CN111400700B - Encryption method, device, device and computer-readable storage medium of switch - Google Patents

Abstract

The invention discloses an encryption method, device, equipment and storage medium of a switch. The steps of the method include: after the hardware system of the switch is powered on, performing key authentication on the startup program for starting the hardware system, so as to start the operating system of the switch after the startup program passes the key authentication; after the operating system is started, a data packet is received by a switching chip in the switch, and the data packet is analyzed by an FPGA chip in the switch, and the parsed data is encrypted. The present invention realizes that after the hardware system is powered on and started, the operating system is started by performing key authentication on the startup program, receiving data packets through the switching chip, analyzing the data packets through the FPGA chip, and encrypting the parsed data, thereby preventing the switch program from being cracked violently and encrypting the switch data, thereby improving the security of the switch.

Description

Encryption method, device, device and computer-readable storage medium of switch

technical field

The present invention relates to the technical field of encryption, in particular to an encryption method, device, equipment and computer-readable storage medium of a switch.

Background technique

At present, Ethernet switches use a transparent and unified transmission control protocol. In the transmission control protocol, the program and data of the switch are open, without encryption and monitoring, which leads to the brute force cracking of the switch program and the leakage of switch data. It can be seen that the security of the current Ethernet switch is low.

Contents of the invention

The main purpose of the present invention is to provide an encryption method, device, equipment and storage medium of a switch, aiming at solving the technical problem of low security of the existing Ethernet switch.

In order to achieve the above object, the present invention provides an encryption method of a switch, the encryption method of the switch comprises the steps of:

After the hardware system of the switch is powered on and started, key authentication is performed on the startup program for starting the hardware system, so as to start the operating system of the switch after the startup program passes the key authentication;

After the operating system is started, the data packet is received by the switching chip in the switch, and the field programmable logic gate array FPGA chip in the switch is used to analyze the data packet, and the parsed data is encrypted.

Preferably, after the operating system is started, receiving data packets through the switch chip in the switch, and analyzing the data packets through the FPGA chip in the switch, and encrypting the parsed data includes:

After the operating system is started, a data packet sent by the first terminal device is received from the Ethernet data port of the switch through the switch chip in the switch;

The data packet is analyzed by the FPGA chip of the switch to obtain valid data in the data packet, and a preset encryption algorithm is used to encrypt the valid data.

Preferably, the FPGA chip of the switch parses the data packet to obtain valid data in the data packet, and the steps of encrypting the valid data using a preset encryption algorithm include:

The data packet is unpacked by the data packet format in the FPGA chip to obtain unpacked data;

Extracting the unpacked data according to the valid data field preset in the FPGA chip to obtain valid data;

The valid data is encrypted by using a preset encryption algorithm in the FPGA chip.

Preferably, after the hardware system of the switch is powered on and started, performing key authentication on the startup program for starting the hardware system, so that the step of starting the operating system of the switch after the startup program passes the key authentication includes:

After the hardware system of the switch is powered on and started, the startup program for starting the hardware system is read from the pre-programmed flash of the switch memory chip, wherein the startup program is a boot program;

The boot program is loaded into the internal SRAM of the switch to run to start the boot program;

After the boot program starts, read the key file in the external encryption chip on the switch PCB;

performing key authentication on the boot key file in the boot program through the key file, so as to start the operating system of the switch after the startup program passes the key authentication.

Preferably, the step of performing key authentication on the boot key file in the boot program through the key file to start the operating system of the switch after the startup program passes the key authentication includes:

Read the boot key file into the key file of the encryption chip to perform key verification, obtain the verification result of the key authentication, and verify whether the verification result is passed;

If it is verified that the check result is passed, start the operating system of the switch.

Preferably, after the hardware system of the switch is powered on and started, the key authentication is performed on the startup program for starting the hardware system, so that before the step of starting the operating system of the switch after the startup program passes the key authentication, it also includes:

Detect whether the boot program in the switch memory chip has been updated;

If it is detected that the boot program has been updated, power on and start the hardware system of the switch.

Preferably, after the operating system is started, the data packet is received by the switch chip in the switch, and the data packet is analyzed by the FPGA chip in the switch, and after the step of encrypting the parsed data, it also includes:

The encrypted data is repackaged according to the data packet format in the FPGA chip to obtain a packaged data packet;

Sending the encapsulated data packet to the second terminal device through the Ethernet data port of the switch, so that after the second terminal device receives the encapsulated data packet, it unpacks the encapsulated data packet, extracts the encrypted data, and decrypts the encrypted data to obtain valid data in the encapsulated data packet.

In addition, in order to achieve the above object, the present invention also provides an encryption device for a switch comprising:

An authentication module, configured to perform key authentication on the startup program for starting the hardware system after the hardware system of the switch is powered on, so as to start the operating system of the switch after the startup program passes the key authentication;

a receiving module, configured to receive data packets through the switch chip in the switch after the operating system is started;

An analysis module, configured to analyze the data packet through the FPGA chip in the switch;

The encryption module is used to encrypt the parsed data.

In addition, in order to achieve the above object, the present invention also provides an encryption device of a switch, the encryption device of the switch includes a memory, a processor, and an encryption program of the switch stored in the memory and run on the processor, when the encryption program of the switch is completed by the processor, the steps of the encryption method for the switch as described above are implemented.

In addition, to achieve the above object, the present invention also provides a computer-readable storage medium, on which an encryption program of a switch is stored, and when the encryption program of the switch is completed by a processor, the steps of the encryption method for the switch as described above are implemented.

After the hardware system is powered on and started, the present invention performs key authentication on the startup program of the hardware system to start the operating system, receives data packets through the switching chip, analyzes the data packets through the FPGA chip, and encrypts the parsed data. It can be seen that, in the encryption process of the switch, the present invention performs key authentication on the startup program after the hardware system is powered on and starts, and the operating system is started only after the startup program passes the key authentication, thus preventing the switch program from being cracked by violence.

Description of drawings

Fig. 1 is a schematic flow chart of the first embodiment of the encryption method of the switch of the present invention;

Fig. 2 is a better structural schematic diagram of the encryption device of the switch of the present invention;

Fig. 3 is a schematic structural diagram of the hardware operating environment involved in the solution of the embodiment of the present invention.

The realization of the purpose of the present invention, functional characteristics and advantages will be further described in conjunction with the embodiments and with reference to the accompanying drawings.

Detailed ways

It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention.

The present invention provides an encryption method for a switch. Referring to FIG. 1 , FIG. 1 is a schematic flowchart of a first embodiment of the encryption method for a switch according to the present invention.

The embodiment of the present invention provides an embodiment of the encryption method of the switch. It should be noted that although the logic sequence is shown in the flow chart, the steps shown or described may be completed in a different order than here under certain data.

Encryption methods for switches include:

Step S10, after the hardware system of the switch is powered on and started, perform key authentication on the startup program for starting the hardware system, so as to start the operating system of the switch after the startup program passes the key authentication.

After the hardware system of the switch is powered on and started, the switch uses its encryption chip to perform key authentication on the startup program that starts the hardware system. After the startup program passes the key authentication, the switch will start its operating system.

Wherein, the hardware system includes a switching chip, a storage chip, an encryption chip, and an FPGA (Field Programmable Gate Array, Field Programmable Logic Gate Array) chip and the like. The switching chip is used to receive data packets, the storage chip is used to store the boot (startup command) program, the encryption chip is used to authenticate the key of the boot program, and the FPGA chip is used to analyze the data packet and extract the data, encrypt the parsed data, forward the encrypted data, etc.

The step S10 also includes:

Step a, after the hardware system of the switch is powered on and started, read the startup program for starting the hardware system from the pre-burned flash of the switch memory chip, wherein the startup program is a boot program;

Step b, the boot program is loaded into the internal SRAM of the switch to run to start the boot program;

Step c, after the boot program starts, read the key file in the external encryption chip on the switch PCB;

Step d, performing key authentication on the boot key file in the boot program through the key file, so as to start the operating system of the switch after the boot program passes the key authentication.

Specifically, after the hardware system of the switch is powered on, the switch reads the boot program from the pre-programmed flash (flash memory register) of its memory chip, the boot program is a boot program, and the boot program is loaded into the internal SRAM (Static Random-Access Memory) of the switch to run, to start the boot program, and read the boot key file in the boot program. After the boot program starts, the switch reads the key file in the external encryption chip on its PCB (Printed Circuit Board, printed circuit board) through I2C (bidirectional two-wire synchronous serial bus), and performs key authentication on the code information in the boot key file through the key file in the encryption chip, and the key authentication is boot key authentication. After the code information in the boot key file is successfully authenticated by the key file in the encryption chip, that is, after the startup program passes the key authentication, the switch starts its operating system.

