WO2024040846A1

WO2024040846A1 - Data processing method and apparatus, electronic device, and storage medium

Info

Publication number: WO2024040846A1
Application number: PCT/CN2022/144150
Authority: WO
Inventors: 王阳; 樊俊诚; 吴亚东
Original assignee: 奇安信网神信息技术(北京)股份有限公司; 奇安信科技集团股份有限公司
Priority date: 2022-08-23
Filing date: 2022-12-30
Publication date: 2024-02-29
Also published as: CN115426403A

Abstract

The present application relates to the technical field of communications, and provides a data processing method and apparatus, an electronic device, and a storage medium. According to the method, two levels of coroutines are designed under an SSL proxy service for respectively processing messages requiring the SSL proxy service, such that layering of a code logic level is realized, and the processing performance of the SSL proxy service can be effectively improved; moreover, a message processing process in a network middlebox can receive messages of various services and correspondingly process the messages, such that the network middlebox can process messages in more service scenarios instead of only processing messages of the SSL proxy service, and thus the performance of the network middlebox for processing other services can be improved. In addition, according to the present solution, an encryption/decryption operation is issued to a hardware acceleration apparatus for processing, such that the performance of the hardware acceleration apparatus can be fully exerted, and the consumption of computing resources of a CPU in the network middlebox is reduced, thereby further improving the performance of the CPU for processing concurrent services.

Description

Data processing methods, devices, electronic equipment and storage media

Cross-references to related applications

This application claims priority to the Chinese patent application with application number 202211017571.7 and titled "Data processing methods, devices, electronic equipment and storage media" submitted to the State Intellectual Property Office of China on August 23, 2022, the entire content of which is incorporated by reference. incorporated in this application.

Technical field

The present application relates to the field of communication technology, specifically, to a data processing method, device, electronic equipment and storage medium.

Background technique

The Secure Sockets Protocol SSL (Secure Sockets Layer) is between the application layer and the transport layer. The application layer data is no longer directly passed to the transport layer, but to the SSL layer. The SSL layer controls the slave application. The data received by the layer is encrypted, which ensures the security of the communication between the client and the server and prevents it from being monitored and tampered with.

Generally, SSL proxy is used as an implementation method of the SSL layer. The implementation process of SSL proxy often involves a large number of encryption and decryption operations. These encryption and decryption operations consume a large amount of computing resources of the device CPU, causing the CPU load to be too high, thereby affecting the device. Other business processing performance.

Contents of the invention

The purpose of the embodiments of the present application is to provide a data processing method, device, electronic device and storage medium to improve the problem of the existing method that consumes a large amount of computing resources of the CPU and affects other business processing performance of the device.

In a first aspect, embodiments of the present application provide a data processing method applied to a network intermediate device, where the network intermediate device is deployed with an SSL proxy service. The method includes:

Receive the current message sent by the server or client through the message processing process of the network intermediate device, and when it is determined that the current message requires SSL proxy service, switch to the first-level coroutine of the SSL proxy service;

Preprocess the current message through the first-level coroutine, and switch to the second-level coroutine of the SSL proxy service after the preprocessing is completed;

The second-level coroutine performs relevant operations specified by the SSL protocol on the current message after preprocessing is completed. When the second-level coroutine performs the encryption and decryption operation of the data, it submits the encryption and decryption operation to Hardware acceleration device performs asynchronous processing.

In the above implementation process, this method can realize the code logic level by designing a first-level coroutine and a second-level coroutine under the SSL proxy service. These two-level coroutines are used to process the messages that require SSL proxy service respectively. The layering can effectively improve the processing performance of SSL proxy services, and the message processing process of the network intermediate device can receive messages from various services and process them accordingly, which allows the network intermediate device to process more services This can improve the performance of network intermediate devices in processing other services. Moreover, in this application solution, the encryption and decryption operations are sent to the hardware acceleration device for processing. This can fully utilize the performance of the hardware acceleration device, reduce the consumption of computing resources of the CPU in the network intermediate device, and further improve the CPU's efficiency in concurrent business processing. performance.

Optionally, after submitting the encryption and decryption operations to the hardware acceleration device for asynchronous processing through the secondary coroutine, the method further includes:

Save the execution scene of the second-level coroutine and switch back to the first-level coroutine;

Save the execution scene of the first-level coroutine and switch back to the message processing process;

The task processing results of the encryption and decryption operations are monitored through the message processing process.

In the above implementation process, by saving the execution scene of the first-level coroutine and the second-level coroutine, the execution scene can be restored and continued execution the next time it is called. This eliminates the need to restart the execution and improves processing efficiency.

Optionally, after switching back to the first-level coroutine, the method further includes:

Add the encryption and decryption operation tasks to the hardware execution task queue through the first-level coroutine;

The monitoring of the task processing results of the encryption and decryption operations through the message processing process includes:

The message processing process monitors the task processing results of the encryption and decryption operations in the hardware execution task queue.

