程序代码执行以下操作：
获取数据处理请求，所述数据处理请求中携带待处理数据，所述数据处理包括加密或解密；
从第一处理方式和第二处理方式中选择一种作为所述待处理数据的处理方式，所述第一处理方式由加解密芯片处理，所述第二处理方式由运行在中央处理器上的软件程序处理；
利用选择的所述处理方式对所述待处理数据执行加密或解密的操作。
应理解，存储器703也可以用于存储程序代码，按照计算机中处理器701读写内存单元和存储器的处理方式，处理器701可以先将存储器703中程序代码加载至内存单元702，然后再从内存单元702中调用程序代码中具体指令实现上述方法的操作过程。
应理解，在本申请实施例中，该处理器701可以是CPU，该处理器701还可以 是数字信号处理器(digital signal processing，DSP)、专用集成电路(application-specific integrated circuit，ASIC)、现场可编程门阵列(field-programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。还可以是其他类型的处理器，如GPU、NPU等具有计算能力的处理器。
内存单元702中包括上述图1所示系统的内核态驱动7021、用户态驱动7022、程序代码7023，以及用于如步骤S307所述的第一队列7024。
该存储器703可以包括只读存储器和随机存取存储器，并向处理器701提供指令和数据。存储器703还可以包括非易失性随机存取存储器。例如，存储器703还可以存储设备类型的信息。
该存储器703可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data date SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct ram bus RAM，DR RAM)。
通信接口704，用于实现系统700与系统外其他设备或系统的通信，示例地，通信接口704可以是网卡。
加解密芯片705中包括处理器7051、存储器7052、通信接口7053和总线7054，其中，处理器7051、存储器7052、通信接口7053通过总线7054相连，其中，处理器7051也可以如处理器701包括各种类型的处理器，每个处理器包括多个处理器核，如处理器核1和处理器核2。通信接口7053用于实现加解密芯片705与其他部件和/或设备的通信。存储器7052中包括程序代码70521和第二队列70522，以使得加解密芯片705实现上述图2至图5所示的方法中相应主体所执行的方法的操作步骤。
值得说明的是，处理器7051中处理器和每个处理器核的个数并不构成对本申请的限定，具体实施中，可以依据具体业务需求配置加解密芯片中处理器的个数，以及每个处理器中处理器核的个数。
总线706除包括数据总线之外，还可以包括电源总线、控制总线和状态信号总线等。但是为了清楚说明起见，在图中将各种总线都标为总线703。
应理解，根据本申请实施例的系统700可对应于本申请实施例中的装置600，并可以对应于执行根据本申请实施例的方法100中的相应主体，并且系统700中的各个模块的上述和其它操作和/或功能分别为了实现图2至图5中的各个方法的相应流程，为了简洁，在此不再赘述。
通过上述内容的描述可知，系统700也可以提供两种数据加密或解密的处理方式，并根据具体情况选择一种方式作为待处理数据的处理方式，进而针对不同待处理数据使用不同处理方式执行加密或解密操作，以此提升数据处理的效率。另一方面，在硬件加解密处理方式中，还可以将待处理数据切分为多个分片，分别利用加解密芯片中多个处理器核分别对不同分片执行加密或解密操作，以实现多个分片的并行处理，进而提升数据处理效率的目的，可以进一步提升系统的处理速度，降低处理时延。
作为一种可能的实现方式，本申请还提供一种数据加密或解密的系统，与系统700不同在于，处理器701和加解密芯片705通过除总线以外的外部网络连接，该外部网络包括以太网、第5代(the fifth generation,5G)移动通信技术、无线网络。此时，该系统中至少包括两个设备，处理器701和加解密芯片705分别位于不同设备，处理器701和加解密芯片705通过外部网络进行通信。该系统也可以用于实现上述图2至图5所示方法，为了解决，在此不再赘述。
上述实施例，可以全部或部分地通过软件、硬件、固件或其他任意组合来实现。当使用软件实现时，上述实施例可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载或执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以为通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集合的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质。半导体介质可以是固态硬盘(solid state drive，SSD)。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到各种等效的修改或替换，这些修改或替换都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以权利要求的保护范围为准。

Claims (22)

