CN114978532B - Deep learning-oriented data stream type security processing acceleration method and device - Google Patents

Deep learning-oriented data stream type security processing acceleration method and device Download PDF

Info

Publication number
CN114978532B
CN114978532B CN202210512839.8A CN202210512839A CN114978532B CN 114978532 B CN114978532 B CN 114978532B CN 202210512839 A CN202210512839 A CN 202210512839A CN 114978532 B CN114978532 B CN 114978532B
Authority
CN
China
Prior art keywords
data
fpga chip
memory area
digital certificate
public key
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202210512839.8A
Other languages
Chinese (zh)
Other versions
CN114978532A (en
Inventor
请求不公布姓名
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shanghai Jianjiao Technology Service Co ltd
Original Assignee
Shanghai Jianjiao Technology Service Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shanghai Jianjiao Technology Service Co ltd filed Critical Shanghai Jianjiao Technology Service Co ltd
Priority to CN202210512839.8A priority Critical patent/CN114978532B/en
Publication of CN114978532A publication Critical patent/CN114978532A/en
Application granted granted Critical
Publication of CN114978532B publication Critical patent/CN114978532B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F13/00Interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units
    • G06F13/14Handling requests for interconnection or transfer
    • G06F13/20Handling requests for interconnection or transfer for access to input/output bus
    • G06F13/28Handling requests for interconnection or transfer for access to input/output bus using burst mode transfer, e.g. direct memory access DMA, cycle steal
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/04Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Storage Device Security (AREA)

Abstract

The invention relates to a data stream type safe processing acceleration method and device facing deep learning, wherein the method comprises the following steps: certificate generation: generating a built-in digital certificate by adopting an FPGA chip, and sending a public key of the certificate to a digital certificate issuing mechanism; data encryption step: accessing a designated memory area through a DMA controller, and encrypting data to be processed by adopting a received public key; and a data decryption step: and accessing the appointed memory area through the DMA controller, and decrypting the data to be processed by adopting a secret key with a built-in digital certificate. The invention can realize encryption and decryption processing of near-real-time data stream transmission so as to ensure the security of data information.