In the above implementation process, since the hardware execution task queue can store tasks for multiple encryption and decryption operations, the message processing process can detect the task processing results of multiple encryption and decryption operations by monitoring the hardware execution task queue. , improve detection efficiency.

Optionally, the method also includes:

After the message processing process detects that the task processing of the encryption and decryption operation is completed, the message processing process restores the execution site of the first-level coroutine and switches to the first-level coroutine;

Restore the execution site of the second-level coroutine through the first-level coroutine, and switch to the second-level coroutine;

The results of the encryption and decryption operations are obtained from the hardware acceleration device through the secondary coroutine, and the related operations specified by the SSL protocol are continued to be performed.

In the above implementation process, after the secondary coroutine resumes execution, it obtains the results of the encryption and decryption operations from the hardware acceleration device and continues to perform related operations. In this way, the secondary coroutine and the hardware acceleration device can implement asynchronous processing of messages. Improved processing performance of SSL proxy service.

Optionally, the related operations specified by the SSL protocol are performed on the current message after the preprocessing is completed through the second-level coroutine, including:

The SSL handshake negotiation operation or corresponding message processing operation is performed on the current message after preprocessing is completed through the second-level coroutine. In this way, the layering of code logic can be achieved through two-level coroutines, and through the cooperation between the first-level coroutines and the second-level coroutines, the processing performance of SSL proxy service packets can be improved.

Optionally, when the current message is the first message that requires SSL proxy service, preprocessing the current message through the first-level coroutine includes:

The certificate obtained from the server is re-issued through the first-level coroutine, so that the current message is processed using the re-issued certificate. Simple preprocessing operations are performed on the messages through the first-level coroutine, so that specific message operations can be processed by the second-level coroutine. This can realize the layering of agent logic levels, give full play to the advantages of the coroutine, and improve SSL security. The processing performance of the proxy service.

Optionally, the network intermediate device is a firewall, and the hardware acceleration device is an accelerator card based on QAT technology.

In the second aspect, embodiments of the present application provide a data processing device that runs on a network intermediate device. The network intermediate device is deployed with an SSL proxy service. The device includes:

The coroutine switching module is used to receive the current message sent by the server or the client through the message processing process of the network intermediate device, and when it is determined that the current message requires SSL proxy service, switch to the SSL proxy service. The first-level coroutine;

A first-level coroutine processing module, used to preprocess the current message through the first-level coroutine, and switch to the second-level coroutine of the SSL proxy service after the preprocessing is completed;

The secondary coroutine processing module is used to perform related operations specified by the SSL protocol on the current message after preprocessing is completed through the secondary coroutine, wherein the secondary coroutine performs the encryption and decryption operation of the data. , submitting the encryption and decryption operations to the hardware acceleration device for asynchronous processing.

In a third aspect, embodiments of the present application provide an electronic device, including a processor and a memory. The memory stores computer-readable instructions. When the computer-readable instructions are executed by the processor, the operation is as described above. A first aspect provides steps in the method.

In a fourth aspect, embodiments of the present application provide a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps in the method provided in the above-mentioned first aspect are executed.

Additional features and advantages of the application will be set forth in the description which follows, and in part will be apparent from the description, or may be learned by practice of the embodiments of the application. The objectives and other advantages of the application may be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.

Description of drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required to be used in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present application, therefore This should not be regarded as limiting the scope. For those of ordinary skill in the art, other relevant drawings can be obtained based on these drawings without exerting creative efforts.

Figure 1 is a flow chart of a data processing method provided by an embodiment of the present application;

Figure 2 is an interaction flow chart between two-level coroutines provided by an embodiment of the present application;

Figure 3 is a structural block diagram of a data processing device provided by an embodiment of the present application;

FIG. 4 is a schematic structural diagram of an electronic device for executing a data processing method provided by an embodiment of the present application.

Detailed ways

The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of this application.

It should be noted that the terms "system" and "network" in the embodiments of this application can be used interchangeably. "Multiple" means two or more. In view of this, "plurality" may also be understood as "at least two" in the embodiments of this application. "And/or" describes the relationship between related objects, indicating that there can be three relationships. For example, A and/or B can mean: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the character "/", unless otherwise specified, generally indicates that the related objects are in an "or" relationship.

The embodiment of the present application provides a data processing method, which is applied to a network intermediate device. An SSL proxy service is deployed in the network intermediate device. A first-level coroutine and a second-level coroutine are designed under the SSL proxy service. These two-level coroutines are They are respectively used to process the messages that require SSL proxy service, which can realize the stratification of the code logic level and effectively improve the processing performance of SSL proxy service. The message processing process of the network intermediate device can receive various services. This allows the network intermediate device to process packets in more business scenarios, not just SSL proxy service packets. This can improve the performance of the network intermediate device in processing other services. Moreover, in this application solution, the encryption and decryption operations are sent to the hardware acceleration device for processing. This can fully utilize the performance of the hardware acceleration device, reduce the consumption of computing resources of the CPU in the network intermediate device, and further improve the CPU's efficiency in concurrent business processing. performance.

