Developers los ntawm Cloudflare hais txog kev ua haujlwm txhawm rau txhim kho kev ua haujlwm ntawm disk encryption hauv Linux kernel. Yog li ntawd, lawv tau npaj rau subsystem thiab Crypto API, uas ua rau nws muaj peev xwm ua tau ntau tshaj ob npaug ntawm kev nyeem ntawv thiab sau cov ntawv dhau los hauv kev sim hluavtaws, nrog rau ib nrab latency. Thaum kuaj ntawm cov khoom siv tiag tiag, encryption nyiaj siv ua haujlwm tau txo qis rau yuav luag qib pom thaum ua haujlwm nrog disk yam tsis muaj ntaub ntawv encryption.
Cloudflare siv dm-crypt los encrypt cov ntaub ntawv ntawm cov khoom siv khaws cia siv los cache cov ntsiab lus ntawm CDN. Dm-crypt ua haujlwm ntawm qib thaiv cov cuab yeej thiab encrypts sau I / O thov thiab decrypts nyeem cov lus thov, ua raws li txheej txheej ntawm cov cuab yeej thaiv thiab cov ntaub ntawv kaw lus tsav tsheb.
Txhawm rau ntsuas qhov ua tau zoo ntawm dm-crypt siv lub pob Peb ntsuas qhov ceev ntawm kev ua hauj lwm nrog encrypted thiab unencrypted partitions ntawm ib tug RAM disk nyob rau hauv RAM kom tshem tawm cov kev hloov pauv nyob rau hauv disk kev ua tau zoo thiab tsom rau cov code kev ua tau zoo. Rau unencrypted partitions, nyeem thiab sau kev ua tau zoo tseem nyob ntawm 1126 MB / s, tab sis qhov ceev tau txo qis thaum encryption tau qhib. nyob rau hauv 7 zaug thiab tus nqi rau 147 MB ββ/ s.
Thaum xub thawj, kev xav tsis thoob tau tshwm sim txog kev siv cov algorithms tsis muaj txiaj ntsig hauv lub kernel cryptosystem. Tab sis cov kev ntsuam xyuas siv qhov ceev tshaj plaws algorithm, aes-xts, nrog 256 encryption keys, uas nws ua tau zoo thaum khiav lub "cryptsetup benchmark" yog ntau tshaj li ob zaug raws li qhov tshwm sim tau thaum kuaj RAM disk. Kev sim nrog dm-crypt chij rau kev ua tau zoo tsis tau txais txiaj ntsig: thaum siv "--perf-same_cpu_crypt" chij, kev ua tau zoo txawm tias poob mus rau 136 MB / s, thiab thaum qhia txog "--perf-submit_from_crypt_cpus" chij nws nce nkaus xwb mus txog 166 MB/s.
Kev soj ntsuam tob dua ntawm kev ua haujlwm logic pom tias dm-crypt tsis yooj yim li nws zoo li - thaum daim ntawv thov tuaj txog ntawm FS tsav tsheb, dm-crypt tsis ua haujlwm tam sim ntawd, tab sis muab tso rau hauv kab "kcryptd", uas. tsis yog parsed tam sim ntawd, tab sis thaum yooj yim lub sij hawm. Los ntawm kab, qhov kev thov raug xa mus rau Linux Crypto API los ua encryption. Tab sis txij li thaum Crypto API siv tus qauv asynchronous tua, encryption tseem tsis tau ua tam sim ntawd, tab sis hla lwm kab. Tom qab encryption tiav lawm, dm-crypt yuav sim txheeb cov ntawv thov uas tseem tos siv cov ntoo tshawb nrhiav . Thaum kawg, cais cov xov xov dua, nrog rau qee qhov kev ncua sijhawm, khaws cov ntawv thov I / O thiab xa mus rau pawg thaiv cov cuab yeej.
Thaum nyeem ntawv, dm-crypt thawj zaug ntxiv qhov kev thov rau "kcryptd_io" kab kom tau txais cov ntaub ntawv los ntawm lub tsav. Tom qab qee lub sijhawm, cov ntaub ntawv yuav muaj thiab muab tso rau hauv kab "kcryptd" rau kev decryption.
