CN115190175B - Connection processing method, system, electronic device, server and readable storage medium - Google Patents

Abstract

The application discloses a connection processing method, a system, electronic equipment, a server and a readable storage medium, and relates to the field of servers; storing the client data into a preset storage space corresponding to the TCP connection in the DDR, and judging whether the client data stored in the preset storage space meets TLS processing conditions or not; if yes, performing TLS calculation processing on all the client data stored in the preset storage space, and sending the processed client data to a server; and when receiving the server data fed back by the server, performing TLS calculation processing on the server data, and sending the processed server data packet to the client. The method and the device can reduce design complexity, avoid a large number of broken packet processing, state storage and readback, and simultaneously release CPU resources, thereby ensuring the performance of the server.

Description

Connection processing method, system, electronic device, server and readable storage medium

technical field

The present application relates to the server field, in particular to a connection processing method, system, electronic equipment, server and readable storage medium.

Background technique

HTTPS (Hyper Text Transfer Protocol over SecureSocket Layer, Hypertext Transfer Security Protocol) protocol is constructed by HTTP plus TLS (Transport Layer Security, Transport Layer Security)/SSL (SecureSocket Layer, Secure Socket Layer) protocol, which can be encrypted The network protocol of transmission and identity authentication mainly completes the encryption of Internet data transmission through digital certificates, encryption algorithms, asymmetric keys and other technologies to realize the security protection of Internet transmission. Traditionally, the protocol runs on the CPU side. After testing, it takes about 436 milliseconds to establish a Https connection, of which the SSL part takes 322 milliseconds. Frequent rebuilding of SSL sessions will take up too much CPU (Central Processing Unit, central processing unit) resources, affecting server performance.

Therefore, how to provide a solution to the above technical problems is a problem that those skilled in the art need to solve at present.

Contents of the invention

The purpose of this application is to provide a connection processing method, system, electronic equipment, server and readable storage medium, which can reduce design complexity, avoid a large number of broken packet processing, state storage and readback, and release CPU resources at the same time, thereby ensuring server performance.

In order to solve the above technical problems, the present application provides a connection processing method, which is applied to a processing device, and the processing device is independent of the CPU. The connection processing method includes:

Analyze the received TCP connection sent by the client to obtain the client data;

storing the client data in a preset storage space corresponding to the TCP connection in the DDR, and judging whether the client data stored in the preset storage space meets the TLS processing conditions;

If so, perform TLS calculation processing on all the client data stored in the preset storage space, and send the processed client data to the server;

When the server data fed back by the server is received, the TLS calculation process is performed on the server data, and the processed server data packet is sent to the client.

Optionally, before storing the client data in the preset storage space corresponding to the TCP connection in the DDR, the connection processing method includes:

Obtain the writable address corresponding to the TCP connection from the preset address list;

The process of storing the client data in the preset storage space corresponding to the TCP connection in the DDR includes:

The client data is stored in a preset storage space in the DDR according to the writable address.

Optionally, after the client data is stored in the preset storage space in the DDR according to the writable address, the connection processing method further includes:

Updating the writable address of the TCP connection in the preset address list, so as to execute a new write operation corresponding to the TCP connection based on the updated writable address.

Optionally, the process of judging whether the client data stored in the preset storage space meets the TLS processing conditions includes:

judging whether the client data stored in the preset storage space constitutes a complete TLS package;

If not, determine that the client data stored in the preset storage space does not meet the TLS processing conditions;

If so, judging whether the TLS packet satisfies the preset state jump condition;

If so, determine that the client data stored in the preset storage space meets the TLS processing conditions;

If not, it is determined that the client data stored in the preset storage space does not satisfy the TLS processing condition.

Optionally, the connection processing method also includes:

When it is determined that the client data stored in the preset storage space does not constitute a complete TLS package, record TLS breakpoint information;

Wherein, the TLS breakpoint information includes the connection number, total length and remaining unreceived length of the TCP connection.

Optionally, the connection processing method also includes:

When it is determined that the client data stored in the preset storage space constitutes a complete TLS packet, record the TLS frame type and length corresponding to the TLS packet.

Optionally, the connection processing method also includes:

When it is determined that the client data stored in the preset storage space satisfies the TLS processing condition, record the TCP connection number corresponding to the TLS packet and the operation type of the pending operation;

The process of performing TLS calculation processing on all the client data stored in the preset storage space includes:

determining a readable address from the preset address list according to the TCP connection number corresponding to the TLS packet;

Reading the client data from the preset storage space according to the readable address, and performing TLS calculation processing on the read client data based on the operation type of the operation to be processed.

Optionally, after reading the client data from the preset storage space according to the readable address, the connection processing method further includes:

updating the readable address of the TCP connection in the preset address list.

Optionally, the process of parsing the received TCP connection sent by the client to obtain the client data includes:

Analyzing the TLP frame in the TCP connection sent by the client, discarding the frame header of the TLP frame, and obtaining the client data.

Optionally, the process of performing TLS calculation and processing on all the client data stored in the preset storage space includes:

Perform encryption and decryption calculations and Hash operations on all the client data stored in the preset storage space;

Correspondingly, the process of performing the TLS calculation processing on the server data includes:

Encryption and decryption calculations and Hash operations are performed on the server data.