Please refer to Figure 1. Figure 1 is a flow chart of a data processing method provided by an embodiment of the present application. The method is applied to a network intermediate device and includes the following steps:

Step S110: Receive the current message sent by the server or client through the message processing process of the network intermediate device. When it is determined that the current message requires SSL proxy service, switch to the first-level coroutine of the SSL proxy service.

The network intermediate device in the embodiment of this application may refer to a gateway, a router, a firewall, and other devices. The network intermediate device may be used to process communication messages between the client and the server accordingly. In order to ensure the security of communication between the client and the server, an SSL proxy service is deployed in the network intermediate device, so that the network intermediate device can serve as an SSL proxy server to communicate with the client and server respectively.

For example, when the client communicates with the server, the client will send a Client Hello message and initiate an SSL connection. After receiving the message, the network intermediate device will parse and cache the message, and send its own Client Hello to the server. message, the server responds to the message and returns the Server Hello message and server certificate to the network intermediate device. At this time, the network intermediate device will act as a proxy client to complete the SSL handshake with the server, establish an SSL connection, and then the network intermediate device sends the message to the client. After the client completes the verification of the certificate with its own Server Hello message and the re-issued certificate, it completes the SSL handshake with the network intermediate device and establishes an SSL connection. After that, the messages transmitted between the client, the network intermediate device and the server are all encrypted messages. The network intermediate device can decrypt the messages received from the client or server, and can secure the decrypted messages. Content is inspected or audited before being re-encrypted and sent to the client or server.

Therefore, the network intermediate device will involve a large number of encryption and decryption operations during the SSL proxy process. These encryption and decryption operations will consume a lot of computing resources of the network intermediate device's CPU. However, the network intermediate device also involves the processing of other business packets, and also It requires consuming CPU resources. In order to reduce the occupation of CPU computing resources by encryption and decryption operations, the embodiment of this application proposes a two-level coroutine to process the messages of the SSL proxy service and send the encryption and decryption operations to the hardware acceleration device for processing. This solution eliminates the need for the CPU of the network intermediate device to perform encryption and decryption operations, and the network intermediate device can also have more resources to process more other business packets.

Among them, the packet processing process of the network intermediate device may refer to the main process of the network intermediate device, which can be used to process a variety of business packets, such as SSL proxy service packets, filter, intercept, and secure other business packets. Detection, etc. For messages from other services, the message processing process can process them directly, while for messages from the SSL proxy service, the messages can be submitted to the two-level coroutine of the SSL proxy service for processing. In this way, the message processing The process can still process other business packets synchronously and is not affected by the processing of SSL proxy service packets. This can improve the performance of network intermediate devices in processing concurrent services.

The first-level coroutine and the second-level coroutine can be created for the SSL proxy service. Using the coroutine to process the packets of the SSL proxy service can release the resource occupation of the packet processing process, so that the packet processing process can continue synchronously. Process other business messages.

Coroutine means that a function containing multiple instruction statements can no longer be executed from the first instruction statement of the multiple instruction statements every time, but from the last call in the process of calling the function. Execution continues from the paused position. Specifically, when the coroutine function is called for the first time, a coroutine context will be allocated on the stack to save the return address of the initiator, entry parameters, variables, and release of control rights to system resources. Location and other information, when the coroutine calls the function again, the calling environment will be restored based on the saved coroutine context, and then the function will continue to execute from the location where execution was last suspended. In this way, the coroutine mechanism can be used to easily protect and restore the execution site. In the embodiment of this application, a two-level coroutine mechanism is used to process the messages of the SSL proxy service. Each level of coroutine completes the corresponding message processing action. For example, the first-level coroutine can preprocess the message, and Specific message processing operations are placed in the second-level coroutine, so that rapid processing of messages can be achieved through the cooperation of the two-level coroutine.

In this step S110, the interactive messages between the client and the server will be forwarded through the network intermediate device. If the current message received by the message processing process of the network intermediate device requires SSL proxy service, it needs to be forwarded through When the SSL proxy service is processing, it switches to the first-level coroutine of the SSL proxy service for processing. Here, the network intermediate device can determine whether SSL proxy service is required based on some information carried in the current message, such as determining whether the current message is a Hello message sent by the client or the server, or whether it is a communication between the client or the server. Messages transmitted by SSL connections, etc.

Step S120: Preprocess the current message through the first-level coroutine, and switch to the second-level coroutine of the SSL proxy service after the processing is completed.