  1. 一种数据加密或解密的方法，其特征在于，所述方法包括：
    获取数据处理请求，所述数据处理请求中携带待处理数据；
    从第一处理方式和第二处理方式中选择一种作为所述待处理数据的处理方式，所述第一处理方式由加解密芯片处理，所述第二处理方式由运行在中央处理器上的软件程序处理；
    利用选择的所述处理方式对所述待处理数据执行加密或解密的操作。
  2. 根据权利要求1所述的方法，其特征在于，所述选择步骤包括：
    根据所述待处理数据的大小和第一参数，选择所述待处理数据的处理方式，其中，所述第一参数包括单位长度的数据块的加密或解密处理时延。
  3. 根据权利要求2所述的方法，其特征在于，所述选择步骤具体包括：
    根据所述待处理数据的大小和所述第一参数预测得到第一处理时延和第二处理时延，其中，所述第一参数包括单位长度的数据块在所述第一处理方式下的处理时延和单位长度的数据块在所述第二处理方式下的处理时延，所述第一处理时延为所述待处理数据在所述第一处理方式下的处理时延，所述第二处理时延为所述待处理数据在所述第二处理方式下的处理时延；
    根据所述第一处理时延和所述第二处理时延的比较结果选择所述处理方式。
  4. 根据权利要1所述的方法，其特征在于，所述选择步骤包括：
    根据所述待处理数据的大小选择所述待处理数据的处理方式。
  5. 根据权要求4所述的方法，其特征在于，所述选择步骤具体包括：
    当所述待处理数据的大小大于所述预设的大小阈值时，选择所述第一处理方式；
    当所述待处理数据的大小小于或等于预设的大小阈值时，选择所述第二处理方式。
  6. 根据权利要求1所述的方法，其特征在于，当所述选择的加解密方式为所述第一处理方式时，所述利用选择的处理方式对所述待处理数据进行加密或解密，包括：
    对所述待处理数据进行分片；
    利用所述加解密芯片中的多个处理器核分别对不同分片执行所述加密或解密操作。
  7. 根据权利要求6所述的方法，其特征在于，所述对所述待处理数据进行分片包括：根据所述加解密芯片的硬件处理能力对所述待处理数据进行分片。
  8. 根据权利要求6或7中任一所述的方法，其特征在于，所述根据硬件加解密芯片的处理能力对所述待处理数据进行分片，包括：
    根据所述待处理数据的大小、所述加解密芯片中处理器核的个数、数据通道数、以及每个处理器核对单位长度的数据块的处理时延确定分片的数量；
    根据所述确定的分片的数量切分所述第一数据块，获得两个或两个以上分片。
  9. 根据权利要求8所述的方法，其特征在于，所述方法还包括：
    在所述加解密芯片的多个处理器核中选择第一处理器核集合，所述第一处理器核集合中处理器核的个数大于或等于切分所述待处理数据所获得的分片的个数；
    向所述第一处理器核集合的处理器核发送所述两个或两个以上分片，以使得所述第一处理器核集合中各个处理器核分别对所述两个或两个以上分片中不同分片执行加密或解密操作。
  10. 根据权利要求6至8中任一所述的方法，其特征在于，所述方法还包括：
    根据分片顺序分别对所述待处理数据的各个分片的加密结果进行排序，获得所述待处理数据的加密结果。
  11. 一种数据加密或解密的装置，其特征在于，所述装置包括：
    获取单元，用于获取数据处理请求，所述数据处理请求中携带待处理数据；
    决策单元，用于从第一处理方式和第二处理方式中选择一种作为所述待处理数据的处理方式，所述第一处理方式由加解密芯片处理，所述第二处理方式由运行在中央处理器上的软件程序处理；
    处理单元，利用选择的所述处理方式对所述待处理数据执行加密或解密的操作。
  12. 根据权利要求11所述的装置，其特征在于，
    所述决策单元，还用于根据所述待处理数据的大小和第一参数，选择所述待处理数据的处理方式，其中，所述第一参数包括单位长度的数据块的加密或解密处理时延。
  13. 根据权利要求12所述的装置，其特征在于，
    所述决策单元，还用于根据所述待处理数据的大小和所述第一参数预测得到第一处理时延和第二处理时延，其中，所述第一参数包括单位长度的数据块在所述第一处理方式下的处理时延和单位长度的数据块在所述第二处理方式下的处理时延，所述第一处理时延为所述待处理数据在所述第一处理方式下的处理时延，所述第二处理时延为所述待处理数据在所述第二处理方式下的处理时延；根据所述第一处理时延和所述第二处理时延的比较结果选择所述处理方式。
  14. 根据权利要求11所述的装置，其特征在于，
    所述决策单元，还用于根据所述待处理数据的大小选择所述待处理数据的处理方式。
  15. 根据权利要求14所述的装置，其特征在于，
    所述决策单元，还用于当所述待处理数据的大小大于所述预设的大小阈值时，选择所述第一处理方式；当所述待处理数据的大小小于或等于预设的大小阈值时，选择 所述第二处理方式。
  16. 根据权利要求11所述的装置，其特征在于，
    所述处理单元，还用于对所述待处理数据进行分片；利用所述加解密芯片中的多个硬件加解密引擎分别对不同分片执行所述加密或解密操作。
  17. 根据权利要求16所述的装置，其特征在于，
    所述处理单元，还用于根据所述加解密芯片的硬件处理能力对所述待处理数据进行分片。
  18. 根据权利要求16或17所述的装置，其特征在于，
    所述处理单元，还用于根据所述待处理数据的大小、所述加解密芯片中处理器核的个数、数据通道数、以及每个处理器核对单位长度的数据块的处理时延确定分片的数量；根据所述确定的分片的数量切分所述第一数据块，获得两个或两个以上分片。
  19. 根据权利要求18所述的装置，其特征在于，
    所述处理单元，还用于在所述加解密芯片的多个处理器核中选择第一处理器核集合，所述第一处理器核集合中处理器核的个数大于或等于切分所述待处理数据所获得的分片的个数；向所述第一处理器核集合的处理器核发送将所述两个或两个以上分片，以使得所述第一处理器核集合中各个处理器核分别对所述两个或两个以上分片中不同分片执行加密或解密操作。
  20. 根据权利要求16至18中任一所述的装置，其特征在于，
    所述处理单元，还用于根据分片顺序分别对所述待处理数据的各个分片的加密结果进行排序，获得所述待处理数据的加密结果。
  21. 一种数据加密或解密的系统，其特征在于，所述系统包括处理器和加解密芯片，所述系统用于执行所述权利要求1至10中任一所述方法的操作步骤。
  22. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中包括指令，当其在计算机上运行时，使得计算机执行权利要求1至10中任一所述的方法的操作步骤。
PCT/CN2021/088551 2020-06-08 2021-04-21 数据加密或解密的方法、装置和系统 WO2021249028A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP21822921.9A EP4148606A4 (en) 2020-06-08 2021-04-21 METHOD FOR ENCRYPTING OR DECRYPTING DATA, APPARATUS AND SYSTEM
US18/062,944 US20230102374A1 (en) 2020-06-08 2022-12-07 Data Encryption Or Decryption Method, Apparatus, And System