Optionally, the processing device is any one of FPGA, ASIC, microprocessor, single-chip microcomputer, CPLD, and DSP.

In order to solve the above technical problems, the present application also provides a connection processing system, which is applied to a processing device, and the processing device is independent of the CPU. The connection processing system includes:

The analysis module is used to analyze the received TCP connection sent by the client to obtain client data;

A storage module, configured to store the client data in a preset storage space corresponding to the TCP connection in the DDR, and determine whether the client data stored in the preset storage space meets the TLS processing conditions, and if so , triggering the first TLS calculation module;

The first TLS calculation module is configured to perform TLS calculation processing on all the client data stored in the preset storage space, and send the processed client data to the server;

The second TLS calculation module is used to perform the TLS calculation processing on the server data when receiving the server data fed back by the server, and trigger the encapsulation module;

The packet module is configured to send the processed data packet of the server to the client.

In order to solve the above technical problems, the present application also provides an electronic device, including:

memory for storing computer programs;

A processor configured to implement the steps of the connection processing method described in any one of the above when executing the computer program.

In order to solve the above technical problem, the present application further provides a server, including the electronic device as described above.

In order to solve the above technical problems, the present application also provides a readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the connection processing as described in any one of the above is realized method steps.

The present application provides a connection processing method, which is applied to a processing device, and the processing device is independent of the CPU. The connection processing method includes: analyzing the received TCP connection sent by the client to obtain client data; storing the client data Go to the preset storage space corresponding to the TCP connection in the DDR, and judge whether the client data stored in the preset storage space meets the TLS processing conditions; if so, perform TLS calculation processing on all client data stored in the preset storage space, Send the processed client data to the server; when receiving the server data fed back by the server, perform TLS calculation processing on the server data, and send the processed server data packet to the client.

It can be seen that in practical applications, the solution of this application is used to first store the received client data in the DDR, and when the stored client data meets the TLS processing conditions, that is, after all relevant TLS frames are in place, the DDR Calculations are performed on client data stored in the server, reducing design complexity and avoiding a large number of packet break processing, state storage and readback. At the same time, TLS-related calculations are performed by a processing device independent of the CPU, which releases CPU resources and ensures server performance.

The present application also provides a connection processing system, an electronic device, a server, and a readable storage medium, which have the same beneficial effect as the above connection processing device.

Description of drawings

In order to illustrate the embodiments of the present application more clearly, the following will briefly introduce the accompanying drawings used in the embodiments. Obviously, the accompanying drawings in the following description are only some embodiments of the present application. As far as people are concerned, other drawings can also be obtained based on these drawings on the premise of not paying creative work.

FIG. 1 is a flow chart of the steps of a connection processing method provided by the present application;

Fig. 2 is a kind of general architecture schematic diagram that realizes each function of processing device by FPGA provided by the present application;

Fig. 3 is the structural representation of a kind of tpre_pro module provided by the present application;

FIG. 4 is a schematic diagram of a state machine provided by the present application;

FIG. 5 is a schematic diagram of high-bandwidth processing provided by the present application;

FIG. 6 is a schematic structural diagram of a connection processing system provided by the present application.

Detailed ways

The core of this application is to provide a connection processing method, system, electronic equipment, server and readable storage medium, which can reduce design complexity, avoid a large number of broken packet processing, state storage and readback, and release CPU resources at the same time, thereby ensuring server performance.

In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments It is a part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the scope of protection of this application.

In order to facilitate understanding of a connection processing method provided in the present application, the following describes the processing device to which the connection processing method provided in the present application is applied. The processing device is independent of the CPU, so as to release CPU resources. Specifically, the processing device may be FPGA (Field Programmable Gate Array, Field Programmable Logic Gate Array), ASIC (Application Specific Integrated Circuit, Application Specific Integrated Circuit), microprocessor, single-chip microcomputer, CPLD (Complex Programmable Logic Device, complex programmable Any one of programming logic device) and DSP (Digital Signal Process, digital signal processing).

Please refer to FIG. 1. FIG. 1 is a flow chart of the steps of a connection processing method provided by the present application. The connection processing method includes:

S101: Analyze the received TCP connection sent by the client to obtain client data;

Specifically, the processing device includes a TOE (TCP Offload Engine, TCP offloading engine) module and a NIC, wherein the TOE module is used to connect to the TCP (Transmission Control Protocol, Transmission Control Protocol) sent by the client received by the NIC (network card). Perform analysis to obtain the Payload in the TCP packet (referring to the valid data carried by the TCP connection). It can be understood that the Payload is the client data in this step and is used to form a TLS packet.

As an optional embodiment, the process of parsing the received TCP connection sent by the client to obtain client data includes: parsing the TLP frame in the TCP connection sent by the client, discarding the frame header of the TLP frame , to obtain client data, thereby further reducing the difficulty of subsequent data processing.