Among them, the preprocessing here can refer to some basic processing of the message. For example, if the current message is the first message that requires SSL proxy service, if the current message is the first time the client sends a Client Hello message, At this time, the preprocessing operation may include the first-level coroutine re-issuing the certificate obtained from the server (such as replacing the issuer and the key pair used in the certificate), so as to use the re-issued certificate to process the current message, The network intermediate device replies to the client with a Server Hello message and a re-issued server certificate for the current message, so that the subsequent client can use the key pair of the re-issued server certificate to encrypt the message.

In addition, when initially establishing an SSL connection, the preprocessing operation may also include some initialization of SSL, such as the protocol version used, the supported algorithm suite, etc. Preprocessing operations can also include operations such as parsing messages, such as parsing the extended fields required for the Client Hello message sent by the client (such as whether to support Application-Layer Protocol Negotiation (ALPN), server name indication (Server Name Indication, SNI), etc.). In addition, preprocessing operations can also include determining whether session reuse is needed, etc.

It is understandable that in actual applications, preprocessing operations can be set according to needs. These preprocessing operations can be considered as some preparations for the message, and the specific message processing operations can be handed over to the secondary coroutine. deal with.

Therefore, the first-level coroutine can use preprocessing operations to establish an SSL connection with the client on behalf of the server and the client with the server, and the context information of the SSL connection can be maintained in the first-level coroutine. After the client or server sends a message through the SSL connection, the context information can be restored in the first-level coroutine and the message can continue to be processed.

Step S130: Use the second-level coroutine to perform related operations specified by the SSL protocol on the current message after preprocessing.

After the first-level coroutine completes preprocessing of the current message, it switches to the second-level coroutine. At this time, the second-level coroutine can perform related operations specified by the SSL protocol on the current message, such as based on the negotiation status of the current SSL connection. , construct a reply message corresponding to the current message, and send it to the corresponding server or client, or generate or obtain the key of the corresponding algorithm suite according to the type of algorithm suite used in the negotiation process, etc. Or performing relevant operations specified by the SSL protocol also includes performing SSL handshake negotiation operations or corresponding message processing operations on the current message. The SSL handshake negotiation operation here means that the network intermediate device can perform SSL handshake negotiation with the other party on behalf of the client or server. , such as negotiating a key pair for encryption and decryption. The corresponding message processing operation may refer to the encryption and decryption operation of the message, the forwarding operation, or other operations involved in the SSL proxy service, such as decrypting the message obtained from one side, Transparently transmit the plaintext to the other side of the SSL proxy, or re-encrypt the plaintext before sending it out. You can also decide whether to send the plaintext information to other services through mirroring according to the policy configuration for security inspection.

Of course, when the secondary coroutine performs encryption and decryption operations on data, in order to reduce the computational burden on the network intermediate device CPU, the encryption and decryption operations are submitted to the hardware acceleration device for asynchronous processing.

The secondary coroutine here may refer to the Open Secure Sockets Layer Protocol (OpenSSL). Submitting encryption and decryption operations to the hardware acceleration device can be understood as using the interface function provided by OpenSSL to call the engine of the hardware acceleration device in the kernel mode. The engine drives the hardware acceleration device to process encryption and decryption operations. For example, when the second-level coroutine performs encryption and decryption operations, it generates corresponding asynchronous tasks and then directly enters the corresponding processing engine.

Among them, the hardware acceleration device can be an accelerator card based on Quick Assist Technology (QAT). In this case, the processing engine can be QAT Engine. The processing engine can call the QAT driver in the kernel mode to drive the hardware acceleration device to process the acceleration. Decryption operations are processed asynchronously. In this case, the hardware acceleration device can process encryption and decryption tasks asynchronously, and the two-level coroutine of the SSL proxy service can process other messages asynchronously, without the need for additional network intermediate devices to perform encryption and decryption operations, giving full play to the hardware acceleration device. processing capabilities to maximize the performance of network intermediate devices.

In the above implementation process, by designing the first-level coroutine and the second-level coroutine under the SSL proxy service, the two-level coroutines are used to process the messages that require SSL proxy service, which can realize the separation of the code logic level. layer, which can effectively improve the processing performance of SSL proxy services, and the message processing process of the network intermediate device can receive messages from various services and process them accordingly, which allows the network intermediate device to handle more business scenarios. packets, not just SSL proxy service packets, which can improve the performance of network intermediate devices in processing other services. Moreover, in this application solution, the encryption and decryption operations are sent to the hardware acceleration device for processing. This can fully utilize the performance of the hardware acceleration device, reduce the consumption of computing resources of the CPU in the network intermediate device, and further improve the CPU's efficiency in concurrent business processing. performance.

On the basis of the above embodiment, in order to enable the two-level coroutine and the hardware acceleration device to process asynchronously, after the encryption and decryption operations are submitted to the hardware acceleration device for asynchronous processing through the secondary coroutine, the second-level coroutine can also save its Execution site (that is, you can continue execution from the paused point after resuming the site next time), and switch back to the first-level coroutine, then save the execution site of the first-level coroutine, and switch back to the message processing process, and then you can use the message processing process to Monitor the task processing results of encryption and decryption operations.

That is to say, after submitting the encryption and decryption operations to the hardware acceleration device, the second-level coroutine finally switches back to the message processing process. At this time, the message processing process can monitor the task processing results of the encryption and decryption operations. For example, the message processing process can Create a monitoring task, mainly used to monitor the task processing results of this encryption and decryption operation. If the processing is completed, after the processing is completed, you can continue to obtain the encrypted and decrypted messages through the two-level coroutine. Subsequent network intermediate devices can continue to process the encrypted and decrypted packets, such as forwarding them to the client or server.

In the above implementation process, by saving the execution scene of the first-level coroutine and the second-level coroutine, the execution scene can be restored and continued execution the next time it is called. This eliminates the need to restart execution and improves processing efficiency.

On the basis of the above embodiment, since the SSL proxy service involves many encryption and decryption operations, many encryption and decryption operation tasks will be submitted to the hardware acceleration device. In order to improve the monitoring efficiency of the message processing process, the above-mentioned save level 2 At the execution site of the coroutine, after switching back to the first-level coroutine, the encryption and decryption operation tasks can also be added to the hardware execution task queue through the first-level coroutine, and the encryption and decryption operations in the task queue can be performed on the hardware through the message processing process. Monitor the results of task processing.

Here, the hardware execution task queue can be used to store each encryption and decryption operation task processed by the hardware acceleration device. The processing result of each encryption and decryption task by the hardware acceleration device can be marked in the hardware execution task queue. If the processing is not completed, it is marked as 0. , if the processing is completed, it will be marked as 1. Of course, the mark here can be flexibly set according to actual needs, as long as the message processing process can know the task processing results of the encryption and decryption operations from the hardware execution task queue. In this way, the message processing process can know whether the encryption and decryption operation is completed through the tag representing the task processing result corresponding to the encryption and decryption operation in the hardware execution task queue. If the processing is completed, it can be processed through the two-level coroutine of the SSL proxy service. Obtain the message after the corresponding encryption and decryption operation.

When the message processing process monitors the hardware execution task queue, it can read the task processing results of the encryption and decryption operations from the hardware execution task queue regularly or in real time.

Based on the above embodiment, after the message processing process detects that the task processing of the encryption and decryption operation is completed, the message processing process restores the execution site of the first-level coroutine, switches to the first-level coroutine, and then passes the first-level coroutine. The coroutine restores the execution site of the second-level coroutine and switches to the second-level coroutine. At this time, the results of the encryption and decryption operations can be obtained from the hardware acceleration device through the second-level coroutine and continue to perform related operations specified by the SSL protocol.

For example, when the message processing process detects that the encryption and decryption operation task processing is completed in the hardware execution task queue, it switches to the first-level coroutine. At this time, the first-level coroutine restores the previously saved execution scene and continues to execute according to the current logic, that is, Switch to the second-level coroutine. The second-level coroutine restores the previously saved execution scene. Since the second-level coroutine submits the encryption and decryption operations to the hardware acceleration device, it is equivalent to the second-level coroutine suspending the task of performing the encryption and decryption operations. Therefore, the secondary coroutine can resume performing encryption and decryption operations at this time. At this time, it can be understood that the secondary coroutine obtains the processing results of the encryption and decryption operations from the hardware acceleration device, such as the current message after encryption and decryption, and then can perform encryption and decryption. The current message after the current message continues to perform related operations specified by the SSL protocol, such as forwarding to the client or server through an SSL connection, that is, continuing to perform the operations on the message after encryption and decryption in the SSL protocol, such as continuing to perform the SSL handshake process or continuing to The message is subsequently processed, and the above process is repeated when the next hanging point is encountered. That is, when the next message requiring SSL proxy service is encountered, the same process is followed, or the relevant operations specified by the SSL protocol are performed here, including the above. The operation mentioned in step S130.

After the secondary coroutine obtains the results of the encryption and decryption tasks, it can end the previously created encryption and decryption tasks, that is, release the created encryption and decryption tasks. If there are multiple encryption and decryption tasks, each time the results of the encryption and decryption tasks are obtained, the encryption and decryption tasks will be released. The decryption task is released and switched back to the first-level coroutine. The first-level coroutine will also release the previously created asynchronous task and switch back to the message processing process.