Description

Deep learning-oriented data stream type security processing acceleration method and device
Technical Field
The invention relates to the technical field of data stream processing, in particular to a data stream type safe processing acceleration method and device for deep learning.
Background
With the development of computer technology, the data security requirements on equipment are higher and higher. The data stream encryption equipment in the current market mainly adopts software encryption, and the method has low safety, is easy to break, and is not suitable for users with high safety requirements. Another method with higher security is to use a CPU to carry data in real time, but the speed of this method is generally low, and it is difficult to meet the requirement of high throughput of data required by deep learning.
Disclosure of Invention
The invention aims to solve the technical problem of providing a data stream type safe processing acceleration method and device for deep learning, which can realize encryption and decryption processing of near-real-time data stream transmission so as to ensure the safety of data information.
The technical scheme adopted for solving the technical problems is as follows: the data stream type safe processing acceleration method facing deep learning comprises the following steps:
certificate generation: generating a built-in digital certificate by adopting an FPGA chip, and sending a public key of the certificate to a digital certificate issuing mechanism;
data encryption step: accessing a designated memory area through a DMA controller, and encrypting data to be processed by adopting a received public key;
and a data decryption step: and accessing the appointed memory area through the DMA controller, and decrypting the data to be processed by adopting a secret key with a built-in digital certificate.
The certificate generation step specifically comprises the following steps:
reserving a memory space in the FPGA chip to form a random sampling area specific to the FPGA chip, and generating a key seed in the random sampling area;
generating a local digital certificate of the FPGA chip by adopting the key seed based on an asymmetric key algorithm;
and extracting the public key of the local digital certificate and sending the public key to a digital certificate issuing authority.
The data encryption step specifically comprises the following steps:
receiving data to be processed and a public key of a target node in the appointed memory region;
receiving a data encryption instruction;
accessing the appointed memory area through a DMA controller, acquiring the data to be processed and a public key of a target node, encrypting the data to be processed by using the public key of the target node, and writing the encrypted data into the appointed memory area;
and sending data encryption completion information.
Before the data encryption completion information is sent, the method further comprises the following steps: and signing the encrypted data by adopting a secret key of a built-in digital certificate.
The data decryption step specifically comprises the following steps:
receiving data to be processed in the appointed memory region;
receiving a data decryption instruction;
accessing the appointed memory area through a DMA controller, acquiring the data to be processed, decrypting the data to be processed by using a secret key of a built-in digital certificate, and writing the decrypted data into the appointed memory area;
and sending data decryption completion information.
Before receiving the data to be processed in the designated memory area, the method further comprises checking the data to be processed.
The technical scheme adopted for solving the technical problems is as follows: the data stream type safe processing accelerating device facing deep learning comprises:
the certificate generation module is used for generating a built-in digital certificate by adopting an FPGA chip and sending a public key of the certificate to a digital certificate issuing mechanism;
the data encryption module is used for accessing the appointed memory area through the DMA controller and encrypting the data to be processed by adopting the received public key;
and the data decryption module is used for accessing the appointed memory area through the DMA controller and decrypting the data to be processed by adopting a secret key of the built-in digital certificate.
The certificate generation module includes:
the key seed generation unit is used for reserving a memory space in the FPGA chip to form a random sampling area special for the FPGA chip and generating a key seed in the random sampling area;
the certificate generation unit is used for generating a local digital certificate of the FPGA chip by adopting the key seed based on an asymmetric key algorithm;
and the public key sending unit is used for extracting the public key of the local digital certificate and sending the public key to the digital certificate issuing mechanism.
The data encryption module includes:
the first receiving unit is used for receiving the data to be processed and the public key of the target node in the appointed memory area;
a second receiving unit that receives a data encryption instruction;
the encryption unit accesses the appointed memory area through the DMA controller, acquires the data to be processed and the public key of the target node, encrypts the data to be processed by using the public key of the target node, and writes the encrypted data into the appointed memory area;
and the first transmitting unit is used for transmitting the data encryption completion information.
The data decryption module includes:
a third receiving unit for receiving data to be processed in the specified memory area;
a fourth receiving unit that receives a data decryption instruction;
the decryption unit accesses the appointed memory area through the DMA controller, acquires the data to be processed, decrypts the data to be processed by using a secret key of a built-in digital certificate, and writes the decrypted data into the appointed memory area;
and a second transmitting unit that transmits the data decryption completion information.
Advantageous effects
Due to the adoption of the technical scheme, compared with the prior art, the invention has the following advantages and positive effects: the invention forms a random sampling area specific to each chip by reserving a memory area in the FPGA without initializing, and the random sampling area is used as a key seed required in the process of generating the digital certificate. According to the invention, communication access is performed between the DMA controller and the CPU and between the DMA controller and the dynamic memory based on the FPGA chip, so that the applicability and the data throughput performance of data encryption and decryption are improved to the greatest extent.