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN202010514307.9 2020-06-08
CN202010514307 2020-06-08
CN202011426126.7 2020-12-09
CN202011426126.7A CN113836543A (zh) 2020-06-08 2020-12-09 数据加密或解密的方法、装置和系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/062,944 Continuation US20230102374A1 (en) 2020-06-08 2022-12-07 Data Encryption Or Decryption Method, Apparatus, And System

Publications (1)

Publication Number Publication Date
WO2021249028A1 true WO2021249028A1 (zh) 2021-12-16

Family

ID=78845192

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/088551 WO2021249028A1 (zh) 2020-06-08 2021-04-21 数据加密或解密的方法、装置和系统

Country Status (3)

Country Link
US (1) US20230102374A1 (zh)
EP (1) EP4148606A4 (zh)
WO (1) WO2021249028A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114785860A (zh) * 2022-06-02 2022-07-22 深圳云创数安科技有限公司 基于加解密的数据响应方法、装置、设备及介质

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CA3139745A1 (en) * 2020-11-25 2022-05-25 Comcast Cable Communications, Llc Sample-parallel sparse cipher-block chaining (cbcs) encrypton
CN116186747A (zh) * 2023-04-27 2023-05-30 暗链科技(深圳)有限公司 自适应哈希加密方法、非易失性可读存储介质及电子设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104038339A (zh) * 2013-03-04 2014-09-10 唐键 使用多密码算法和多密钥对文件或通信报文进行加密的方法
CN104735457A (zh) * 2015-03-27 2015-06-24 南京中新赛克科技有限责任公司 一种基于h.264编码的视频加解密方法
US20160140349A1 (en) * 2014-11-19 2016-05-19 Ebay Inc. Systems and methods for encrypting information displayed on a user interface of a device
CN111103856A (zh) * 2019-12-18 2020-05-05 宁波和利时信息安全研究院有限公司 一种加密控制方法、装置及系统

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7120799B2 (en) * 2000-12-15 2006-10-10 International Business Machines Corporation Method and apparatus for dual hardware and software cryptography
JP4912075B2 (ja) * 2006-08-11 2012-04-04 パナソニック株式会社 復号装置
KR102376506B1 (ko) * 2014-10-20 2022-03-18 삼성전자주식회사 암복호화기, 암복호화기를 포함하는 전자 장치 및 암복호화기의 동작 방법

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104038339A (zh) * 2013-03-04 2014-09-10 唐键 使用多密码算法和多密钥对文件或通信报文进行加密的方法
US20160140349A1 (en) * 2014-11-19 2016-05-19 Ebay Inc. Systems and methods for encrypting information displayed on a user interface of a device
CN104735457A (zh) * 2015-03-27 2015-06-24 南京中新赛克科技有限责任公司 一种基于h.264编码的视频加解密方法
CN111103856A (zh) * 2019-12-18 2020-05-05 宁波和利时信息安全研究院有限公司 一种加密控制方法、装置及系统

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114785860A (zh) * 2022-06-02 2022-07-22 深圳云创数安科技有限公司 基于加解密的数据响应方法、装置、设备及介质
CN114785860B (zh) * 2022-06-02 2024-06-04 深圳云创数安科技有限公司 基于加解密的数据响应方法、装置、设备及介质

Also Published As

Publication number Publication date
US20230102374A1 (en) 2023-03-30
EP4148606A1 (en) 2023-03-15
EP4148606A4 (en) 2023-10-18

Similar Documents

Publication Publication Date Title
WO2021249028A1 (zh) 数据加密或解密的方法、装置和系统
CN113836543A (zh) 数据加密或解密的方法、装置和系统
US20230110230A1 (en) Technologies for secure i/o with memory encryption engines
US10310774B2 (en) Techniques for data storage protection and integrity checking
EP3198458B1 (en) Technologies for accelerating compute intensive operations using solid state drives
US10289568B2 (en) Application-driven storage systems for a computing system
US20170324713A1 (en) Techniques for load balancing in a packet distribution system
US9419972B2 (en) Two dimensional direct memory access scheme for enhanced network protocol processing performance
US20080294913A1 (en) Disk array controller, disk array control method and storage system
WO2021249059A1 (zh) 网卡以及网卡处理数据的方法
US20230069781A1 (en) Microprocessor, data processing method, electronic device, and storage medium
CN111324777A (zh) 用于分片创建的装置和系统
US20180288099A1 (en) Secure software defined storage
US11899829B2 (en) Memory systems and devices including examples of generating access codes for memory regions using authentication logic
US8452900B2 (en) Dynamic compression of an I/O data block
KR20080029687A (ko) 암호화 기능이 내장된 메모리를 이용한 고속 대용량의암호화 장치 및 그 구현 방법
CN115022076A (zh) 一种数据加/解密方法、装置、系统及介质
US20170344759A1 (en) Electronic circuit performing encryption/decryption operation to prevent side-channel analysis attack, and electronic device including the same
CN116192395A (zh) 用于分散式数据存储的可信系统
WO2024109417A1 (zh) 数据加密方法、数据解密方法、装置、设备及存储介质
US11461043B2 (en) Storage device set including storage device and reconfigurable logic chip, and storage system including storage device set
CN115577397A (zh) 数据处理方法、装置、设备及存储介质
CN115795522A (zh) 多核并发的高速密码引擎数据处理方法及装置
US20180097781A1 (en) Device for managing multiple accesses to a secure module of a system on chip of an apparatus
CN117493344B (zh) 一种基于机密计算技术的数据组织方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21822921

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2021822921

Country of ref document: EP

Effective date: 20221207

NENP Non-entry into the national phase

Ref country code: DE