In order to describe the process in the above embodiment more clearly, it can be understood in conjunction with the interactive process shown in Figure 2, where the following is the interpretation or function of each function in Figure 2:

User Space: user mode;

Kernel Space: kernel state;

dp: message processing process;

ssl_entry: SSL proxy entity;

ssl_entryasync: Asynchronous tasks in SSL proxy entities;

Libsg_ssl: library function that implements SSL protocol;

OpenSSL async: Asynchronous tasks in OpenSSL, that is, second-level coroutines;

Libsg_crypto: library functions that implement various cryptography algorithms;

Qat Engine: The engine library file provided by third-party Intel that supports the use of QAT can also be understood as the QAT engine;

QAT Driver: QAT driver;

app_proc: application layer processing;

ssl_async_schedule: SSL agent asynchronous processing scheduling function;

sslasync job: asynchronous task of SSL proxy;

ssl_fibre_start: SSL agent asynchronous task startup function (switched from the message processing process to the first-level coroutine of the SSL agent for processing);

SSL_connect: function to initiate SSL connection;

ssl_start_async_job: Asynchronous processing function in SSL (allocate OpenSSL async, record asynchronous processing status, etc.);

ASYNC_start_job: function to allocate asynchronous tasks in OpenSSL;

async_fibre_swapcontext: asynchronous task startup function in OpenSSL (switched from the first-level coroutine of the SSL agent to the second-level coroutine of OpenSSL);

ssl_op_intern: SSL internal asynchronous processing function;

Cpa Crypto OP: Call QAT interface operation;

ASYNC_PAUSE: The status returned when an asynchronous task is not completed;

ssl_fibre_switch: SSL agent asynchronous task switching function (switching between the message processing process and the first-level coroutine of the SSL agent);

ASYNC_resume_job: OpenSSL asynchronous task recovery operation;

ASYNC_FINISH: The status returned after asynchronous task processing is completed;

SSL_ERROR_WANT_ASYNC: The status returned by SSL when the asynchronous task is not completed;

SSL_ERROR_NONE: an SSL status code;

ssl_async_poll_hw: SSL proxy poll function (query QAT processing results).

The following is a brief introduction to the execution process in Figure 2: After the main message process dp receives the current message, if the current message requires SSL proxy service, it switches to the first-level coroutine of the SSL proxy service through the ssl_async_schedule function. The first-level coroutine preprocesses the current message, including creating a sslasync job (this task is used to preprocess the message), that is, creating an asynchronous task, initiating an SSL connection through the SSL_connect function, and switching to the second-level coroutine by calling Libsg_ssl. Processed in level coroutine.

When the secondary coroutine executes the encryption and decryption operation, it creates an asynchronous task (ASYNC_start_job). Here, the secondary coroutine can create an asynchronous task for each encryption and decryption operation and submit the encryption and decryption operation to the QAT engine. The QAT engine uses the interface The function calls the QAT driver to drive QAT to process encryption and decryption operations. Then the second-level coroutine saves the execution scene (that is, ASYNC_PAUSE), and then switches back to the first-level coroutine. The first-level coroutine saves the execution scene (that is, saves sslasync job), and finally switches to the message processing process, and the message processing process executes the hardware Task queue for monitoring (ssl_async_poll_hw).

Then the message processing process switches to the first-level coroutine, restores the execution site of the first-level coroutine (ssl_fibre_switch), then switches to the second-level coroutine, restores the execution site of the second-level coroutine (ASYNC_resume_job), and reads QAT through the QAT driver The result of the encryption and decryption operation on the message. At this time, the task execution of the encryption and decryption operation in the second-level coroutine ends (ASYNC_FINISH), that is, the asynchronous task created by the second-level coroutine obtains the corresponding encryption and decryption result in the second-level coroutine. Then it is released and switches to the first-level coroutine. The first-level coroutine finally switches to the message processing process and releases the asynchronous tasks created by the first-level coroutine (release sslasync job). That is, the asynchronous tasks of the first-level coroutine can be processed in the second-level coroutine. The level coroutine is released after performing relevant operations specified by the SSL protocol. The asynchronous task of the two-level coroutine is suspended after the second-level coroutine submits the encryption and decryption operation to QAT, and is resumed after the message processing process detects that the encryption and decryption operation task is completed.

Therefore, the embodiment of the present application submits the encryption and decryption operations to the hardware acceleration device for asynchronous processing, which can solve the problem of low performance caused by using CPU resources to perform encryption and decryption operations in a synchronous manner in the original method, and through the two-level coroutine Processing of SSL proxy service packets allows the packet processing process of the network intermediate device to simultaneously process other business packets and improve packet processing efficiency. The processing process of the two-level coroutine realizes the stratification of the code logic level, and can also effectively improve the processing performance of messages. Since the coroutine mechanism can save context information, the context information can be used to restore the execution site and continue execution during the next execution. Therefore, it can also solve the difficulty of state preservation and reentry during the SSL proxy service process. Moreover, coroutines are also more lightweight, thus avoiding the problem of frequent switching between kernel mode and user mode when using processes and threads, which leads to a lot of switching time.