Drawings
Fig. 1 is a flow chart of a first embodiment of the present invention.
Detailed Description
The invention will be further illustrated with reference to specific examples. It is to be understood that these examples are illustrative of the present invention and are not intended to limit the scope of the present invention. Further, it is understood that various changes and modifications may be made by those skilled in the art after reading the teachings of the present invention, and such equivalents are intended to fall within the scope of the claims appended hereto.
The first embodiment of the present invention relates to a data stream type security processing acceleration method facing deep learning, as shown in fig. 1, including:
step 1, managing built-in digital certificates based on FPGA chips, namely a certificate generation step. The method specifically comprises the following steps: step 1a, reserving a memory space which is not less than 4KB in the FPGA chip, wherein the memory space is not subjected to pre-programming treatment, so that a random sampling area special for the FPGA chip is formed, and generating a key seed in the random sampling area; step 1b, generating a local digital certificate of the FPGA chip by adopting the key seed based on SM2 or other asymmetric key algorithms; step 1c, extracting the public key of the local digital certificate, sending the public key to a unified digital certificate issuing mechanism, and carrying out public key authentication issuing by the digital certificate issuing mechanism.
And 2, data encryption processing based on the FPGA chip, namely a digital encryption step. The method specifically comprises the following steps: step 2a, the CPU writes the source data needing to be encrypted and the public key of the target node receiving the data into a designated memory area; step 2, the CPU sends an instruction to the FPGA chip to inform the FPGA chip to encrypt data by using the appointed memory area; and 2c, accessing a designated memory area by the FPGA chip through the DMA controller, acquiring the public keys of the source data and the target node, encrypting the source data by using the public key of the target node, and writing the encrypted data into the designated memory area. Meanwhile, the secret key of the digital certificate built in the FPGA chip is used for signing the encrypted data so as to confirm the source of the data; and 2d, the FPGA chip sends information to the CPU to report that the corresponding data encryption processing is completed.
And step 3, data decryption processing based on the FPGA chip, namely a digital decryption step. The method specifically comprises the following steps: step 3a, the CPU firstly verifies the digital signature of the data to ensure the credibility of the data source, and when the data source is credible, the data needing to be decrypted is written into a designated memory area; step 3b, the CPU sends an instruction to the FPGA chip to inform the FPGA chip to use the appointed memory area to decrypt the data; step 3c, the FPGA chip accesses the appointed memory area through the DMA controller, acquires the data to be decrypted, decrypts the data by using a secret key of a built-in digital certificate of the FPGA chip, and writes the decrypted data into the appointed memory area; and 3d, the FPGA chip sends information to the CPU to report that the corresponding data decryption processing is completed.
A second embodiment of the present invention relates to a deep learning-oriented data stream type security processing acceleration device, including: the certificate generation module is used for generating a built-in digital certificate by adopting an FPGA chip and sending a public key of the certificate to a digital certificate issuing mechanism; the data encryption module is used for accessing the appointed memory area through the DMA controller and encrypting the data to be processed by adopting the received public key; and the data decryption module is used for accessing the appointed memory area through the DMA controller and decrypting the data to be processed by adopting a secret key of the built-in digital certificate.
The certificate generation module includes: the key seed generation unit is used for reserving a memory space in the FPGA chip to form a random sampling area special for the FPGA chip and generating a key seed in the random sampling area; the certificate generation unit is used for generating a local digital certificate of the FPGA chip by adopting the key seed based on an asymmetric key algorithm; and the public key sending unit is used for extracting the public key of the local digital certificate and sending the public key to the digital certificate issuing mechanism.
The data encryption module includes: the first receiving unit is used for receiving the data to be processed and the public key of the target node in the appointed memory area; a second receiving unit that receives a data encryption instruction; the encryption unit accesses the appointed memory area through the DMA controller, acquires the data to be processed and the public key of the target node, encrypts the data to be processed by using the public key of the target node, and writes the encrypted data into the appointed memory area; and the first transmitting unit is used for transmitting the data encryption completion information.
The data decryption module includes: a third receiving unit for receiving data to be processed in the specified memory area; a fourth receiving unit that receives a data decryption instruction; the decryption unit accesses the appointed memory area through the DMA controller, acquires the data to be processed, decrypts the data to be processed by using a secret key of a built-in digital certificate, and writes the decrypted data into the appointed memory area; and a second transmitting unit that transmits the data decryption completion information.
It is easy to find that the random sampling area specific to each chip is formed by reserving the memory area in the FPGA without initializing, and the random sampling area is used as a key seed required in the process of generating the digital certificate. According to the invention, communication access is performed between the DMA controller and the CPU and between the DMA controller and the dynamic memory based on the FPGA chip, so that the applicability and the data throughput performance of data encryption and decryption are improved to the greatest extent.