S102: Store the client data in the preset storage space corresponding to the TCP connection in the DDR, and determine whether the client data stored in the preset storage space meets the TLS processing conditions, and if so, execute S103;

Specifically, after the client data is obtained by parsing, the application first stores the client data in DDR (Double Data Rate memory, double data rate) in the preset storage space corresponding to the TCP connection. It can be understood that each TCP connection has its own independent preset storage space in DDR. Determine whether the client data stored in the preset storage space meets the TLS processing conditions. The TLS processing conditions can be set according to actual needs. Considering that the complete data content of some TLS packets may span multiple TCP packets, the TLS processing conditions can include But not limited to the integrity of the TLS packet data content and/or the TLS packet meets the state machine adjustment conditions, etc., avoiding a large number of packet break processing, state storage and readback, while avoiding repeated DDR reading of the same data and parameters, releasing DDR bandwidth. The precious DDR bandwidth is reserved for the TLS calculation engine, and the present application does not specifically limit the TLS processing conditions here.

Wherein, whether a TLS packet is received can be judged according to the rules of the TLS protocol.

S103: Perform TLS calculation processing on all client data stored in the preset storage space, and send the processed client data to the server;

S104: When receiving the server data fed back by the server, perform TLS calculation processing on the server data, and send the processed server data packet to the client.

As an optional embodiment, the process of performing TLS calculation and processing on all client data stored in the preset storage space includes:

Perform encryption and decryption calculations and Hash operations on all client data stored in the preset storage space;

Correspondingly, the process of performing TLS calculation and processing on server data includes:

Perform encryption and decryption calculations and Hash operations on server data.

Specifically, perform TLS calculation processing on the client data stored in the preset storage space that meets the TLS processing conditions. It can be understood that, considering that different TCP connections correspond to different preset storage spaces, when performing TLS processing on client data that meets the TLS processing conditions, it may be performed on one or more preset storage spaces The client data is uniformly processed by TLS calculation, and the processed client data is sent to the server. The server will feed back the corresponding server data according to the client data. The TLS calculation process includes but not limited to decryption calculation and Hash (ha Greek) operations, etc. After receiving the server data returned by the server, perform TLS calculation processing on the server data, and send the processed server data packet to the client.

It can be seen that in this embodiment, the received client data is first stored in the DDR, and when the stored client data meets the TLS processing conditions, that is, after all relevant TLS frames have arrived, the client data stored in the DDR is Perform calculations to reduce design complexity and avoid a large number of packet break processing, state storage and readback. At the same time, TLS-related calculations are performed by a processing device independent of the CPU, which releases CPU resources and ensures server performance.

On the basis of above-mentioned embodiment:

As an optional embodiment, before storing the client data in the preset storage space corresponding to the TCP connection in the DDR, the connection processing method includes:

Obtain the writable address corresponding to the TCP connection from the preset address list;

The process of storing client data into the preset storage space corresponding to the TCP connection in DDR includes:

Store client data to the preset storage space in DDR according to writable addresses.

As an optional embodiment, after the client data is stored in the preset storage space in the DDR according to the writable address, the connection processing method further includes:

The writable address of the TCP connection in the preset address list is updated, so as to perform a new write operation corresponding to the TCP connection based on the updated writable address.

Specifically, in this embodiment, each TCP connection corresponds to an address in the DDR, and the address of the DDR corresponding to each TCP connection can be stored in the preset address list Addr_table. The connection number determines the corresponding writable address from the preset address list, and then writes the client data Payload of the TCP connection into a certain preset storage space in the DDR from the writable address. After the write operation is completed, update the writable address of the TCP connection in the Addr_table, and the next write operation of the TCP connection will be written from the updated address. This application supports a large number of TCP connections under the condition that the logical resources remain unchanged, and the number of supported TCP connections is only limited by the DDR space.

As an optional embodiment, the process of judging whether the client data stored in the preset storage space meets the TLS processing conditions includes:

Determine whether the client data stored in the preset storage space constitutes a complete TLS package;

If not, it is determined that the client data stored in the preset storage space does not meet the TLS processing conditions;

If so, determine whether the TLS packet meets the preset state jump condition;

If yes, determine that the client data stored in the preset storage space meets the TLS processing conditions;

If not, it is determined that the client data stored in the preset storage space does not meet the TLS processing conditions. As an optional embodiment, the connection processing method further includes:

When it is determined that the client data stored in the preset storage space does not constitute a complete TLS package, record the TLS breakpoint information;

Wherein, the TLS breakpoint information includes the connection number, the total length and the remaining unreceived length of the TCP connection.

As an optional embodiment, the connection processing method further includes:

When it is determined that the client data stored in the preset storage space constitutes a complete TLS packet, record the TLS frame type and length corresponding to the TLS packet.

As an optional embodiment, the connection processing method further includes:

When it is determined that the client data stored in the preset storage space meets the TLS processing conditions, record the TCP connection number corresponding to the TLS packet and the operation type of the pending operation;

The process of performing TLS calculation and processing on all client data stored in the preset storage space includes:

Determine the readable address from the preset address list according to the TCP connection number corresponding to the TLS packet;

Read client data from the preset storage space according to the readable address, and perform TLS calculation processing on the read client data based on the operation type of the pending operation.

As an optional embodiment, after reading the client data from the preset storage space according to the readable address, the connection processing method further includes:

Update the readable address of the TCP connection in the default address list.