Wherein, the boot program is a startup command of the switch hardware system. The key file refers to the secret information used to complete cryptographic applications such as encryption, decryption, and integrity verification. The I2C bus is a bidirectional two-wire synchronous serial bus that requires two wires to transmit information between devices connected to the bus. The boot key authentication is the bottom layer key authentication of the bootloader. After it completes the initialization of the switching chip and related hardware, it installs the operating system image or solidified embedded application in the memory, and then jumps to the space where the operating system is located to start the operating system.

It should be noted that when the hardware system of the switch is started, the switch will pre-set a key file on the encryption chip. The operating systems of different switches are different, and the form of the switch is not limited in this embodiment.

In this embodiment, for example, in the information of the key file of the encryption chip, the information for key authentication of the boot key file is if the boot program has "3onedata", certification passed, and the code information included in the boot key file of the boot program has "connect to 3onedata" and so on. The switch reads the boot program in the memory chip flash, and the boot program runs and starts in the internal SRAM. The ciphertext matches. When the key file in the encryption chip matches the boot key file in the boot program, that is, when the key file in the encryption chip is the same as the boot key file in the boot program, the switch starts its operating system.

Further, said step d includes:

Step e, read the boot key file into the key file of the encryption chip to perform key verification, obtain the verification result of the key authentication, and verify whether the verification result is passed;

Step f, if it is verified that the inspection result is passed, start the operating system of the switch.

Specifically, the switch reads the boot key file into the key file of the encryption chip to perform a key matching check, and obtains a boot key authentication check result, and then the switch verifies the check result, and if the check result passes, the switch starts its operating system; if the check result fails, the switch locks its operating system until the check result is verified.

Among them, methods for key matching verification include information comparison verification method, character comparison verification method, etc., and the form of the comparison verification method is not limited in this embodiment.

In this embodiment, for example, what the key matching verification method adopts is the character comparison verification method. Set the pass character as true in the switch, and the pass character as false, and the switch reads the boot key file into the key file of the encryption chip for key matching inspection. Since the key file in the encryption chip matches the boot key file, the encryption chip returns the character true to the switch. The switch compares the returned character with the internally set character, and then performs verification.

Step S20, after the operating system is started, receive data packets through the switch chip in the switch, analyze the data packets through the FPGA chip in the switch, and encrypt the parsed data.

After the operating system of the switch is started, the switch receives the data packet through its switching chip, and after receiving the data packet, it analyzes the data packet through its FPGA chip, and then re-encrypts the parsed data.

The step S20 also includes:

Step g, after the operating system is started, receiving the data packet sent by the first terminal device from the Ethernet data port of the switch through the switching chip in the switch;

In step h, the FPGA chip of the switch analyzes the data packet to obtain valid data in the data packet, and encrypts the valid data by using a preset encryption algorithm.

Specifically, after the operating system of the switch is started, the switch receives the data packet sent from the first terminal device from the Ethernet data port of the switch through its switch chip. After obtaining the data packet, the switch analyzes the data packet through the FPGA chip to obtain valid data in the data packet, and then uses a preset encryption algorithm to re-encrypt the valid data.

Wherein, the first terminal device is a terminal device that sends data packets to the switch, and may be an external network terminal device or an internal network terminal device. An encryption algorithm is a method for encrypting data. There are many encryption algorithms, including Chinese and English encryption algorithms, binary encryption algorithms, and digital English encryption algorithms. This embodiment does not limit the form of encryption algorithms.

Further, the step h also includes:

Step i, unpacking the data packet by the data packet format in the FPGA chip to obtain unpacked data;

Step j, extracting the unpacked data according to the valid data field preset in the FPGA chip to obtain valid data;

In step k, the valid data is encrypted using a preset encryption algorithm in the FPGA chip to obtain encrypted data.

Specifically, the switch unpacks the data packet through the unpacking method of the data packet format in the FPGA chip to obtain the unpacked data, then extracts the unpacked data according to the valid fields preset in the FPGA chip, and discards the invalid data to obtain valid data, and then uses the preset encryption algorithm in the FPGA chip to re-encrypt the valid data to obtain encrypted data.

Among them, valid data and invalid data are set according to individual needs. The data packet format refers to the data format specified according to different protocols. There are many kinds of data packet formats. This embodiment does not limit the form of the data packet format. The most commonly used data packet format is "frame header + data". In this embodiment, for example, the preset effective field is "3onedata", and the data packets received by the switch include "3onedata-Profit in January 2020.doc", "ABC-Profit in February 2020.doc", etc. After unpacking, the frame headers are "3onedata", "ABC", etc., the data corresponding to "3onedata" is "Profit in January 2020.doc", and the data corresponding to "ABC" is "Profit in February 2020.doc ", and then according to the preset limited fields, extract the data "Profit in January 2020.doc" and re-encrypt it, and discard the data "Profit in February 2020.doc". This example. For example, the ciphertext is "20 21 18 14 12 05 06 20", which is "TURE LERT" after being decrypted by the digital English encryption algorithm.

Further, the encryption method of the switch also includes:

Step 1, detecting whether the boot program in the switch memory chip has been updated;

Step m, if it is detected that the boot program has been updated, power on and start the hardware system of the switch.

Specifically, before the hardware system of the switch is not powered on, the switch detects whether the boot program in the memory chip of the switch has been updated through its internal system. When it is detected that the boot program has not been updated, the switch continues to detect.

It should be noted that there are many methods for detecting updates, such as based on time, name, suffix, etc., and this embodiment does not limit the methods for detecting updates.

In this embodiment, for example, an original boot program in the memory chip of the switch is "3onedata-2020.1". After a period of time, the switch detects that the boot program has been changed to "3onedata-2020.1.1", which means that the boot program has been updated.

After the hardware system is powered on and started, the present invention performs key authentication on the startup program of the hardware system to start the operating system, receives data packets through the switching chip, analyzes the data packets through the FPGA chip, and encrypts the parsed data. It can be seen that, in the encryption process of the switch, the present invention performs key authentication on the startup program after the hardware system is powered on and starts, and the operating system is started only after the startup program passes the key authentication, thus preventing the switch program from being cracked by violence.

Further, a second embodiment of the encryption method of the switch of the present invention is proposed.

The difference between the second embodiment of the encryption method of the switch and the first embodiment of the encryption method of the switch is that the encryption method of the switch further includes:

Step n, the encrypted data is repackaged according to the packet format in the FPGA chip, to obtain the packaged packet;

Step o, sending the encapsulated data packet to the second terminal device through the Ethernet data port of the switch, so that the second terminal device unpacks the encapsulated data packet after receiving the encapsulated data packet, extracts the encrypted data, and decrypts the encrypted data to obtain valid data in the encapsulated data packet.

Specifically, after the switch encrypts the data, the switch repackages the encrypted data according to the data packet format in the FPGA chip to obtain the encapsulated data packet, and then sends the encapsulated data packet to the Ethernet data port of the switch through the FPGA chip, and then sends it to the second terminal device through the Ethernet data port, so that after the second terminal device receives the encapsulated data packet, it unpacks the encapsulated data packet according to the data packet format to obtain the unpackaged encapsulated data, then proposes the encrypted data in the encapsulated data, and then decrypts the encrypted data to obtain valid data, and then according to user needs Get the required data in the valid data.

Wherein, the second terminal device refers to a device that receives the data packet encapsulated by the switch, and may be an external network terminal device or an internal network terminal device. The decryption algorithm is a method for decrypting data. There are many decryption algorithms, including Chinese and English encryption algorithms, binary encryption algorithms, digital English encryption algorithms, etc. This embodiment does not limit the form of the decryption algorithm.

After re-encrypting the data, the switch in this embodiment re-encapsulates the encrypted data, and sends the encapsulated data to the terminal device through a normal Ethernet packet format, so that the encapsulated data packet can be transmitted on the public network according to the common packet format, thereby improving the versatility of the encapsulated data packet.

In addition, the present invention also provides an encryption device of a switch. Referring to FIG. 2, the encryption device of the switch includes:

The authentication module 10 is used to perform key authentication on the startup program for starting the hardware system after the hardware system of the switch is powered on, so as to start the operating system of the switch after the startup program passes the key authentication;

A receiving module 20, configured to receive data packets through a switching chip in the switch after the operating system is started;

Parsing module 30, for parsing the data packet by the FPGA chip in the switch;

An encryption module 40, configured to encrypt the parsed data.

Further, the encryption module 40 includes:

a receiving unit, configured to receive a data packet sent by a first terminal device from an Ethernet data port of the switch through a switch chip in the switch after the operating system is started;

The encryption unit is used to parse the data packet through the FPGA chip of the switch to obtain valid data in the data packet, and encrypt the valid data by using a preset encryption algorithm.

Further, the encryption unit includes:

The unpacking subunit is used to unpack the data packet through the data packet format in the FPGA chip to obtain unpacked data;

An extraction subunit is used to extract the unpacked data according to the valid data field preset in the FPGA chip to obtain valid data;

The encryption subunit is used to encrypt the valid data by adopting the encryption algorithm preset in the FPGA chip to obtain encrypted data.

Further, the authentication module 10 includes:

The reading unit is used to read the startup program for starting the hardware system from the pre-programmed flash of the switch memory chip after the hardware system of the switch is powered on, wherein the startup program is a boot program;

a loading unit, configured to load the boot program into the internal SRAM of the switch to run, so as to start the boot program;

The reading unit is also used to read the key file in the external encryption chip on the switch PCB after the boot program is started;

The authentication unit is configured to perform boot key authentication on the boot key file in the boot program through the key file, so as to start the operating system of the switch after the startup program passes the key authentication.

Further, the authentication unit includes:

The verification subunit is used to read the boot key file into the key file of the encryption chip for key verification, and obtain the verification result of key authentication;

A verification subunit is used to verify whether the test result is passed;

The starting subunit is used to start the operating system of the switch if the verification result is passed.

Further, the encryption device of the switch also includes:

A detection unit, configured to detect whether the boot program in the switch memory chip is updated;

A starting unit, configured to power on and start the hardware system of the switch if the boot program has been updated.

Further, the encryption device of the switch also includes:

An encapsulation module is used to re-encapsulate the encrypted data according to the data packet format in the FPGA chip to obtain an encapsulated data packet;

The sending module sends the encapsulated data packet to the second terminal device through the Ethernet data port of the switch, so that the second terminal device unpacks the encapsulated data packet after receiving the encapsulated data packet, extracts the encrypted data, and decrypts the encrypted data to obtain valid data in the encapsulated data packet.

The specific implementation manners of the switch-based encryption device of the present invention are basically the same as the above-mentioned embodiments of the switch-based encryption method, and will not be repeated here.

In addition, the invention also provides an encryption device of a switch. As shown in FIG. 3 , FIG. 3 is a schematic structural diagram of a hardware operating environment involved in the solution of the embodiment of the present invention.

It should be noted that FIG. 3 is a schematic structural diagram of a hardware operating environment of an encryption device of a switch.

FIG. 3 is a schematic structural diagram of a hardware operating environment of an encryption device of a switch.

As shown in the figure, the encryption device of the switch may include: a processor 1001 , such as a CPU, a memory 1005 , a user interface 1003 , a network interface 1004 , and a communication bus 1002 . Wherein, the communication bus 1002 is used to realize connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (board), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. Optionally, the network interface 1004 may include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 can be a high-speed RAM memory, or a stable memory (non-volatile memory), such as a disk memory. Optionally, the memory 1005 may also be a storage device independent of the aforementioned processor 1001 .

Optionally, the encryption device of the switch may also include an RF (Radio Frequency, radio frequency) circuit, a sensor, a WiFi module, and the like.

Those skilled in the art can understand that the encryption device structure of the switch shown in FIG. 3 does not constitute a limitation on the encryption device of the switch, and may include more or less components than shown in the figure, or combine some components, or arrange different components.

As shown in FIG. 3 , the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and an encryption program of a switch. Wherein, the operating system is a program that manages and controls the hardware and software resources of the encryption device of the switch, and supports the operation of the encryption program of the switch and other software or programs.

In the encryption device of the switch shown in the figure, the user interface 1003 is mainly used for the user's terminal device, so that the user can select valid data on the terminal device according to individual needs; the network interface 1004 is mainly used for the switch, and performs data communication with the terminal device; the processor 1001 can be used to call the encryption program of the switch stored in the memory 1005, and complete the steps of the control method for the encryption device of the switch as described above.

The specific implementation manners of the encryption device of the switch in the present invention are basically the same as the embodiments of the encryption method of the switch above, and will not be repeated here.

In addition, an embodiment of the present invention also provides a computer-readable storage medium, on which an encryption program of a switch is stored, and when the encryption program of the switch is completed by a processor, the steps of the above-mentioned encryption method for the switch are implemented.

The specific implementation manners of the computer-readable storage medium of the present invention are basically the same as the embodiments of the encryption method of the switch above, and will not be repeated here.

It should be noted that, in this document, the terms "comprising", "comprising" or any other variation thereof are intended to cover a non-exclusive inclusion, such that a process, method, article or device comprising a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent in such a process, method, article or device. Without further limitation, an element defined by the phrase "comprising a ..." does not preclude the presence of additional identical elements in the process, method, article or apparatus comprising that element.

The serial numbers of the above embodiments of the present invention are for description only, and do not represent the advantages and disadvantages of the embodiments.

Through the description of the above embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus a necessary general-purpose hardware platform, and of course also by hardware, but the former is a better implementation in many cases. Based on such an understanding, the technical solution of the present invention or the part that contributes to the prior art can be embodied in the form of software goods, and the computer software goods are stored in a storage medium (such as ROM/RAM, magnetic disk, optical disk), and include several instructions to enable the encryption device of a switch to complete the methods described in various embodiments of the present invention.

Claims (6)

1. an encryption method of an exchange, is characterized in that, the encryption method of the exchange comprises the following steps: After the hardware system of the switch is powered on and started, the startup program for starting the hardware system is read from the pre-programmed flash memory register flash of the switch memory chip, wherein the startup program is a boot program; The boot program is loaded into the internal static random access memory SRAM of the switch to run, to start the boot program; After the boot program starts, read the key file in the external encryption chip on the printed circuit board PCB of the switch; Carry out key authentication to the boot key file in the boot program through the key file, to start the operating system of the switch after the startup program passes the key authentication; After the operating system is started, a data packet sent by the first terminal device is received from the Ethernet data port of the switch through the switch chip in the switch; The data packet is unpacked by the data packet format in the Field Programmable Gate Array FPGA chip in the switch to obtain unpacked data; Extracting the unpacked data according to the valid data field preset in the FPGA chip to obtain valid data; Encrypting the valid data using a preset encryption algorithm in the FPGA chip; The encrypted data is repackaged according to the data packet format in the FPGA chip to obtain a packaged data packet; Sending the encapsulated data packet to the second terminal device through the Ethernet data port of the switch, so that after the second terminal device receives the encapsulated data packet, it unpacks the encapsulated data packet, extracts the encrypted data, and decrypts the encrypted data to obtain valid data in the encapsulated data packet. 2. the encryption method of switch as claimed in claim 1, is characterized in that, described key authentication is carried out to the boot key file in described boot program by described key file, to start the step of the operating system of described switch after described start-up program by key authentication comprises: Read the boot key file into the key file of the encryption chip to perform key verification, obtain the verification result of the key authentication, and verify whether the verification result is passed; If it is verified that the check result is passed, start the operating system of the switch. 3. the encryption method of switch as claimed in claim 1, it is characterized in that, after the hardware system of switch is powered on and started, read the start-up program of starting described hardware system from the flash memory register flash of described switch memory chip burning in advance, wherein, before described start-up program is the step of boot program, also comprise: Detect whether the boot program in the switch memory chip has been updated; If it is detected that the boot program has been updated, power on and start the hardware system of the switch. 4. An encryption device of a switch, characterized in that the encryption device of the switch comprises: The authentication module is used to read the startup program for starting the hardware system from the pre-programmed flash memory register flash of the switch memory chip after the hardware system of the switch is powered on, wherein the startup program is a boot program; the boot program is loaded into the internal static random access memory (SRAM) of the switch to start the boot program; start the operating system of the switch after the startup program passes the key authentication; A receiving module, configured to receive a data packet sent by a first terminal device from an Ethernet data port of the switch through a switch chip in the switch after the operating system is started; Parsing module, for unpacking the data packet by the data packet format in the Field Programmable Gate Array FPGA chip in the switch to obtain unpacked data; extract the unpacked data according to the valid data field preset in the FPGA chip to obtain valid data; An encryption module, configured to encrypt the valid data using a preset encryption algorithm in the FPGA chip; The encryption module is also used to repackage the encrypted data according to the packet format in the FPGA chip to obtain a packaged data package; the packaged data package is sent to the second terminal device through the Ethernet data port of the switch, for the second terminal device to unpack the packaged data package after receiving the packaged data package, extract the encrypted data, and decrypt the encrypted data to obtain valid data in the packaged data package. 5. An encryption device of a switch, characterized in that the encryption device of the switch comprises a memory, a processor, and an encryption program of the switch stored on the memory and operated on the processor, and the encryption program of the switch is implemented when the processor is completed. The steps of the encryption method of the switch according to any one of claims 1 to 3. 6. A computer-readable storage medium, wherein an encryption program of a switch is stored on the computer-readable storage medium, and when the encryption program of the switch is completed by a processor, the steps of the encryption method for a switch according to any one of claims 1 to 3 are implemented.