Claims (2)

1. The data stream type safe processing accelerating method facing deep learning is characterized by comprising the following steps:
certificate generation: generating a built-in digital certificate by adopting an FPGA chip, and sending a public key of the certificate to a digital certificate issuing mechanism; the method specifically comprises the following steps:
reserving a memory space in the FPGA chip to form a random sampling area specific to the FPGA chip, and generating a key seed in the random sampling area;
generating a built-in digital certificate of the FPGA chip by adopting the key seed based on an asymmetric key algorithm;
extracting a public key of the built-in digital certificate, and sending the public key to a digital certificate issuing mechanism, wherein the digital certificate issuing mechanism performs public key authentication issuing;
data encryption step: accessing a designated memory area through a DMA controller, and encrypting source data needing to be encrypted by adopting a public key of a target node; the method specifically comprises the following steps:
the CPU writes the source data needing encryption and the public key of the target node receiving the data into a designated memory area;
the CPU sends an instruction to the FPGA chip to inform the FPGA chip to encrypt data by using the appointed memory area;
the FPGA chip accesses the appointed memory area through the DMA controller, acquires the public keys of the source data and the target node, encrypts the source data by using the public key of the target node, writes the encrypted data into the appointed memory area, and signs the encrypted data by using a secret key of a digital certificate built in the FPGA chip;
the FPGA chip sends information to the CPU to report that the corresponding data encryption processing is completed;
and a data decryption step: accessing a designated memory area through a DMA controller, and decrypting data to be decrypted by adopting a secret key of a built-in digital certificate; the method specifically comprises the following steps:
the CPU checks the digital signature of the data to be decrypted, and when the source of the data to be decrypted is credible, the data to be decrypted is written into a designated memory area;
the CPU sends an instruction to the FPGA chip to inform the FPGA chip to use the appointed memory area to decrypt the data;
the FPGA chip accesses the appointed memory area through the DMA controller, acquires the data to be decrypted, decrypts the data by using a secret key of a built-in digital certificate of the FPGA chip, and writes the decrypted data into the appointed memory area;
the FPGA chip sends information to the CPU to report that the corresponding data decryption processing is completed.
2. The data stream type safe processing accelerating device facing deep learning is characterized by comprising:
the certificate generation module is used for generating a built-in digital certificate by adopting an FPGA chip and sending a public key of the certificate to a digital certificate issuing mechanism; the certificate generation module includes:
the key seed generation unit is used for reserving a memory space in the FPGA chip to form a random sampling area special for the FPGA chip and generating a key seed in the random sampling area;
the certificate generation unit is used for generating a built-in digital certificate of the FPGA chip by adopting the key seed based on an asymmetric key algorithm;
the public key sending unit is used for extracting the public key of the built-in digital certificate and sending the public key to the digital certificate issuing mechanism; wherein, the digital certificate issuing mechanism performs public key authentication issuing;
the data encryption module is used for accessing the appointed memory area through the DMA controller and encrypting the source data needing to be encrypted by adopting the public key of the target node; the method comprises the following steps:
the CPU writes the source data needing encryption and the public key of the target node receiving the data into a designated memory area;
the CPU sends an instruction to the FPGA chip to inform the FPGA chip to encrypt data by using the appointed memory area;
the FPGA chip accesses the appointed memory area through the DMA controller, acquires the public keys of the source data and the target node, encrypts the source data by using the public key of the target node, writes the encrypted data into the appointed memory area, and signs the encrypted data by using a secret key of a digital certificate built in the FPGA chip;
the FPGA chip sends information to the CPU to report that the corresponding data encryption processing is completed;
the data decryption module is used for accessing the appointed memory area through the DMA controller and decrypting the data needing to be decrypted by adopting a secret key of a built-in digital certificate, and specifically comprises the following steps:
the CPU checks the digital signature of the data to be decrypted, and when the source of the data to be decrypted is credible, the data to be decrypted is written into a designated memory area;
the CPU sends an instruction to the FPGA chip to inform the FPGA chip to use the appointed memory area to decrypt the data;
the FPGA chip accesses the appointed memory area through the DMA controller, acquires the data to be decrypted, decrypts the data by using a secret key of a built-in digital certificate of the FPGA chip, and writes the decrypted data into the appointed memory area;
the FPGA chip sends information to the CPU to report that the corresponding data decryption processing is completed.
CN202210512839.8A 2022-05-11 2022-05-11 Deep learning-oriented data stream type security processing acceleration method and device Active CN114978532B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202210512839.8A CN114978532B (en) 2022-05-11 2022-05-11 Deep learning-oriented data stream type security processing acceleration method and device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202210512839.8A CN114978532B (en) 2022-05-11 2022-05-11 Deep learning-oriented data stream type security processing acceleration method and device