Please refer to FIG. 3 , which is a structural block diagram of a data processing device 200 provided by an embodiment of the present application. The device 200 may be a module, program segment or code on an electronic device (ie, a network intermediate device). It should be understood that the device 200 corresponds to the above-mentioned method embodiment in Figure 1 and can perform various steps involved in the method embodiment in Figure 1. For specific functions of the device 200, please refer to the above description. To avoid repetition, the detailed description is appropriately omitted here. .

Optionally, the device 200 includes:

The coroutine switching module 210 is used to receive the current message sent by the server or the client through the message processing process of the network intermediate device, and when it is determined that the current message requires SSL proxy service, switch to the SSL proxy. The first-level coroutine of the service;

The first-level coroutine processing module 220 is used to preprocess the current message through the first-level coroutine, and switch to the second-level coroutine of the SSL proxy service after the preprocessing is completed;

The secondary coroutine processing module 230 is used to perform related operations specified by the SSL protocol on the current message after preprocessing is completed through the secondary coroutine, wherein the secondary coroutine performs encryption and decryption operations on the data. When, the encryption and decryption operations are submitted to the hardware acceleration device for asynchronous processing.

Optionally, the device 200 also includes:

A monitoring module is used to save the execution site of the second-level coroutine and switch back to the first-level coroutine; to save the execution site of the first-level coroutine and switch back to the message processing process; through the The message processing process monitors the task processing results of the encryption and decryption operations.

Optionally, the monitoring module is also configured to add the task of encryption and decryption operations to the hardware execution task queue through the first-level coroutine; and add the task to the hardware execution task queue through the message processing process. The task processing results of the encryption and decryption operations are monitored.

Optionally, the device 200 also includes:

A result acquisition module, configured to restore the execution site of the first-level coroutine through the message processing process and switch to the first-level coroutine after the message processing process detects that the task processing of the encryption and decryption operation is completed. level coroutine; restore the execution site of the level two coroutine through the level one coroutine, and switch to the level two coroutine; obtain the added value from the hardware acceleration device through the level two coroutine Decrypt the results of the operation and continue to perform related operations specified by the SSL protocol.

Optionally, the second-level coroutine processing module 230 is configured to perform an SSL handshake negotiation operation or corresponding message processing operation on the current message after preprocessing is completed through the second-level coroutine.

Optionally, when the current message is the first message that requires SSL proxy service, the first-level coroutine processing module 220 is used to obtain the certificate from the server through the first-level coroutine. Re-issuance is performed to process the current message using the re-issued certificate.

It should be noted that those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process of the above-described device can be referred to the corresponding process in the foregoing method embodiment, and will not be repeated here.

Please refer to Figure 4. Figure 4 is a schematic structural diagram of an electronic device for executing a data processing method provided by an embodiment of the present application. The electronic device may include: at least one processor 310, such as a CPU, and at least one communication interface 320. , at least one memory 330 and at least one communication bus 340. Among them, the communication bus 340 is used to realize direct connection communication between these components. Among them, the communication interface 320 of the device in the embodiment of this application is used to communicate signaling or data with other node devices. The memory 330 may be a high-speed RAM memory or a non-volatile memory (non-volatile memory), such as at least one disk memory. The memory 330 may optionally be at least one storage device located remotely from the aforementioned processor. Computer-readable instructions are stored in the memory 330. When the computer-readable instructions are executed by the processor 310, the electronic device performs the method process shown in FIG. 1 above.

It can be understood that the structure shown in FIG. 4 is only illustrative, and the electronic device may also include more or fewer components than shown in FIG. 4 , or have a different configuration than that shown in FIG. 4 . Each component shown in Figure 4 can be implemented in hardware, software, or a combination thereof.

Embodiments of the present application provide a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the method process executed by the electronic device in the method embodiment shown in Figure 1 is executed.

This embodiment discloses a computer program product. The computer program product includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer The methods provided by the above method embodiments can be executed, for example, including: receiving the current message sent by the server or the client through the message processing process of the network intermediate device, and determining that the current message requires SSL proxy service. When, switch to the first-level coroutine of the SSL proxy service; preprocess the current message through the first-level coroutine, and switch to the second-level coroutine of the SSL proxy service after the preprocessing is completed. ; Use the second-level coroutine to perform related operations specified by the SSL protocol on the current message after preprocessing is completed, wherein the second-level coroutine submits the encryption and decryption operation when performing the encryption and decryption operation of the data. Perform asynchronous processing for hardware acceleration devices.

To sum up, embodiments of the present application provide a data processing method, device, electronic device and storage medium. The method designs a first-level coroutine and a second-level coroutine under the SSL proxy service. The two-level coroutine uses For processing packets that require SSL proxy service, it can realize the layering of code logic level, which can effectively improve the processing performance of SSL proxy service, and the packet processing process of the network intermediate device can receive packets of various services. And process them accordingly, so that the network intermediate device can process packets in more business scenarios, not just SSL proxy service packets, which can improve the performance of the network intermediate device in processing other services. Moreover, in this application solution, the encryption and decryption operations are sent to the hardware acceleration device for processing. This can fully utilize the performance of the hardware acceleration device, reduce the consumption of computing resources of the CPU in the network intermediate device, and further improve the CPU's efficiency in concurrent business processing. performance.

In the embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or can be integrated into another system, or some features can be ignored, or not implemented. On the other hand, the coupling or direct coupling or communication connection between each other shown or discussed may be through some communication interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical, mechanical or other forms.

In addition, units described as separate components may or may not be physically separated, and components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

Furthermore, each functional module in each embodiment of the present application can be integrated together to form an independent part, each module can exist alone, or two or more modules can be integrated to form an independent part.

In this document, relational terms such as first, second, etc. are used only to distinguish one entity or operation from another entity or operation and do not necessarily require or imply the existence of any such entity or operation between these entities or operations. Actual relationship or sequence.

The above descriptions are only examples of the present application and are not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various modifications and changes. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of this application shall be included in the protection scope of this application.

Claims

A data processing method, characterized in that it is applied to a network intermediate device, and the network intermediate device is deployed with an SSL proxy service. The method includes:

Receive the current message sent by the server or client through the message processing process of the network intermediate device, and when it is determined that the current message requires SSL proxy service, switch to the first-level coroutine of the SSL proxy service;

Preprocess the current message through the first-level coroutine, and switch to the second-level coroutine of the SSL proxy service after the preprocessing is completed;

The second-level coroutine performs relevant operations specified by the SSL protocol on the current message after preprocessing is completed. When the second-level coroutine performs the encryption and decryption operation of the data, it submits the encryption and decryption operation to Hardware acceleration device performs asynchronous processing.
The method according to claim 1, characterized in that, after submitting the encryption and decryption operations to a hardware acceleration device for asynchronous processing through the secondary coroutine, the method further includes:

Save the execution scene of the second-level coroutine and switch back to the first-level coroutine;

Save the execution scene of the first-level coroutine and switch back to the message processing process;

The task processing results of the encryption and decryption operations are monitored through the message processing process.
The method according to claim 2, characterized in that after switching back to the first-level coroutine, it further includes:

Add the encryption and decryption operation tasks to the hardware execution task queue through the first-level coroutine;

The monitoring of the task processing results of the encryption and decryption operations through the message processing process includes:

The message processing process monitors the task processing results of the encryption and decryption operations in the hardware execution task queue.
The method of claim 2, further comprising:

After the message processing process detects that the task processing of the encryption and decryption operation is completed, the message processing process restores the execution site of the first-level coroutine and switches to the first-level coroutine;

Restore the execution site of the second-level coroutine through the first-level coroutine, and switch to the second-level coroutine;

The results of the encryption and decryption operations are obtained from the hardware acceleration device through the secondary coroutine, and the related operations specified by the SSL protocol are continued to be performed.
The method according to claim 1, characterized in that the related operations specified by the SSL protocol are performed on the current message after preprocessing is completed through the secondary coroutine, including:

The SSL handshake negotiation operation or corresponding message processing operation is performed on the current message after preprocessing is completed through the second-level coroutine.
The method according to claim 1, characterized in that when the current message is the first message that requires SSL proxy service, the current message is preprocessed through the first-level coroutine, include:

The certificate obtained from the server is re-issued through the first-level coroutine, so that the current message is processed using the re-issued certificate.
The method according to any one of claims 1 to 6, characterized in that the network intermediate device is a firewall, and the hardware acceleration device is an accelerator card based on QAT technology.
A data processing device, characterized in that it runs on a network intermediate device, and the network intermediate device is deployed with an SSL proxy service. The device includes:

The coroutine switching module is used to receive the current message sent by the server or the client through the message processing process of the network intermediate device, and when it is determined that the current message requires SSL proxy service, switch to the SSL proxy service. The first-level coroutine;

A first-level coroutine processing module, used to preprocess the current message through the first-level coroutine, and switch to the second-level coroutine of the SSL proxy service after the preprocessing is completed;

The secondary coroutine processing module is used to perform related operations specified by the SSL protocol on the current message after preprocessing is completed through the secondary coroutine, wherein the secondary coroutine performs the encryption and decryption operation of the data. , submitting the encryption and decryption operations to the hardware acceleration device for asynchronous processing.
An electronic device, characterized in that it includes a processor and a memory, and the memory stores computer-readable instructions. When the computer-readable instructions are executed by the processor, any of claims 1-7 is executed. The method described in 1.
A computer-readable storage medium on which a computer program is stored, characterized in that when the computer program is executed by a processor, the method according to any one of claims 1-7 is executed.