Kcryptd xa ib daim ntawv thov mus rau Linux Crypto API, uas decrypts cov ntaub ntawv asynchronously. Kev thov tsis tas mus dhau ntawm txhua qhov kab, tab sis nyob rau hauv qhov xwm txheej phem tshaj plaws, kev thov sau ntawv xaus rau hauv cov kab mus txog 4 zaug, thiab nyeem ntawv thov txog li 3 zaug. Txhua qhov kev ntaus rau cov kab ua rau qeeb, uas yog qhov laj thawj tseem ceeb rau kev txo qis hauv dm-crypt kev ua haujlwm.
Kev siv cov kab yog vim qhov xav tau ua haujlwm hauv cov xwm txheej uas cuam tshuam tshwm sim. Nyob rau hauv 2005, thaum dm-crypt tus tam sim no queue-raws li kev khiav hauj lwm qauv tau siv, Crypto API tseem tsis tau asynchronous. Tom qab Crypto API tau pauv mus rau tus qauv asynchronous tua, qhov tseem ceeb ntawm kev tiv thaiv ob zaug pib siv. Cov Queues kuj tau qhia kom txuag tau noj cov ntsiav pawg, tab sis tom qab nws nce xyoo 2014, cov kev ua kom zoo no poob lawv qhov cuam tshuam. Ib qho kab ntxiv "kcryptd_io" tau qhia kom kov yeej lub fwj dej uas ua rau tos rau kev faib lub cim xeeb thaum muaj ntau qhov kev thov tuaj txog. Nyob rau hauv 2015, ib tug ntxiv sorting theem tau qhia, txij li thaum encryption thov ntawm multiprocessor systems yuav ua kom tiav ntawm kev txiav txim (es tsis txhob ntawm sequential nkag mus rau lub disk, kev nkag tau ua nyob rau hauv ib tug random order, thiab CFQ teem sij hawm tsis ua hauj lwm zoo). Tam sim no, thaum siv SSD drives, sorting tau poob nws lub ntsiab lus, thiab CFQ teem sijhawm tsis siv nyob rau hauv cov ntsiav.
Xav tias niaj hnub tsav tau dhau los sai dua thiab ntse dua, cov peev txheej faib khoom hauv Linux ntsiav tau raug kho dua tshiab thiab qee qhov subsystems tau raug kho dua tshiab, Cloudflare engineers dm-crypt muaj hom kev ua haujlwm tshiab uas tshem tawm kev siv cov kab tsis tsim nyog thiab hu asynchronous. Lub hom tau qhib los ntawm tus chij cais "force_inline" thiab coj dm-crypt rau hauv daim ntawv ntawm lub npe yooj yim uas encrypts thiab decrypts cov lus thov tuaj. Kev cuam tshuam nrog Crypto API tau ua kom zoo dua los ntawm kev xaiv encryption algorithms uas ua haujlwm hauv hom synchronous thiab tsis siv cov ntawv thov. Ua haujlwm synchronously nrog Crypto API muaj lub module uas tso cai rau koj siv FPU / AES-NI rau acceleration thiab ncaj qha xa mus rau encryption thiab decryption thov.
Raws li qhov tshwm sim, thaum kuaj RAM disk, nws muaj peev xwm ua tau ntau dua ob npaug ntawm qhov kev ua tau zoo ntawm dm-crypt - kev ua haujlwm tau nce los ntawm 294 MB / s (2 x 147 MB ββ/ s) mus rau 640 MB / s, uas yog ze heev. kev ua tau zoo ntawm kev zais zais zais (696 MB / s).
Thaum kuaj kev thauj khoom ntawm cov servers tiag tiag, qhov kev siv tshiab tau pom qhov ua tau zoo ze rau qhov kev teeb tsa ua haujlwm yam tsis muaj encryption, thiab ua rau kev nkag mus rau cov servers nrog Cloudflare cache tsis muaj kev cuam tshuam rau cov lus teb ceev. Nyob rau hauv lub neej yav tom ntej, Cloudflare npaj yuav hloov cov ntaub ntawv npaj mus rau lub ntsiab Linux ntsiav, tab sis ua ntej lawv yuav tsum tau rov ua haujlwm dua, vim lawv tau ua kom zoo rau ib qho kev thauj khoom tshwj xeeb thiab tsis npog txhua qhov chaw ntawm daim ntawv thov, piv txwv li, encryption qis. - lub zog embedded li.
Tau qhov twg los: opennet.ru