Specifically, considering that the data content of a complete TLS packet may span multiple TCP packets, it will also judge whether the TLS packet has been received according to the rules of the TLS protocol, that is, judge the client data stored in the preset storage space Whether it constitutes a complete TLS package. If it cannot form a complete TLS package, it means that the client data stored in the preset storage space does not meet the TLS processing conditions. At this time, in order to improve the reliability of subsequent packet interruption and resume transmission, as a In an optional embodiment, when it is determined that the client data stored in the preset storage space does not constitute a complete TLS package, the TLS breakpoint information is recorded; wherein, the TLS breakpoint information includes the connection number, the total length and the remaining unused TCP connection. Receive length.

Further, considering that it may be necessary to perform TLS calculation and processing on one or more TLS packets when performing TLS calculation and processing, if the client data stored in the preset storage space can constitute a complete TLS package, it should be judged Whether the complete TLS packet meets the preset state jump condition, that is, to judge whether the TLS packet is the TLS packet of the node that triggers the subsequent processing action, if not, only record the TLS frame type and length corresponding to the TLS packet, and do not perform other operations , if yes, record information such as the TCP connection number corresponding to the TLS packet and the operation type of the operation to be processed, so as to trigger the operation of performing TLS processing on the TLS packets that meet the TLS processing conditions stored in the preset storage space. Specifically, the process of performing TLS calculation and processing on all client data stored in the preset storage space includes: determining the readable address from the preset address list according to the TCP connection number corresponding to the TLS packet; It is assumed that the client data is read in the storage space, and TLS calculation processing is performed on the read client data based on the operation type of the pending operation.

Specifically, please refer to FIG. 2. FIG. 2 is a schematic diagram of the overall architecture of a processing device provided by the present application to realize the functions of the processing device. The FPGA includes: NIC, TOE module, tpre_pro module, rbpt module, rfifo module, tccal module, tscal module, tpack module and DMA (Direct Memory Access, direct memory access) module, the processing device performs data interaction with the client through the NIC, and performs data interaction with the Host end (ie, the server end) through the DMA.

First, the tpre_pro module is described. This module is used to parse the output of the TOE module, parse the TLP frame corresponding to the TCP connection, discard the TLP frame header, and write the parsed client data into the receiving buffer (Rbuff) of the DDR, and Update the read-write pointer rbpt, the tpre_pro module can also realize the function of continuous transmission after interrupted packets, splicing the same TLP frame into one piece, and after receiving the complete TLS frame, write the frame type and connection num into rfifo according to the configuration.

Further, each TCP connection has an independent Rbuff, and the rbpt module (Rbuff point table) is used to store the read and write pointers of the Rbuff of each TCP connection, which is implemented by sram, and the rfifo module is used to save the current received complete tls frame Type and length (there may be multiple complete TLS frames); tccal (TLS Client CALCU) module is used for client data encryption and decryption calculations, Hash operations, etc.; tscal (TLS Server CALCU) module is used for server-side data encryption and decryption calculations , Hash operation, etc.; the tpack (TLS DATA PACK) module is used to reply the data packet to the server. Among them, the design of the TLS frame type saved in rfifo is as follows:

1. Client Hello; 2. Client encrypted handshake message.

Please refer to FIG. 3 . FIG. 3 is a schematic diagram of a tpre_pro module provided by the present application. The tpre_pro module includes: Parse module, Shift_mem module, cmd_fifo module, WDDR_ctl module, Addr_table, RDDR_ctl module.

Specifically, the Parse module receives the Payload of the TCP packet parsed by the TOE module, and the Parse module will control the WDDR_ctl module to store the Payload in the writable address corresponding to the TCP connection in the DDR according to the TCP connection, and the WDDR_ctl module is performing the write operation When the Payload is written into DDR, the writable address of the TCP connection will be read from Addr_table. After the write operation is completed, the writable address of the TCP connection in Addr_table will be updated. The next write operation of the TCP connection Will write from this address.

Since the data content of a TLS packet may span multiple TCP packets, the Parse module will also judge whether the TLS packet has been received according to the rules of the TLS protocol. If the TLS packet has not been received, the Parse module will write the The breakpoint information of the TLS packet, the breakpoint information includes the TCP connection number, the total length, the remaining unreceived length, etc.; if the TLS packet has been received, but the packet does not belong to the node that triggers the subsequent processing action, Parse will not Perform other operations; if the TLS packet has been received, and the TLS packet belongs to the node that triggers the subsequent processing action, Parse will write the TCP connection number corresponding to the TLS packet to the cmd_fifo module, and the type of operation that needs to be processed later and other information; when cmd_fifo is not empty, and the tpre_pro module receives an external request, it will take out a piece of information from cmd_fifo, and RDDR_ctl will search for the readable address of the connection in Addr_table according to the TCP connection number in the information, and according to the address Read the data from DDR, and send it to the subsequent module for processing together with the information saved in cmd_fifo; at the same time, the RDDR_ctl module updates the readable address of the corresponding connection in Addr_table.

Specifically, the process of establishing a single Https connection is described, including:

0: Three-way handshake to establish a TCP connection

1: Client hello, providing the cipher suites supported by the client.

2: server hello, determine the encryption suite used;

3: Certificate, send the server certificate;

4: Server key exchange, server public key calculation and parameter exchange;

5: Cerfificate request, client certificate request;

6: Sever hello done, server hello ends;

7: Client Certificate, send the client certificate;

8: Client key exchange, client public key calculation and parameter exchange;

9: Client Certificate verify, perform signature verification on all previous interactions;

10: Client change cipher spec, the client will use symmetric encryption;

11: Client Encrypted Handshake Message The client performs hash and symmetric encryption on all previous interactions;

12: Sever change cipher spec, the server will use symmetric encryption;

13: Sever Encrypted Handshake Message, the server performs hash and symmetric encryption on all previous interactions;

14: Aplication Data, both ends start symmetric encryption to exchange application data.

Based on this, a state machine is set in this embodiment, and the schematic diagram of the state machine is shown in FIG.

0IDLE is the initial state, and enters the next state after receiving Client hello. 1client_hello The server receives the client hello and sends all the information to the FPGA. The FPGA performs information encryption and signature calculation through the module tscal, and then sends it to the tpack module and sends it to the TOE module. Here, the consecutively completed messages include: server hello, confirm to use cipher suite; Certificate, send server certificate; Server key exchange, server public key calculation and parameter exchange; Cerfificate request, client certificate request; The module is complete and all connections share that module. 2server_hello_done server hellodone, waiting for the client message. 3client_certificate, client key exchange, client certificate verify, client change cipher spec, client encrypted handshakemessage, after all the above messages are stored in Rbuff, the tpre_pro module will store the client encrypted handshakemessage type and message length in rfifo, and start the tccal module to receive Information is calculated, all calculations are completed, and the next state is entered, which is completed by an independent module, and all connections share this module. 4server change cipherspec, Encrypted Handshake Message (finihsend) starts tscal to calculate the symmetric encryption key, after the calculation is completed, send the server change cipher spec and Encrypted Handshake Message message to the TOE module, and enter the next state, which is completed by an independent module here, and all connections share the module. 5Application Data is symmetrically encrypted, and the application data is transmitted in this state. Enter idle after the connection is closed.

Further, all states will enter the exception processing state when encountering an exception, and enter idle after completing the exception processing, and all relevant messages will be discarded.

Referring to Figure 5, the tpre_pro module saves complete tls frames, and according to the above status description, all related tls frames are sent to the subsequent TLS calculation engine for processing, which greatly reduces design complexity and avoids a large number of interrupts. Packet processing, state storage, and readback all avoid repeated DDR reading of the same data and parameters, free up DDR bandwidth, and leave precious DDR bandwidth to the TLS computing engine. The TLS calculation engine reads the data and parameters required for calculation from DDR, and saves them in the internal cache (SRAM). Subsequent calculations use pipeline processing to meet line-speed processing requirements.

In summary, this application proposes an FPGA-based multi-connection high-bandwidth Https implementation mechanism, which can complete TCP packet break processing and strongly correlated TLS frame integration, simplify the design of finite state machines, and prevent the fragmentation of FPGA logic work. Under the condition of unchanged logic resources, it supports super-multiple connections, and the number of connections is only limited by the DDR space. It realizes the pipeline design of TLS computing engine and meets the requirements of line-speed design.

Please refer to FIG. 6. FIG. 6 is a schematic structural diagram of a connection processing system provided by the present application, which is applied to a processing device, and the processing device is independent of the CPU. The connection processing system includes:

Parsing module 1, for parsing the received TCP connection sent by the client to obtain client data;

The storage module 2 is used to store the client data in the preset storage space corresponding to the TCP connection in the DDR, and judge whether the client data stored in the preset storage space meets the TLS processing conditions, and if so, trigger the first TLS calculation module 3;

The first TLS calculation module 3 is used to perform TLS calculation processing on all client data stored in the preset storage space, and send the processed client data to the server;

The second TLS calculation module 4 is used to perform TLS calculation processing on the server data when receiving the server data fed back by the server, and trigger the encapsulation module 5;

The packet module 5 is configured to send the processed server data packet to the client.

It can be seen that in this embodiment, the received client data is first stored in the DDR, and when the stored client data meets the TLS processing conditions, that is, after all relevant TLS frames have arrived, the client data stored in the DDR is Perform calculations to reduce design complexity and avoid a large number of packet break processing, state storage and readback. At the same time, TLS-related calculations are performed by a processing device independent of the CPU, which releases CPU resources and ensures server performance.

As an optional embodiment, the connection processing system includes:

The first obtaining module is used to obtain the writable address corresponding to the TCP connection from the preset address list;

The process of storing client data into the preset storage space corresponding to the TCP connection in DDR includes:

Store client data to the preset storage space in DDR according to writable addresses.

As an optional embodiment, after the client data is stored in the preset storage space in the DDR according to the writable address, the connection processing system further includes:

The first update module is configured to update the writable address of the TCP connection in the preset address list, so as to perform a new write operation corresponding to the TCP connection based on the updated writable address.

As an optional embodiment, the process of judging whether the client data stored in the preset storage space meets the TLS processing conditions includes:

Determine whether the client data stored in the preset storage space constitutes a complete TLS package;

If not, it is determined that the client data stored in the preset storage space does not meet the TLS processing conditions;

If so, determine whether the TLS packet meets the preset state jump condition;

If yes, determine that the client data stored in the preset storage space meets the TLS processing conditions;

If not, it is determined that the client data stored in the preset storage space does not meet the TLS processing conditions.

As an optional embodiment, the connection processing system further includes:

The first recording module is used to record TLS breakpoint information when it is determined that the client data stored in the preset storage space does not constitute a complete TLS package;

Wherein, the TLS breakpoint information includes the connection number, the total length and the remaining unreceived length of the TCP connection.

As an optional embodiment, the connection processing system further includes:

The second recording module is configured to record the TLS frame type and length corresponding to the TLS packet when it is determined that the client data stored in the preset storage space constitutes a complete TLS packet.

As an optional embodiment, the connection processing system further includes:

The third recording module is used to record the TCP connection number corresponding to the TLS packet and the operation type of the operation to be processed when it is determined that the client data stored in the preset storage space meets the TLS processing conditions;

The process of performing TLS calculation and processing on all client data stored in the preset storage space includes:

Determine the readable address from the preset address list according to the TCP connection number corresponding to the TLS packet;

Read client data from the preset storage space according to the readable address, and perform TLS calculation processing on the read client data based on the operation type of the pending operation.

As an optional embodiment, the connection processing system further includes:

The second updating module is used for updating the readable address of the TCP connection in the preset address list.

As an optional embodiment, the process of parsing the received TCP connection sent by the client and obtaining the client data includes:

Analyze the TLP frame in the TCP connection sent by the client, discard the frame header of the TLP frame, and obtain the client data.

As an optional embodiment, the process of performing TLS calculation and processing on all client data stored in the preset storage space includes:

Perform encryption and decryption calculations and Hash operations on all client data stored in the preset storage space;

Correspondingly, the process of performing TLS calculation and processing on server data includes:

Perform encryption and decryption calculations and Hash operations on server data.

As an optional embodiment, the processing device is any one of FPGA, ASIC, microprocessor, single-chip microcomputer, CPLD, and DSP.

In order to solve the above technical problems, the present application also provides an electronic device, including:

memory for storing computer programs;

The processor is configured to implement the steps of the connection processing method described in any one of the above embodiments when executing the computer program.

Specifically, the memory includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and computer-readable instructions, and the internal memory provides an environment for the operation of the operating system and computer-readable instructions in the non-volatile storage medium. When the processor executes the computer program stored in the memory, the following steps can be implemented: analyze the received TCP connection sent by the client to obtain client data; store the client data in the preset storage corresponding to the TCP connection in the DDR Space, and judge whether the client data stored in the preset storage space meets the TLS processing conditions; if so, perform TLS calculation processing on all client data stored in the preset storage space, and send the processed client data to the server ; When receiving the server data fed back by the server, perform TLS calculation processing on the server data, and send the processed server data packet to the client.

It can be seen that in this embodiment, the received client data is first stored in the DDR, and when the stored client data meets the TLS processing conditions, that is, after all relevant TLS frames have arrived, the client data stored in the DDR is Perform calculations to reduce design complexity and avoid a large number of packet break processing, state storage and readback. At the same time, TLS-related calculations are performed by a processing device independent of the CPU, which releases CPU resources and ensures server performance.

As an optional embodiment, when the processor executes the computer subroutine stored in the memory, the following steps can be implemented: obtain the writable address corresponding to the TCP connection from the preset address list, Data is stored to the preset storage space in DDR.

As an optional embodiment, when the processor executes the computer subroutine stored in the memory, the following steps can be implemented: update the writable address of the TCP connection in the preset address list, so as to execute based on the updated writable address The new write operation corresponding to the TCP connection.

As an optional embodiment, when the processor executes the computer subroutine stored in the memory, the following steps can be implemented: determine whether the client data stored in the preset storage space constitutes a complete TLS package; if not, determine whether the preset The client data stored in the storage space does not meet the TLS processing conditions; if so, determine whether the TLS packet meets the preset state jump condition; if so, determine that the client data stored in the preset storage space meets the TLS processing conditions; if not, determine Client data stored in the preset storage space does not meet the TLS processing conditions.

As an optional embodiment, when the processor executes the computer subroutine stored in the memory, the following steps can be implemented: when it is determined that the client data stored in the preset storage space does not constitute a complete TLS packet, record the TLS breakpoint information , wherein the TLS breakpoint information includes the connection number, total length and remaining unreceived length of the TCP connection.

As an optional embodiment, when the processor executes the computer subroutine stored in the memory, the following steps can be implemented: When it is determined that the client data stored in the preset storage space constitutes a complete TLS packet, record the TLS packet corresponding to the TLS packet. Frame type and length.

As an optional embodiment, when the processor executes the computer subroutine stored in the memory, the following steps can be implemented: when it is determined that the client data stored in the preset storage space meets the TLS processing conditions, record the TCP connection corresponding to the TLS packet number and the operation type of the pending operation; determine the readable address from the preset address list according to the TCP connection number corresponding to the TLS packet; read the client data from the preset storage space according to the readable address, and based on the pending The operation type of the operation performs TLS calculation processing on the read client data.

As an optional embodiment, when the processor executes the computer subroutine stored in the memory, the following steps may be implemented: updating the readable address of the TCP connection in the preset address list.

As an optional embodiment, when the processor executes the computer subroutine stored in the memory, the following steps can be implemented: analyze the TLP frame in the TCP connection sent by the client, discard the frame header of the TLP frame, and obtain the data.

As an optional embodiment, when the processor executes the computer subroutine stored in the memory, the following steps can be implemented: performing encryption and decryption calculations and Hash operations on all client data stored in the preset storage space, and performing hash operations on the server data Perform encryption and decryption calculations and Hash operations.

In order to solve the above technical problems, the present application also provides a readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the connection processing method as described in any one of the above embodiments are implemented .

The readable storage medium may include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk, etc., which can store program codes. medium. A computer program is stored on the storage medium, and when the computer program is executed by the processor, the following steps are implemented: analyzing the received TCP connection sent by the client to obtain client data; storing the client data in the DDR corresponding to the TCP connection preset storage space, and determine whether the client data stored in the preset storage space meets the TLS processing conditions; if so, perform TLS calculation processing on all client data stored in the preset Send to the server; when receiving the server data fed back by the server, perform TLS calculation processing on the server data, and send the processed server data packet to the client.

It can be seen that in this embodiment, the received client data is first stored in the DDR, and when the stored client data meets the TLS processing conditions, that is, after all relevant TLS frames have arrived, the client data stored in the DDR is Perform calculations to reduce design complexity and avoid a large number of packet break processing, state storage and readback. At the same time, TLS-related calculations are performed by a processing device independent of the CPU, which releases CPU resources and ensures server performance.

As an optional embodiment, when the computer subroutine stored in the computer-readable storage medium is executed by the processor, the following steps can be specifically implemented: obtain the writable address corresponding to the TCP connection from the preset address list, and press the Write address to store client data to the preset storage space in DDR.

As an optional embodiment, when the computer subroutine stored in the computer-readable storage medium is executed by the processor, the following steps can be specifically implemented: updating the writable address of the TCP connection in the preset address list, so that based on the updated The writable address of the TCP connection corresponds to the new write operation.

As an optional embodiment, when the computer subroutine stored in the computer-readable storage medium is executed by the processor, the following steps may be specifically implemented: judging whether the client data stored in the preset storage space constitutes a complete TLS package; If not, determine that the client data stored in the preset storage space does not meet the TLS processing conditions; if so, determine whether the TLS packet meets the preset state jump condition; if so, determine that the client data stored in the preset storage space meets the TLS processing conditions condition; if not, it is determined that the client data stored in the preset storage space does not meet the TLS processing conditions.

As an optional embodiment, when the computer subroutine stored in the computer-readable storage medium is executed by the processor, the following steps can be specifically implemented: when it is determined that the client data stored in the preset storage space does not constitute a complete TLS packet , to record TLS breakpoint information, wherein the TLS breakpoint information includes the connection number, total length and remaining unreceived length of the TCP connection.

As an optional embodiment, when the computer subroutine stored in the computer-readable storage medium is executed by the processor, the following steps may be specifically implemented: when it is determined that the client data stored in the preset storage space constitutes a complete TLS package, Record the TLS frame type and length corresponding to the TLS packet.

As an optional embodiment, when the computer subroutine stored in the computer-readable storage medium is executed by the processor, the following steps can be specifically implemented: when it is determined that the client data stored in the preset storage space meets the TLS processing conditions, record The TCP connection number corresponding to the TLS packet and the operation type of the pending operation; determine the readable address from the preset address list according to the TCP connection number corresponding to the TLS packet; read the client from the preset storage space according to the readable address Data, and perform TLS calculation processing on the read client data based on the operation type of the operation to be processed.

As an optional embodiment, when the computer subprogram stored in the computer-readable storage medium is executed by the processor, the following steps may be specifically implemented: updating the readable address of the TCP connection in the preset address list.

As an optional embodiment, when the computer subroutine stored in the computer-readable storage medium is executed by the processor, the following steps can be specifically implemented: parsing the TLP frame in the TCP connection sent by the client, discarding the TLP frame Frame header, get client data.

As an optional embodiment, when the computer subroutine stored in the computer-readable storage medium is executed by the processor, the following steps can be implemented specifically: performing encryption and decryption calculation and hashing on all client data stored in the preset storage space Operation, encrypt and decrypt calculation and Hash operation on server data.

On the other hand, the present application also provides a server, including the electronic device as above.

For the introduction of a server provided in this application, please refer to the above-mentioned embodiments, and this application will not repeat it here.

A server provided by the present application has the same beneficial effects as the above connection processing method.

It should also be noted that in this specification, relative terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that these entities or operations There is no such actual relationship or order between the operations. Furthermore, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus comprising a set of elements includes not only those elements, but also includes elements not expressly listed. other elements of or also include elements inherent in such a process, method, article, or device. Without further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising said element.

The above description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the present application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the application. Therefore, the present application will not be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims (14)

1. A connection processing method, characterized in that it is applied to a processing device, and the processing device is independent of the CPU, and the connection processing method comprises: Analyze the received TCP connection sent by the client to obtain the client data; storing the client data in a preset storage space corresponding to the TCP connection in the DDR, and judging whether the client data stored in the preset storage space meets the TLS processing conditions; If so, perform TLS calculation processing on all the client data stored in the preset storage space, and send the processed client data to the server; When the server data fed back by the server is received, the TLS calculation process is performed on the server data, and the processed server data packet is sent to the client; The process of judging whether the client data stored in the preset storage space meets the TLS processing conditions includes: judging whether the client data stored in the preset storage space constitutes a complete TLS package; If not, determine that the client data stored in the preset storage space does not meet the TLS processing conditions; If so, judging whether the TLS packet satisfies the preset state jump condition; If so, determine that the client data stored in the preset storage space meets the TLS processing conditions; If not, it is determined that the client data stored in the preset storage space does not satisfy the TLS processing condition. 2. The connection processing method according to claim 1, characterized in that, before the client data is stored in the DDR in a preset storage space corresponding to the TCP connection, the connection processing method comprises: Obtain the writable address corresponding to the TCP connection from the preset address list; The process of storing the client data in the preset storage space corresponding to the TCP connection in the DDR includes: The client data is stored in a preset storage space in the DDR according to the writable address. 3. The connection processing method according to claim 2, characterized in that, after the client data is stored in the preset storage space in the DDR according to the writable address, the connection processing method further comprises: Updating the writable address of the TCP connection in the preset address list, so as to execute a new write operation corresponding to the TCP connection based on the updated writable address. 4. The connection processing method according to claim 1, further comprising: When it is determined that the client data stored in the preset storage space does not constitute a complete TLS package, record TLS breakpoint information; Wherein, the TLS breakpoint information includes the connection number, total length and remaining unreceived length of the TCP connection. 5. The connection processing method according to claim 1, further comprising: When it is determined that the client data stored in the preset storage space constitutes a complete TLS packet, record the TLS frame type and length corresponding to the TLS packet. 6. The connection processing method according to claim 1, further comprising: When it is determined that the client data stored in the preset storage space satisfies the TLS processing condition, record the TCP connection number corresponding to the TLS packet and the operation type of the pending operation; The process of performing TLS calculation processing on all the client data stored in the preset storage space includes: Determining a readable address from the preset address list according to the TCP connection number corresponding to the TLS packet; Reading the client data from the preset storage space according to the readable address, and performing TLS calculation processing on the read client data based on the operation type of the operation to be processed. 7. The connection processing method according to claim 6, characterized in that, after reading the client data from the preset storage space according to the readable address, the connection processing method further comprises: updating the readable address of the TCP connection in the preset address list. 8. The connection processing method according to claim 1, wherein the process of analyzing the received TCP connection sent by the client to obtain the client data comprises: Analyzing the TLP frame in the TCP connection sent by the client, discarding the frame header of the TLP frame, and obtaining the client data. 9. The connection processing method according to claim 1, wherein the process of performing TLS calculation and processing on all the client data stored in the preset storage space comprises: Perform encryption and decryption calculations and Hash operations on all the client data stored in the preset storage space; Correspondingly, the process of performing the TLS calculation processing on the server data includes: Encryption and decryption calculations and Hash operations are performed on the server data. 10. The connection processing method according to any one of claims 1-9, wherein the processing device is any one of FPGA, ASIC, microprocessor, single-chip microcomputer, CPLD, and DSP. 11. A connection processing system, characterized in that it is applied to a processing device, the processing device is independent of the CPU, and the connection processing system comprises: The analysis module is used to analyze the received TCP connection sent by the client to obtain client data; A storage module, configured to store the client data in a preset storage space corresponding to the TCP connection in the DDR, and determine whether the client data stored in the preset storage space meets the TLS processing conditions, and if so , triggering the first TLS calculation module; The first TLS calculation module is configured to perform TLS calculation processing on all the client data stored in the preset storage space, and send the processed client data to the server; The second TLS calculation module is used to perform the TLS calculation processing on the server data when receiving the server data fed back by the server, and trigger the encapsulation module; The packet module is configured to send the processed server data packet to the client; The process of judging whether the client data stored in the preset storage space meets the TLS processing conditions includes: judging whether the client data stored in the preset storage space constitutes a complete TLS package; If not, determine that the client data stored in the preset storage space does not meet the TLS processing conditions; If so, judging whether the TLS packet satisfies the preset state jump condition; If so, determine that the client data stored in the preset storage space meets the TLS processing conditions; If not, it is determined that the client data stored in the preset storage space does not satisfy the TLS processing condition. 12. An electronic device, characterized in that it comprises: memory for storing computer programs; A processor, configured to implement the steps of the connection processing method according to any one of claims 1-10 when executing the computer program. 13. A server, comprising the electronic device according to claim 12. 14. A readable storage medium, wherein a computer program is stored on the readable storage medium, and when the computer program is executed by a processor, the connection processing method according to any one of claims 1-10 is implemented A step of.

Images