Publications (2)

Publication Number Publication Date
CN114978532A CN114978532A (en) 2022-08-30
CN114978532B true CN114978532B (en) 2024-04-12

Family

ID=82982111

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202210512839.8A Active CN114978532B (en) 2022-05-11 2022-05-11 Deep learning-oriented data stream type security processing acceleration method and device

Country Status (1)

Country Link
CN (1) CN114978532B (en)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107908574A (en) * 2017-11-22 2018-04-13 深圳华中科技大学研究院 The method for security protection of solid-state disk data storage
CN110268675A (en) * 2017-02-07 2019-09-20 西门子股份公司 Method in programmable hardware security module and programmable hardware security module
CN110690963A (en) * 2019-09-25 2020-01-14 支付宝(杭州)信息技术有限公司 Key agreement method and device based on FPGA
CN112800451A (en) * 2021-02-24 2021-05-14 山东华芯半导体有限公司 Data dump device based on hardware physical isolation

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100031026A1 (en) * 2007-11-01 2010-02-04 Infineon Technologies North America Corp. Method and system for transferring information to a device

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110268675A (en) * 2017-02-07 2019-09-20 西门子股份公司 Method in programmable hardware security module and programmable hardware security module
CN107908574A (en) * 2017-11-22 2018-04-13 深圳华中科技大学研究院 The method for security protection of solid-state disk data storage
CN110690963A (en) * 2019-09-25 2020-01-14 支付宝(杭州)信息技术有限公司 Key agreement method and device based on FPGA
CN112800451A (en) * 2021-02-24 2021-05-14 山东华芯半导体有限公司 Data dump device based on hardware physical isolation

Also Published As

Publication number Publication date
CN114978532A (en) 2022-08-30

Similar Documents

Publication Publication Date Title
CN106789052B (en) Remote key issuing system based on quantum communication network and use method thereof
US8281132B2 (en) Method and apparatus for security over multiple interfaces
CN107005577B (en) Fingerprint data processing method and processing device
CN104253694A (en) Encrypting method for network data transmission
CN110868291B (en) Data encryption transmission method, device, system and storage medium
US20190012472A1 (en) Hierarchical bus encryption system
CN104270242A (en) Encryption and decryption device used for network data encryption transmission
CN112740615A (en) Multi-party computed key management
US11870904B2 (en) Method for encrypting and decrypting data across domains based on privacy computing
CN101539977B (en) Method for protecting computer software
US20230269078A1 (en) Key sharing method, key sharing system, authenticating device, authentication target device, recording medium, and authentication method
CN204180095U (en) A kind of ciphering and deciphering device for network data encryption transmission
CN105262586B (en) The method for distributing key and device of automobile burglar equipment
CN107911221B (en) Key management method for secure storage of solid-state disk data
US20090319791A1 (en) Electronic apparatus and copyright-protected chip
CN103605919A (en) Method and device for generating software authentication files and method and device for authenticating software
CN100464337C (en) Method and equipment for carrying out safety communication between USB device and host
CN114978532B (en) Deep learning-oriented data stream type security processing acceleration method and device
CN116962067A (en) Information encryption method, device and equipment
US10057054B2 (en) Method and system for remotely keyed encrypting/decrypting data with prior checking a token
CN114697113B (en) Multiparty privacy calculation method, device and system based on hardware accelerator card
CN101539978B (en) Software protection method based on space
CN115694922A (en) File transmission encryption method and equipment under domestic CPU and OS
CN101079698B (en) A file encryption method based on Linux operating system with CPK authentication
CN114244509A (en) Method for carrying out SM2 one-time pad bidirectional authentication unlocking by using mobile terminal

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant