A multi-source and multi-target cryptographic resource scheduling method

Abstract

The present invention belongs to the technical field of cryptographic resource scheduling, and specifically relates to a multi-source and multi-target cryptographic resource scheduling method, including initializing relevant parameters of cryptographic resource nodes and cryptographic task nodes; determining whether each cryptographic resource node is a focus node or a peripheral node, and determining the convergence domain of the focus node; for each cryptographic task node, calculating the single node protection capability, for each focus node, calculating the focus weight; updating the speed of each cryptographic resource node according to the single node protection capability and the focus weight, each cryptographic resource node updates its position according to the calculated speed, and after repeated iterations, finally obtains the optimal position and optimal overall layout of each cryptographic resource node. The present invention can ensure that when a cryptographic resource demand appears at a cryptographic task node, under the condition that the overall protection capability meets the requirements, the cryptographic resources can be deployed to the cryptographic task node in the shortest possible time, and at the same time, there will be no excessive aggregation of multiple cryptographic resource nodes.

Description

Technical Field

[0001] The present invention belongs to the technical field of cryptographic resource scheduling, and in particular relates to a multi-source and multi-target cryptographic resource scheduling method. Background Art

[0002] Cloud computing technology is becoming increasingly mature and is widely used in various information systems such as government affairs, finance, and industry. In order to improve service quality, it is necessary to study the management and scheduling of cloud resources. Scheduling algorithms are also developing rapidly, mainly including traditional scheduling algorithms, prediction-based scheduling algorithms, and heuristic intelligent scheduling algorithms.

[0003] Traditional scheduling algorithms include first-come-first-served scheduling algorithm, high-priority scheduling algorithm and round-robin scheduling algorithm. The first-come-first-served scheduling algorithm allocates resources to tasks according to their arrival order. The high-priority scheduling algorithm allocates resources according to the priority of the task, and resources are allocated first to tasks with higher priority. The round-robin scheduling algorithm distributes resource requests to different cloud hosts in a round-robin manner. The implementation of traditional scheduling algorithms is simple, but it is difficult to adapt to complex actual application environments.

[0004] Prediction-based scheduling algorithms usually have a prediction model that predicts the next task requirement based on the operation status of historical tasks and provides a decision-making basis for scheduling strategies. Currently, commonly used prediction methods include prediction models based on Markov chains and prediction models based on quadratic exponential smoothing. Their limitation is that they are highly dependent on historical data.

[0005] Heuristic intelligent algorithms have good global optimization search and learning capabilities, and have received widespread attention in the field of intelligent computing. They include genetic algorithms, particle swarm algorithms, etc., which can be used for resource scheduling in cloud environments and can greatly improve scheduling efficiency and scheduling quality. However, the relevant content is not mature enough and needs further in-depth research.

[0006] The basic idea of ​​Particle Swarm Optimization (PSO) comes from the biological study of bird foraging behavior. Assume the following scenario: within a given range, a flock of birds forages arbitrarily, looking for a single piece of food. Each bird does not know the exact location of the food, but knows how far away the food is from itself. The main strategy is to find the bird in the flock that is shortest to the food, and then search near the bird. Particle Swarm Optimization is inspired by this biological behavior and is usually used to solve optimization problems.

[0007] The particle swarm algorithm compares a bird in a flock to the solution of an optimization problem, allowing it to fly freely in a limited search space at a limited speed. The flight speed needs to be affected by the flight experience of itself and other companions and needs to be adjusted dynamically. When a bird finds a better food location, it will guide other birds in the flock to gather at that point.

[0008] At present, there are few studies on the problem of cryptographic resource scheduling in cloud computing environments. The most relevant implementation scheme for the present invention is the virtual cryptographic machine scheduling strategy based on entropy weight evaluation proposed by Wang Zewu et al. This strategy mainly includes two steps. The first step is to establish a cryptographic task scheduling model based on round-robin optimization and a cryptographic card I / O throughput analysis model, design a migration trigger algorithm, and determine the timing of scheduling; the second step is to establish a comprehensive evaluation model based on the entropy weight method, determine the cloud cryptographic machine resource weight according to the historical data of cloud cryptographic machine resource utilization, comprehensively evaluate the cloud cryptographic machine service capacity according to the resource weight, compare the cloud cryptographic machine service capacity before and after migration, and use the difference sorting method to select the virtual cryptographic machine and the target host to be migrated.

[0009] The virtual cipher scheduling strategy based on entropy weight evaluation is a prediction-based scheduling algorithm that solves the problem of selecting the scheduling source and scheduling target in the cryptographic resource scheduling process. If there is only one source virtual cipher and one target host, this method can derive a specific scheduling plan; if there are multiple source virtual ciphers and multiple target hosts, this plan cannot give the specific correspondence between the source virtual cipher and the target host, and can only determine which virtual ciphers need to be scheduled, without giving a specific scheduling plan. The existing scheme is not applicable to the multi-source and multi-target cryptographic resource scheduling problem.

[0010] The original particle swarm algorithm searches the area around the bird that is currently closest to the food. In each round of iteration, all particles search for the optimal solution around the point with the highest current fitness value. After multiple rounds of iterations, when the end conditions are met, the position of the point with the highest current fitness value is the final solution of the algorithm. The particle swarm algorithm finds a single optimal position through iteration, which is a single point. The problem we want to solve is the scheduling and layout of multiple cryptographic resource nodes when multiple cryptographic task nodes require cryptographic resources. What we need to find is the location of multiple points, not a single point. At the same time, the original particle swarm algorithm may have the problem of too many particles concentrated near a certain position. When applied to cloud resource scheduling, load imbalance may occur. When applying the particle swarm algorithm to the cryptographic resource scheduling problem, the original particle swarm algorithm needs to be improved. Summary of the invention

[0011] In order to solve the problem of cryptographic resource scheduling under multi-source and multi-target conditions, the present invention proposes a multi-source and multi-target cryptographic resource scheduling method, which has good global optimization search capability and learning ability, and can ensure that no matter which cryptographic task nodes have cryptographic resource needs, under the condition that the overall security capability meets the requirements, the cryptographic resources can be deployed to the cryptographic task nodes in the shortest possible time. At the same time, there will be no excessive aggregation of multiple cryptographic resource nodes.

[0012] In order to solve the above technical problems, the present invention adopts the following technical solutions:

[0013] The present invention provides a multi-source and multi-target cryptographic resource scheduling method, comprising the following steps:

[0014] Initialize the relevant parameters of the cryptographic resource node and the cryptographic task node, and send these parameters to the node state storage module for storage in the structure of a binary search tree;

[0015] Determine whether each cryptographic resource node is a focus node or a peripheral node, and determine a convergence domain for each focus node;

[0016] In one round of iteration, when all cryptographic resource nodes have completed the determination of the focus nodes, peripheral nodes, and convergence domains, for each cryptographic task node, the single node assurance capability is calculated, and for each focus node, the focus weight is calculated;

[0017] The speed of updating each cryptographic resource node is based on the single-node protection capability and focus weight. Each cryptographic resource node updates its own position according to the calculated speed. After repeated iterations, the optimal position and optimal overall layout of each cryptographic resource node are finally obtained.

[0018] Further, the initialization of the relevant parameters of the cryptographic resource node and the cryptographic task node, and sending these parameters to the node state storage module for storage in the structure of a binary search tree, comprises the following steps:

[0019] The initialization module generates the identifier Cid of each cryptographic resource node, the identifier Did of each cryptographic task node, and the required security capability E_need of the cryptographic task node;

[0020] The initialization module randomly generates the initial position COORDINATE(Cid) of each cryptographic resource node within the position boundary;

[0021] Initialize the module at maximum speed V MAX Randomly generate the initial speed v of each cryptographic resource node within the range of;

[0022] The initialization module generates the node status RS(Cid) of each cryptographic resource node, RS(Cid) = {Cid, COORDINATE(Cid), v, FOC, PER, WEI, E, E0, ServDid, FocusCid, Gather_Range, pbest}, wherein FOC, PER, WEI, E, E0, Gather_Range are all set to 0, ServDid and FocusCid are set to null, and pbest is set to its historical optimal position; Cid represents the cryptographic resource node identifier, Did represents the cryptographic task node identifier, COORDINATE(Cid) represents the position of the cryptographic resource node, v represents the speed, FOC represents the focus node flag, PER represents the surrounding node flag, WEI represents the focus weight, E represents the basic guarantee capability, E0 represents the single node guarantee capability, ServDid represents the service object identifier, Gather_Range represents the radius of the gathering domain, FocusCid represents the Cid of the focus node to which the cryptographic resource node belongs, and pbest represents the historical optimal position;

[0023] The initialization module sends a message M1={RS(Cid)} to the node status storage module, where RS(Cid) represents the cryptographic resource node status;

[0024] The node status storage module receives the message M1, uses each RS (Cid) as a node of the binary search tree to generate and store RST (Cid), where RST (Cid) represents the cryptographic resource node status tree;

[0025] The initialization module initializes the distance L, transmission delay T, task matching degree X, and resource quantity R of each cryptographic resource node to a single cryptographic task node, generates a resource-task node relationship tuple RTC(Did, Cid), RTC(Did, Cid)={Did, Cid, L, T, X, R}, and sends a message M2={RTC(Did, Cid)} to the node status storage module;

[0026] The node state storage module receives M2, uses each RTC (Did, Cid) as a node of a binary search tree to generate RTCT (Did, Cid) and stores it, where RTCT (Did, Cid) represents a resource-task node relationship tree;

[0027] The initialization module initializes the basic security capability tree ET (Did) and sets the basic security capability E of each node {Did, E, Cid} in the tree to 0.

[0028] Further, determining the focus node includes:

[0029] The focused node determination module sends a message M3 = {Did} to the node status storage module;

[0030] The node state storage module searches the RTCT (Did, Cid) tree for the RTC (Did, Cid) node that matches the current Did according to the received Did, and sends a message M4 = {Did, RTC (Did, Cid)} to the focus node determination module;

[0031] After receiving M4, the focus node determination module extracts T, X and R in RTC (Did, Cid) and calculates the basic guarantee capability E according to the basic guarantee capability calculation formula;

[0032] The focused node determination module sends a message M5 = {Did, E, Cid} to the node status storage module;

[0033] The node status storage module receives the message M5, uses the information therein as the node of the binary search tree to generate ET (Did) and stores it, where ET (Did) represents the basic guarantee capability tree;

[0034] After calculating the basic guarantee capability of each node, the focus node determination module sends a maximum basic guarantee capability query message M6={Did} to the node status storage module;

[0035] After receiving M6, the node status storage module searches for the corresponding ET(Did) according to Did, finds the node with the largest basic guarantee capability, obtains its Cid, and updates the node in RST(Cid), setting the ServDid of the corresponding node to Did and the FocusCid field to its own Cid.

[0036] Furthermore, the basic protection capability is defined as the protection capability that a certain cryptographic resource node can provide to a certain cryptographic task node, and the calculation formula is as follows:

[0037]

[0038] Where T is the transmission delay, R is the amount of resources, X is the task matching degree, and η is the adjustment factor.

[0039] Furthermore, determining the surrounding nodes and the shrinking domain includes the following steps:

[0040] Step 1: The peripheral node determination module sends a query request to the node status storage module to query the status information of all focused nodes;

[0041] Step 2: After receiving the query request, the node status storage module traverses each node of RST(Cid). If the FOC field of the node is 1, the traversal is stopped and a message M7={Cid, COORDINATE(Cid), ServDid} is sent to the surrounding node determination module, where Cid is the Cid of the current node; if the FOC field of the node is 0, no operation is performed and the traversal continues;

[0042] Step 3, after receiving M7, the surrounding node determination module calculates the distance L_Res between the surrounding nodes and the current focused node, and the calculation results are stored in the binary search tree PFT(Cid1) with {Cid1, L_Res, Cid2} as nodes, where PFT(Cid1) represents the surrounding-focused node relationship tree, Cid1 is the Cid of the surrounding node, Cid2 is the Cid of the focused node, and one surrounding node corresponds to one tree. After the calculation of the current surrounding node is completed, it continues to send a request to the node status storage module;

[0043] Step 4: After receiving the request, the node status storage module continues to traverse downwards, and after traversing all nodes, sends a traversal completion message ACK to the surrounding node determination module;

[0044] Step 5: After receiving the traversal completion message ACK, the surrounding node determination module traverses each PFT tree and finds the node with the smallest L_Res in each tree to determine the ownership of the surrounding node; then sends a message M8 = {Cid1, Cid2, L_Res} to the node status storage module;

[0045] Step 6, the node status storage module receives message M8, stores Cid2 in the FocusCid field of the RST (Cid) corresponding to the current surrounding node, uses Cid2 as the index to search for the node in RST (Cid), compares the value of L_Res with Gather_Range, and if L_Res is larger, updates the value of Gather_Range to L_Res, obtains the value of ServDid, recorded as ServDid0; after the traversal is completed, Gather_Range is the radius of the focus node's convergence domain; uses Cid1 as the index to search for the node in RST (Cid), and updates the value of PER in the node to 1, and updates the content of ServDid to ServDid0.

[0046] Furthermore, the calculation of the single node assurance capability includes the following steps:

[0047] Step A, the single node guarantee capability calculation module sends a single node guarantee capability calculation request M9={Did} to the node status storage module;

[0048] Step B, after receiving the request M9, the node status storage module traverses the RST (Cid), queries the ServDid of each node in the RST (Cid) according to the received Did, and if the value of the ServDid is the same as the received Did, extracts the Cid stored in the node and stores it in the list ListA, which stores the Cids of the focus node and surrounding nodes corresponding to the cryptographic task node to be calculated; the Cid stored in the node whose FOC field is 1 is recorded as Cid1, and the Cid stored in the node whose FOC field is 0 is stored in the list ListB, which stores the Cids of the surrounding nodes in ListA; after traversing all nodes of the RST (Cid), execute step C;

[0049] Step C, the node status storage module queries the corresponding ET (Did) according to the Did in M9, and compares the Cid of the first node in ET (Did) with the Cid in ListA. If they are the same, the value of E in the node is extracted and stored in ListC, which stores the E values ​​of the focused node and surrounding nodes; if they are not the same, the next node is queried. After all nodes are traversed, step D is executed;

[0050] Step D: The node status storage module counts the number of surrounding nodes Count of each focused node according to the list ListA, forms a message M10 = {Count}, and sends it to the focus weight calculation module; the node status storage module forms a message M11 with ListC generated in step C and sends it to the single node assurance capability calculation module;

[0051] Step E: After receiving M11, the single node guarantee capability calculation module calculates the single node guarantee capability E0 according to the value of E in ListC and the single node guarantee capability calculation algorithm;

[0052] Step F, calculate the single node security capability E0 according to the single node security capability calculation algorithm, and send the calculation result and the Did of the cryptographic task node to the node state storage module in the form of message M12 = {E0, Did}; after receiving M12, the node state storage module queries the ServDid field of the focus node in RST (Cid), and if this field is the same as the Did in M12, the received single node security capability is written into the E0 field of the node queried;

[0053] Repeat steps A to F to complete the calculation of the security capabilities of all cryptographic task nodes.

[0054] Furthermore, the formula of the single node guarantee capability E0 calculation algorithm is:

[0055] E0=∑E.

[0056] Further, the calculating of the focusing weight includes:

[0057] The focusing weight calculation module sends a focusing weight calculation request M13 = {Cid} to the node status storage module;

[0058] After receiving the query request M13, the node status storage module queries RST (Cid), queries the number of focused nodes N′, and forms the result into a message M14 = {N′}, and returns it to the focus weight calculation module;

[0059] After receiving the message M14, the focus weight calculation module calculates the value according to M14 and M10={Count} received in step D. The focusing weight W is calculated according to the focusing weight calculation algorithm, and the focusing weight calculation module sends a message M15={W, Cid} to the node state storage module, including the focusing weight and the Cid of the focusing node to which it belongs;

[0060] After receiving the message M15, the node status storage module queries RST (Cid), finds the corresponding node according to the Cid of M15, and writes the focus weight W into the WEI field of the corresponding node;

[0061] Repeat the above steps until the calculation of the focusing weights of all focusing nodes is completed.

[0062] Furthermore, the focusing weight W calculation algorithm includes:

[0063] Remember W σ is the standard deviation, and its calculation formula is:

[0064]

[0065] Where N′ is the number of focused nodes, N is the average value obtained by dividing the total number of surrounding nodes by the number of focused nodes; i =N i1 +N i3 , N i1 is the number of nodes around the focused node, N i2 is the number of nodes between domains, N i3 is the correction value of the number of nodes between domains, and the correction value calculation formula is: TA and TB are the transmission delays from the inter-domain node to this focused node and to the focused node to which it belongs, respectively;

[0066] Normalize the standard deviation to get the focusing weight calculation formula:

[0067]

[0068] The larger the focusing weight of the focused node, the fewer surrounding nodes there are, and new surrounding nodes need to be added; the smaller the focusing weight of the focused node, the more surrounding nodes there are, and the surrounding nodes need to be migrated out.

[0069] Furthermore, updating the speed and position includes the following steps:

[0070] Step a, the speed and position update module sends a speed and position update request M16={Cid} to the node status storage module;

[0071] Step b, after receiving the request M16, the node state storage module queries RST (Cid), finds the corresponding node in RST (Cid) according to the Cid in M16, obtains the current position from the COORDINATE (Cid) field of the node, obtains the speed value of the previous iteration from the v field, obtains its historical optimal position from the pbest field, and finds the Cid of the corresponding focus node from the FocusCid field of the node;

[0072] Step c: The node state storage module searches for RST(Cid) according to the Cid of the focused node, obtains the focus weight WEI of the corresponding node and the position COORDINATE(Cid) of the focused node, and the W in the particle speed calculation formula is the value of the WEI field, gbest id The value of the COORDINATE(Cid) field;

[0073] Step d, the node status storage module combines the information queried in steps b and c with the single node guarantee capability E0 calculated by the single node guarantee capability calculation module to form a message M17, and sends it to the speed and position update module;

[0074] Step e: The speed and position update module receives M17, extracts the data therein, and calculates the speed of this round of iteration according to the speed update formula. If the speed value exceeds V MAX , then set it to V MAX ; Calculate the position of this round of iteration according to the position update formula, and form message M18 to send to the cross-border check and end judgment module;

[0075] Step f, after receiving M18, the cross-border check and end judgment module judges the received data according to the end condition. If it crosses the border, the node state storage module is notified. After receiving the message, the node state storage module no longer stores the result data of this round of iteration; if it does not cross the border, the message is handed over to the node state storage module for storage; if the end condition is met, all modules are notified to end;

[0076] The speed update formula is:

[0077]

[0078] Where i = 1, 2, ... N, N is the total number of cryptographic resource nodes, k represents the number of iterations, represents the d-th dimension component of the speed of the cryptographic resource node, w represents the inertia weight, which adjusts the convergence speed of the algorithm, c1, c2 and c3 represent acceleration constants, which adjust the maximum learning step size, r1, r2, 23 are random numbers between (0, 1), and pbest id Indicates the historical optimal position of the cryptographic resource node, which represents the position of the cryptographic resource node with the highest historical security capability. is the position of the password resource node after the previous iteration, gbest id Indicates the optimal position of the region, that is, the position of the focus node; W is the focus weight of the focus node to which the cryptographic resource node belongs, E_need is the required protection capability of the cryptographic task node served by the cryptographic resource node, and E0 is the current single-node protection capability of the cryptographic task node served by the cryptographic resource node;

[0079] The position update formula is:

[0080]

[0081] In the formula, T is the time of each iteration.

[0082] Compared with the prior art, the present invention has the following advantages:

[0083] 1. The present invention uses a heuristic intelligent scheduling algorithm to solve the problem of cryptographic resource scheduling under multi-source and multi-target conditions, and has good global optimization search and learning capabilities; the focusing weight is assigned to the focusing node, and the position update speed of the cryptographic resource node is adjusted by the focusing weight. If there are too many cryptographic resource nodes around a certain cryptographic task node, the speed of moving to the cryptographic task node is slowed down to avoid the situation where multiple cryptographic resource nodes are too concentrated around a certain cryptographic task node to cause load imbalance. The position update speed of the cryptographic resource node is affected by the single-node guarantee capability, so that the cryptographic task node with a shortage of cryptographic resources can obtain a cryptographic resource response as soon as possible.

[0084] 2. The multi-source and multi-target cryptographic resource scheduling method proposed in the present invention, when multiple cryptographic task nodes within a cryptographic service domain have cryptographic resource requirements, reasonably schedules the positions and resources of the cryptographic resource nodes in the domain, finds the optimal positions and optimal overall layout of all cryptographic resource nodes, so that each cryptographic task node can obtain a cryptographic resource response and achieve load balancing in the shortest possible time while the overall security capability within the cryptographic service domain meets the requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0085] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0086] Figure 1 It is a flowchart of a multi-source and multi-target cryptographic resource scheduling method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0087] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0088] In order to better understand the present invention, some of the terms involved are explained as follows:

[0089] 1. Cryptographic algorithm: Cryptographic algorithm is a specific rule for transforming information from “clear” to “encrypted”. Different cryptographic algorithms correspond to different transformation rules.

[0090] 2. Key: A key is a set of information codes that participate in the "operation" of a password and play a specific control role in the "operation" of a password. Keys are an important part of cryptographic technology. In a cryptographic system, the generation, use and management of keys are crucial. Keys usually need to be strictly protected, and the loss of control of keys will cause the cryptographic system to fail.

[0091] 3. Cryptographic resources: Cryptographic resources refer to cryptographic algorithms, keys and cryptographic computing capabilities.

[0092] 4. Password resource node: a server that stores password resources and can provide password resources.

[0093] 5. Cryptographic task node: A node that requires cryptographic resources to complete a cryptographic task. Cryptographic tasks include data encryption and decryption, signature verification, hash value calculation, etc.

[0094] 6. Cryptographic service domain: There are several cryptographic resource nodes and cryptographic task nodes, which is a relatively fixed cryptographic service area.

[0095] 7. Cryptographic resource scheduling: When multiple cryptographic task nodes within a cryptographic service domain have cryptographic resource requirements, the cryptographic resource nodes within the cryptographic service domain are scheduled so that each cryptographic task node can obtain a cryptographic resource response in the shortest possible time while the total amount of cryptographic resources meets the requirements. This process is called cryptographic resource scheduling, and its purpose is to improve cryptographic service efficiency.

[0096] 8. Transmission delay: the sum of channel delay and forwarding delay. Channel delay is the time it takes for a signal to be transmitted on the channel, and forwarding delay is the time it takes for a signal to be transmitted at the forwarding node.

[0097] 9. Basic security capability: the security capability that a cryptographic resource node can provide to a cryptographic task node.

[0098] 10. Focus node: For a certain cryptographic task node, the cryptographic resource node with the strongest basic protection capability is called the focus node of the cryptographic task node.

[0099] 11. Peripheral nodes: If a cryptographic resource node is not a focused node, it is called a peripheral node of a focused node, and the peripheral node belongs to the focused node closest to the peripheral node.

[0100] 12. Collapse domain: Draw a circle with the focus node as the center and the distance between the focus node and the farthest surrounding node as the radius. This circle is called the collapse domain of the focus node.

[0101] 13. Inter-domain node: A peripheral node that is within the convergence domain of a focus node but does not belong to the focus node.

[0102] 14. Single-node security capability: For a certain cryptographic task node, the sum of the basic security capabilities that can be provided by its corresponding focus node and the surrounding nodes within its convergence domain.

[0103] 15. Task matching degree: For a certain task of the cryptographic task node, the matching degree between the cryptographic resources provided by the cryptographic resource node and the task.

[0104] 16. Focus weight: To avoid the situation where the cryptographic resource nodes are too concentrated around a certain cryptographic task node, causing load imbalance, the focus node is given a focus weight through a specific algorithm. The focus weight reflects the weight that the focus node needs other cryptographic resource nodes to gather around it. The larger the focus weight, the higher the priority of other cryptographic resource nodes to gather around the focus node, and vice versa.

[0105] 17. Overall security capability: the weighted sum of all single node security capabilities.

[0106] The following is an explanation of the symbols:

[0107] 1. Cryptographic resource node identification: represented by Cid, which is used to uniquely identify a cryptographic resource node.

[0108] 2. Cryptographic task node identification: represented by Did, which is used to uniquely identify a cryptographic task node.

[0109] 3. The location of the cryptographic resource node: represented by COORDINATE(Cid).

[0110] 4. Focus node flag: Indicated by FOC, it has two values ​​0 and 1. 0 indicates that the node is a non-focus node, and 1 indicates that the node is a focused node.

[0111] 5. Peripheral node flag: Indicated by PER, it has two values ​​0 and 1. 0 means that the node is not a peripheral node, and 1 means that the node is a peripheral node.

[0112] 6. Service object identifier: represented by ServDid, which identifies the cryptographic task node served by the cryptographic resource node. The value stored in ServDid is the identifier Did of the corresponding cryptographic task node.

[0113] 7. Focus weight: Indicated by WEI, it reflects the weight that the focusing node requires other cryptographic resource nodes to gather around it.

[0114] 8. Speed: Indicated by v, it indicates the speed of node movement and is an intermediate variable used to update the position of the cryptographic resource node.

[0115] 9. Basic guarantee capability: represented by E.

[0116] 10. Single-node security capability: represented by E0.

[0117] 11. Security capability required for cryptographic task nodes: denoted by E_need, which is the security capability required by a cryptographic task node to complete the cryptographic task.

[0118] 12. Basic security capability tree: represented by ET(Did). The nodes of ET(Did) are composed of {Did, E, Cid}. Uniquely identified by Did, a cryptographic task node corresponds to a single basic security capability tree. The tree stores the basic security capabilities of the cryptographic resource node for the cryptographic task node. Each node in the tree corresponds to a cryptographic resource node. The E stored in each node is the basic security capability of a single cryptographic resource node for the cryptographic task node.

[0119] 13. Cryptographic resource node status: represented by RS(Cid), RS(Cid) = {Cid, COORDINATE(Cid), v, FOC, PER, WEI, E, E0, ServDid, FocusCid, Gather_Range, pbest}.

[0120] Gather_Range represents the radius of the gathering domain, FocusCid represents the Cid of the focus node to which the cryptographic resource node belongs, and pbest represents the historical optimal position.

[0121] 14. Cryptographic resource node status tree: represented by RST(Cid), a cryptographic resource node corresponds to a node in the tree.

[0122] 15.L: The distance between the cryptographic resource node and the cryptographic task node.

[0123] 16.L_Res: The distance between cryptographic resource nodes.

[0124] 17. Transmission delay: T, the transmission time from the cryptographic resource node to the cryptographic task node.

[0125] 18. Resource quantity: R, the amount of cryptographic resources owned by the cryptographic resource node.

[0126] 19. Peripheral-focused node relationship tree: PFT (Cid), one peripheral node corresponds to a tree, which stores the distance between the peripheral node and all focused nodes, and each focused node corresponds to a node in the tree.

[0127] 20. Task matching degree: X, for a certain task of the cryptographic task node, the matching degree between the cryptographic resources provided by the cryptographic resource node and the task.

[0128] 21. Resource-task node relationship tuple: represented by RTC(Did, Cid), RTC(Did, Cid) = {Did, Cid, L, T, X, R}, uniquely identified by Did.

[0129] 22. Resource-task node relationship tree: represented by RTCT(Did, Cid), uniquely identified by Did, and RTC(Did, Cid) of the same Did form a tree.

[0130] Cryptography is the cornerstone of network and information security. With the rapid development of informatization today, the application of cryptography has penetrated into all aspects of social production and life. In the cloud computing environment, in order to ensure the security of application systems, the application of cryptography is becoming more and more extensive. In a cloud computing environment, there are several cryptographic task nodes and cryptographic resource nodes. When a cryptographic task node needs to complete a cryptographic task, it requests the required cryptographic resources from the cryptographic resource node. Among them, the cryptographic task node is a node that completes cryptographic tasks such as data encryption and decryption, signature verification, and hash value calculation. The cryptographic resource node is a virtual machine that stores cryptographic resources in the cloud computing environment, which is responsible for storing cryptographic resources and related configuration parameters. Many cryptographic resource nodes constitute a cryptographic resource node cluster. When receiving a request for cryptographic resources from a cryptographic task node, it provides cryptographic resources to the cryptographic task node.

[0131] like Figure 1 As shown, this embodiment provides a multi-source and multi-target cryptographic resource scheduling method, comprising the following steps:

[0132] Step S11, initializing the relevant parameters of the cryptographic resource node and the cryptographic task node, and sending these parameters to the node state storage module for storage in the structure of a binary search tree.

[0133] Step S12, determining whether each cryptographic resource node is a focus node or a peripheral node, and determining the convergence domain for each focus node.

[0134] The cryptographic resource nodes participate in the iteration of the algorithm as focus nodes or peripheral nodes. The movement behaviors of focus nodes and peripheral nodes are different. As a subsidiary of a focus node, the peripheral nodes move toward the corresponding focus node. The focus node and the peripheral nodes are the main participants of the algorithm. In each round of iteration of the algorithm, the peripheral nodes move around the focus node according to certain rules and then adjust their positions. When the end condition is met and the iteration is completed, the optimal position and overall layout of the cryptographic resource nodes are obtained.

[0135] Step S13, in one round of iteration, when all cryptographic resource nodes complete the determination of the focus node, peripheral nodes and convergence domain, for each cryptographic task node, the single node protection capability is calculated, and for each focus node, the focus weight is calculated.

[0136] Focus weight and single node security capability are important parameters required for calculating speed and position; the focus weight directly reflects the degree of aggregation of cryptographic resource nodes around the focus node. Introducing the focus weight into the speed update formula affects the adjustment of the position of the cryptographic resource node. In the iteration of the algorithm, the smaller the focus weight of a focus node, the slower its surrounding nodes approach it, or they do not move toward the closest focus node, but move toward other focus nodes.

[0137] Step S14, update the speed of each cryptographic resource node according to the single node protection capability and focus weight, and each cryptographic resource node updates its position according to the calculated speed. After repeated iterations, the optimal position and optimal overall layout of each cryptographic resource node are finally obtained. Speed ​​is an intermediate variable used for position update and is not the final output result. The position after multiple rounds of iterations is the final result.

[0138] Specifically, the node status initialization in step 11 includes the following steps:

[0139] Step S110, the initialization module receives the number of cryptographic task nodes M, the number of cryptographic resource nodes N, the resource volume R, the position boundary, and the maximum speed V of the cryptographic resource nodes manually input. MAX And the required security capability E_need of the cryptographic task node.

[0140] Step S111, the initialization module generates an identifier Cid for each cryptographic resource node, generates an identifier Did for each cryptographic task node, and a required security capability E_need for the cryptographic task node.

[0141] Step S112: the initialization module randomly generates an initial position COORDINATE (Cid) of each cryptographic resource node within the position boundary.

[0142] Step S113, initializing the module at the maximum speed V MAX The initial speed v of each cryptographic resource node is randomly generated within the range of .

[0143] Step S114, the initialization module generates the node status RS(Cid) of each cryptographic resource node, RS(Cid)={Cid,COORDINATE(Cid),v,FOC,PER,WEI,E,E0,ServDid,FocusCid,Gather_Range,pbest}, where FOC, PER, WEI, E, E0, Gather_Range are all set to 0, ServDid and FocusCid are set to empty, and pbest is set to its historical optimal position.

[0144] Step S115: the initialization module sends a message M1 = {RS(Cid)} to the node status storage module.

[0145] Step S116, the node state storage module receives the message M1, and first performs a legality check on the RS (Cid), checking whether the Cid is legal, whether the position and speed are out of bounds, etc. If the legality check fails, it is fed back to the initialization module, which regenerates it. If the legality check passes, the node state storage module uses each RS (Cid) as a node of the binary search tree to generate RST (Cid) and store it. The binary search tree maintains the time complexity of insertion, search, and deletion at O ​​(logN), improving the efficiency of other modules in querying data.

[0146] Step S117, the initialization module initializes the distance L, transmission delay T, task matching degree X, and resource quantity R of each cryptographic resource node to a single cryptographic task node, generates a resource-task node relationship tuple RTC(Did, Cid), RTC(Did, Cid)={Did, Cid, L, T, X, R}, and sends a message M2={RTC(Did, Cid)} to the node status storage module.

[0147] Step S118, the node state storage module receives M2, uses each RTC (Did, Cid) as a node of a binary search tree to generate RTCT (Did, Cid) and stores it.

[0148] Step S119, the initialization module initializes the basic security capability tree ET (Did), and for each node {Did, E, Cid} in the tree, the basic security capability E is set to 0, Did is assigned to the cryptographic task node identifier, and Cid is assigned to the cryptographic resource node identifier.

[0149] After initialization and each round of iteration, each cryptographic task node corresponds to a focus node with the strongest protection capability. The stronger the protection capability of the cryptographic resource node for the cryptographic task node, the faster it can provide cryptographic resources to the cryptographic task node when the cryptographic task node has a cryptographic resource demand, thereby ensuring that the cryptographic task can be executed safely and efficiently, and providing users with high-quality cryptographic services. The position of the focus node is the optimal position in the local area under the current situation, but because we do not know which cryptographic task node will have a sudden demand, the position of the cryptographic task node is not specified during the algorithm iteration, only the distance between the cryptographic task node and all cryptographic resource nodes is specified. In this case, the position of the focus node is only a temporary optimal position, not the final optimal position. There is a position closer to the cryptographic task node around the focus node, and other nodes may be able to search for this position by moving closer to the focus node. Determining multiple focus nodes can enable as many cryptographic task nodes as possible to obtain cryptographic resource guarantees as soon as possible when there is a sudden demand.

[0150] The determination of the focus node requires the calculation of the basic protection capabilities of each cryptographic resource node for all cryptographic task nodes. This work is completed by the focus node determination module, and then a basic protection capability tree for a single cryptographic task node is established and stored in a binary search tree structure.

[0151] Specifically, determining the focus node in step S12 includes the following steps:

[0152] Step S1211, the focused node determination module sends a message M3={Did} to the node status storage module.

[0153] Step S1212, the node status storage module searches the RTCT (Did, Cid) tree for the RTC (Did, Cid) node that matches the current Did according to the received Did, and sends a message M4 = {Did, RTC (Did, Cid)} to the focus node determination module.

[0154] Step S1213, after receiving M4, the focus node determination module extracts T, X and R in RTC (Did, Cid), and calculates the basic guarantee capability E according to the basic guarantee capability calculation formula.

[0155] Step S1214: the focused node determination module sends a message M5={Did, E, Cid} to the node status storage module.

[0156] Step S1215, the node state storage module receives the message M5, uses the information therein as the node of the binary search tree to generate ET (Did) and stores it.

[0157] Step S1216: After calculating the basic guarantee capability of each node, the focused node determination module sends a maximum basic guarantee capability query message M6={Did} to the node status storage module.

[0158] Step S1217, after receiving M6, the node status storage module searches for the corresponding ET (Did) according to Did, finds the node with the largest basic guarantee capability, obtains its Cid, and updates the node in RST (Cid), sets the ServDid of the corresponding node to Did, and sets the FocusCid field to its own Cid.

[0159] The basic protection capability is defined as the protection capability that a cryptographic resource node can provide to a cryptographic task node. The calculation formula is as follows:

[0160]

[0161] Where T is the transmission delay, R is the amount of resources, X is the task matching degree, and η is the adjustment factor.

[0162] Except for the focus node, all cryptographic resource nodes are peripheral nodes. The distances from the peripheral nodes to all the focus nodes are queried, and the peripheral nodes belong to the focus nodes closest to the peripheral nodes. A circle is drawn with the focus node as the center and the distance between the focus node and the peripheral node farthest from it as the radius to determine the convergence domain of the focus node.

[0163] The focus node is a local optimal node, so the efficiency of finding the optimal solution in the space around the focus node is the highest. The surrounding nodes move closer to the focus node in the convergence domain to find the optimal solution. In this scheme, in each round of iteration, the position of the focus node does not change, but the positions of the surrounding nodes need to change. The surrounding nodes move toward the focus node closest to them, so that the changes in the positions of the surrounding nodes in each round of iteration will not be too large, so as to find the optimal solution faster.

[0164] Specifically, determining the surrounding nodes and the collapsed domain in step S12 includes the following steps:

[0165] Step S1221: The peripheral node determination module sends a query request to the node status storage module to query the status information of all focused nodes.

[0166] Step S1222, after receiving the query request, the node status storage module traverses each node of RST (Cid). If the FOC field of the node is 1, the traversal is stopped and a message M7 = {Cid, COORDINATE (Cid), ServDid} is sent to the surrounding node determination module, where Cid is the Cid of the current node; if the FOC field of the node is 0, no operation is performed and the traversal continues.

[0167] Step S1223, after receiving M7, the surrounding node determination module calculates the distance L_Res between the surrounding nodes and the current focused node, and the calculation results are stored in the binary search tree PFT(Cid1) with {Cid1, L_Res, Cid2} as nodes, where PFT(Cid1) represents the surrounding-focused node relationship tree, Cid1 is the Cid of the surrounding node, Cid2 is the Cid of the focused node, and one surrounding node corresponds to one tree. After the calculation of the current surrounding node is completed, it continues to send requests to the node status storage module.

[0168] Step S1224: After receiving the request, the node status storage module continues to traverse downward according to step S1222, and after traversing all nodes, sends a traversal completion message ACK to the surrounding node determination module.

[0169] Step S1225, after receiving the traversal completion message ACK, the peripheral node determination module traverses each PFT tree and finds the node with the smallest L_Res in each tree to determine the ownership of the peripheral node; and then sends a message M8 = {Cid1, Cid2, L_Res} to the node status storage module;

[0170] Step S1226, the node status storage module receives message M8, stores Cid2 in the FocusCid field of the RST (Cid) corresponding to the current surrounding node, searches for the node in RST (Cid) with Cid2 as the index, compares the value of L_Res with Gather_Range, and if L_Res is larger, updates the value of Gather_Range to L_Res, obtains the value of ServDid, recorded as ServDid0; after the traversal is completed, Gather_Range is the radius of the focus node's convergence domain; searches for the node in RST (Cid) with Cid1 as the index, updates the value of PER in the node to 1, and updates the content of ServDid to ServDid0.

[0171] In one round of iteration, after all cryptographic resource nodes have completed the determination of the focus nodes, peripheral nodes and convergence domains, the protection object of each cryptographic resource node is temporarily determined under the current situation. The single node protection capability is the sum of the basic protection capabilities that can be provided to a certain cryptographic task node by its corresponding focus node and the peripheral nodes in its convergence domain. The stronger the single node protection capability of a certain cryptographic task, the higher the possibility that it can be quickly protected when the cryptographic task node has a cryptographic resource demand. At the same time, the total protection capability of the cryptographic resource node is limited. If some cryptographic task nodes are subject to excessive resource protection, it means that other cryptographic task nodes may not be able to obtain cryptographic resource protection, so the single node protection capability is introduced into the speed update formula. In the iteration, the higher the single node protection capability of a cryptographic task node, the slower the movement speed of the cryptographic resource node to its corresponding focus node, and even does not move to the focus node closest to itself, but instead moves to other focus nodes.

[0172] Specifically, the calculation of the single node assurance capability in step S13 includes the following steps:

[0173] Step S1311: the single node guarantee capability calculation module sends a single node guarantee capability calculation request M9={Did} to the node status storage module.

[0174] Step S1312, after receiving request M9, the node status storage module traverses RST (Cid), and queries the ServDid of each node in RST (Cid) according to the received Did. If the value of ServDid is the same as the received Did, the Cid stored in the node is extracted and stored in the list ListA. ListA stores the Cids of the focus node and surrounding nodes corresponding to the cryptographic task node to be calculated; the Cid stored in the node whose FOC field is 1 is recorded as Cid1 (that is, the Cid of the focus node), and the Cid stored in the node whose FOC field is 0 is stored in the list ListB. ListB stores the Cids of the surrounding nodes in ListA; after traversing all nodes of RST (Cid), execute step S1313.

[0175] Step S1313, the node status storage module queries the corresponding ET (Did) according to the Did in M9, and compares the Cid of the first node in ET (Did) with the Cid in the list ListA. If they are the same, the value of E in the node is extracted and stored in the list ListC. ListC stores the E values ​​of the focused node and surrounding nodes. If they are not the same, continue to query the next node. After traversing all nodes, execute step S1314.

[0176] Step S1314, the node status storage module counts the number of surrounding nodes Count of each focused node according to the list ListA, forms a message M10 = {Count}, and sends it to the focusing weight calculation module; the node status storage module forms a message M11 with the ListC generated in step S1313 and sends it to the single node assurance capability calculation module.

[0177] Step S1315, after receiving M11, the single node guarantee capability calculation module calculates the single node guarantee capability E0 according to the value of E in the list ListC and the single node guarantee capability calculation algorithm.

[0178] Step S1316, calculate the single-node security capability E0 according to the single-node security capability calculation algorithm, and send the calculation result and the Did of the cryptographic task node to form a message M12 = {E0, Did} to the node status storage module; after receiving M12, the node status storage module queries the ServDid field of the focus node (that is, the FOC field of the node is 1) in RST (Cid). If this field is the same as the Did in M12, the received single-node security capability is written into the E0 field of the node queried.

[0179] Step S1317, repeat steps S1311 to S1316 to complete the calculation of the security capabilities of all cryptographic task nodes.

[0180] The formula for calculating the single node guarantee capability E0 is:

[0181] E0=∑E.

[0182] The focus node and its surrounding nodes form a convergence domain, and the nodes in the convergence domain mainly guarantee the cryptographic task nodes corresponding to the focus node. Therefore, when too many surrounding nodes gather around a focus node, the ability of some cryptographic task nodes to be guaranteed will exceed its demand, and some cryptographic task nodes may not be able to obtain resource guarantees. Therefore, the concept of focus weight is introduced in this scheme. The focus weight reflects the weight that the focus node needs other cryptographic resource nodes to gather around it. Introducing the focus weight into the speed update formula will affect the adjustment of the position of the cryptographic resource node. In the iteration of the algorithm, the smaller the focus weight of a focus node, the slower its surrounding nodes approach it, or they do not move towards the focus node closest to themselves, but move towards other focus nodes.

[0183] Specifically, the calculation of the focusing weight in step S13 includes the following steps:

[0184] Step S1321, the focus weight calculation module sends a focus weight calculation request M13 = {Cid} to the node status storage module.

[0185] Step S1322, after receiving the query request M13, the node status storage module queries RST (Cid), queries the number of focused nodes N', and forms the result into a message M14 = {N'}, and returns it to the focus weight calculation module.

[0186] Step S1323: After receiving the message M14, the focus weight calculation module calculates the value according to M14 and M10={Count} received in step S1314. The focusing weight W is calculated according to the focusing weight calculation algorithm, and the focusing weight calculation module sends a message M15={W, Cid} to the node state storage module, including the focusing weight and the Cid of the focusing node to which it belongs.

[0187] Step S1324, after receiving the message M15, the node status storage module queries RST (Cid), finds the corresponding node according to the Cid of M15, and writes the focus weight W into the WEI field of the corresponding node.

[0188] Step S1325, repeating steps S1321 to S1324 until the calculation of the focusing weights of all focusing nodes is completed.

[0189] The focusing weight W calculation algorithm includes:

[0190] Let Wσ be the standard deviation, and its calculation formula is:

[0191]

[0192] Where N′ is the number of focused nodes, N is the average value obtained by dividing the total number of surrounding nodes by the number of focused nodes; i =N i1 +N i3 , N i1 is the number of nodes around the focused node, N i2 is the number of nodes between domains, N i3 is the correction value of the number of nodes between domains, and the correction value calculation formula is: TA and TB are the transmission delays from the inter-domain node to this focused node and to the focused node to which it belongs, respectively.

[0193] Normalize the standard deviation to get the focusing weight calculation formula:

[0194]

[0195] The larger the focusing weight of the focused node, the fewer surrounding nodes there are, and new surrounding nodes need to be added; the smaller the focusing weight of the focused node, the more surrounding nodes there are, and the surrounding nodes need to be migrated out.

[0196] Specifically, the updating speed and position in step S14 includes the following steps:

[0197] Step S141 , the speed and position update module sends a speed and position update request M16 = {Cid} to the node status storage module.

[0198] Step S142, after receiving the request M16, the node status storage module queries RST (Cid), finds the corresponding node in RST (Cid) according to the Cid in M16, obtains the current position from the COORDINATE (Cid) field of the node, obtains the speed value of the previous iteration from the v field, obtains its historical optimal position from the pbest field, and finds the Cid of the corresponding focus node from the FocusCid field of the node.

[0199] Step S143, the node state storage module searches for RST(Cid) according to the Cid of the focused node, obtains the focus weight WEI of the corresponding node and the position COORDINATE(Cid) of the focused node, and the W in the particle speed calculation formula is the value of the WEI field, gbest id The value of the COORDINATE(Cid) field.

[0200] In step S144, the node status storage module combines the information queried in step S142 and step S143 with the single node guarantee capability E0 calculated in step S1315 to form a message M17, and sends it to the speed and position update module.

[0201] Step S145: The speed and position update module receives M17, extracts the data therein, and calculates the speed of this round of iteration according to the speed update formula. If the speed value exceeds V MAX , then set it to V MAX ; Calculate the position of this round of iteration according to the position update formula, and form message M18 to send to the out-of-bounds check and end judgment module.

[0202] Step S146, after the out-of-bounds check and end judgment module receives M18, it judges the received data according to the end condition. If it is out of bounds, the node status storage module is notified. After receiving the message, the node status storage module no longer stores the result data of this round of iteration; if it is not out of bounds, the message is handed over to the node status storage module for storage; if the end condition is met, all modules are notified to end.

[0203] (1) Speed ​​update algorithm

[0204] This algorithm abstracts the cryptographic resource node into a massless particle for research. The particle has only two properties: speed and position. The particle mentioned below refers to the cryptographic resource node. The particle speed is an intermediate variable used for iteration, and the particle position represents the actual position of the cryptographic resource node. The calculation formula of the particle speed is:

[0205]

[0206] The calculation formula is in the third part The focusing weight is introduced in the algorithm, so that the degree of particle aggregation affects the particle speed, avoiding the situation where the cryptographic resource nodes are over-aggregated around a certain cryptographic task node, and realizing load balancing. Compared with the traditional particle swarm algorithm, the fourth part c3r3×(E_need-E0) is added to consider the impact of the single node security capability on the particle speed. The larger the gap in the security capability required by the particle corresponding to the cryptographic task node, the faster the particle moves.

[0207] Where i = 1, 2, ... N, N is the total number of cryptographic resource nodes, k represents the number of iterations, represents the d-th dimension component of the speed of the cryptographic resource node, w represents the inertia weight, which adjusts the convergence speed of the algorithm, c1, c2 and c3 represent acceleration constants, which adjust the maximum learning step size, r1, r2, 23 are random numbers between (0, 1), and pbest idIndicates the historical optimal position of the cryptographic resource node, which represents the position of the cryptographic resource node with the highest historical security capability. is the position of the password resource node after the previous iteration, gbest id It represents the optimal position of the area, that is, the position of the focusing node; W is the focusing weight of the focusing node to which the cryptographic resource node belongs, E_need is the protection capability required by the cryptographic task node served by the cryptographic resource node, and E0 is the current single-node protection capability of the cryptographic task node served by the cryptographic resource node.

[0208] (2) Position update formula

[0209]

[0210] In the formula, T is the time of each iteration, which is the unit time.

[0211] (3) End conditions

[0212] a. The maximum number of iterations is reached.

[0213] b. The difference between the two iterations is less than the set threshold.

[0214] c. Determine whether the current optimal solution is out of bounds. If so, take the previous result that was not out of bounds.

[0215] d. The overall support capability reaches the expected target.

[0216] (4) Overall support capability

[0217] The tasks undertaken by all cryptographic task nodes are pre-evaluated, task weights are assigned, and normalized. The higher the task weight, the higher the resource guarantee priority, which needs to be guaranteed first. The number of cryptographic task nodes is M, the task weight of each node is Qi, and E0 is the single node guarantee capability.

[0218] The overall support capability calculation formula is:

[0219]

[0220] The technical problem to be solved by the present invention is the multi-source and multi-target cryptographic resource scheduling problem. When multiple cryptographic task nodes in a cryptographic service domain have cryptographic resource requirements, the cryptographic resource nodes in the domain are scheduled by the scheduling method provided by the present invention to find the optimal position and overall layout of all cryptographic resource nodes, so that each cryptographic task node can obtain a cryptographic resource response in the shortest possible time when the overall security capability in the service domain meets the requirements. At the same time, it is avoided that the cryptographic resource nodes are too concentrated around a certain cryptographic task node to cause load imbalance.

[0221] It should be noted that, in this article, the terms "comprises", "includes" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or apparatus that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or apparatus.

[0222] Finally, it should be noted that the above is only a preferred embodiment of the present invention, which is only used to illustrate the technical solution of the present invention, and is not used to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A multi-source and multi-target cryptographic resource scheduling method, characterized in that: The cryptographic resource node with the strongest basic protection capability for a cryptographic task node is called the focus node of the cryptographic task node; if a cryptographic resource node is not a focus node, it is called a peripheral node of a focus node, and the peripheral node belongs to the focus node closest to the peripheral node; Draw a circle with the focus node as the center and the distance between the focus node and the surrounding node farthest from it as the radius; this circle is called the convergence domain of the focus node; The single node protection capability is the sum of the basic protection capabilities that can be provided by the corresponding focusing node and the surrounding nodes in the convergence domain for a certain cryptographic task node; the focusing weight is the weight that the focusing node needs other cryptographic resource nodes to gather around it; the basic protection capability is the protection capability that a cryptographic resource node can provide to a certain cryptographic task node; The cryptographic resource scheduling method comprises the following steps: Step 1: Initialize the relevant parameters of the cryptographic resource node and the cryptographic task node, and send these parameters to the node state storage module for storage in the structure of a binary search tree; specifically, it includes: The initialization module generates the identifier Cid of each cryptographic resource node, the identifier Did of each cryptographic task node, and the required security capability E_need of the cryptographic task node; The initialization module randomly generates the initial position COORDINATE(Cid) of each cryptographic resource node within the position boundary; Initialize the module at maximum speed V MAX Randomly generate the initial speed v of each cryptographic resource node within the range of; The initialization module generates the node status RS(Cid) of each cryptographic resource node, RS(Cid) = {Cid, COORDINATE(Cid), v, FOC, PER, WEI, E, E0, ServDid, FocusCid, Gather_Range, pbest}, wherein FOC, PER, WEI, E, E0, Gather_Range are all set to 0, ServDid and FocusCid are set to null, and pbest is set to its historical optimal position; Cid represents the cryptographic resource node identifier, Did represents the cryptographic task node identifier, COORDINATE(Cid) represents the position of the cryptographic resource node, v represents the speed, FOC represents the focus node flag, PER represents the surrounding node flag, WEI represents the focus weight, E represents the basic guarantee capability, E0 represents the single node guarantee capability, ServDid represents the service object identifier, Gather_Range represents the radius of the gathering domain, FocusCid represents the Cid of the focus node to which the cryptographic resource node belongs, and pbest represents the historical optimal position; The initialization module sends a message M1={RS(Cid)} to the node status storage module, where RS(Cid) represents the cryptographic resource node status; The node status storage module receives the message M1, uses each RS (Cid) as a node of the binary search tree to generate and store RST (Cid), where RST (Cid) represents the cryptographic resource node status tree; The initialization module initializes the basic security capability tree ET (Did), and sets the basic security capability E of each node {Did, E, Cid} in the tree to 0; Step 2: determine whether each cryptographic resource node is a focus node or a peripheral node, and determine the convergence domain for each focus node; Step 3: In one round of iteration, when all cryptographic resource nodes have completed the determination of the focus node, peripheral nodes, and convergence domain, for each cryptographic task node, the single node protection capability is calculated, and for each focus node, the focus weight is calculated; Calculating the single node assurance capability includes the following steps: Step A, the single node guarantee capability calculation module sends a single node guarantee capability calculation request M9={Did} to the node status storage module; Step B, after receiving the request M9, the node status storage module traverses the RST (Cid), queries the ServDid of each node in the RST (Cid) according to the received Did, and if the value of the ServDid is the same as the received Did, extracts the Cid stored in the node and stores it in the list ListA, which stores the Cids of the focus node and surrounding nodes corresponding to the cryptographic task node to be calculated; the Cid stored in the node whose FOC field is 1 is recorded as Cid1, and the Cid stored in the node whose FOC field is 0 is stored in the list ListB, which stores the Cids of the surrounding nodes in ListA; after traversing all nodes of the RST (Cid), execute step C; Step C, the node status storage module queries the corresponding ET (Did) according to the Did in M9, and compares the Cid of the first node in ET (Did) with the Cid in ListA. If they are the same, the value of E in the node is extracted and stored in ListC, which stores the E values ​​of the focused node and surrounding nodes; if they are not the same, the next node is queried. After all nodes are traversed, step D is executed; Step D: The node status storage module counts the number of surrounding nodes Count of each focused node according to the list ListA, forms a message M10 = {Count}, and sends it to the focus weight calculation module; the node status storage module forms a message M11 with ListC generated in step C and sends it to the single node assurance capability calculation module; Step E: After receiving M11, the single node guarantee capability calculation module calculates the single node guarantee capability E0 according to the value of E in ListC and the single node guarantee capability calculation algorithm; Step F, calculate the single node security capability E0 according to the single node security capability calculation algorithm, and send the calculation result and the Did of the cryptographic task node to the node state storage module in the form of message M12 = {E0, Did}; after receiving M12, the node state storage module queries the ServDid field of the focus node in RST (Cid), and if this field is the same as the Did in M12, the received single node security capability is written into the E0 field of the node queried; Repeat steps A to F to complete the calculation of the security capabilities of all cryptographic task nodes; Calculating the focus weight includes: The focusing weight calculation module sends a focusing weight calculation request M13 = {Cid} to the node status storage module; After receiving the query request M13, the node status storage module queries RST (Cid), queries the number of focused nodes N′, and forms the result into a message M14 = {N′}, and returns it to the focus weight calculation module; After receiving the message M14, the focus weight calculation module calculates the value according to M14 and M10={Count} received in step D. The focusing weight W is calculated according to the focusing weight calculation algorithm, and the focusing weight calculation module sends a message M15={W, Cid} to the node state storage module, including the focusing weight and the Cid of the focusing node to which it belongs; After receiving the message M15, the node status storage module queries RST (Cid), finds the corresponding node according to the Cid of M15, and writes the focus weight W into the WEI field of the corresponding node; Repeat the above steps until the calculation of the focusing weights of all focusing nodes is completed; The focusing weight W calculation algorithm includes: Remember W σ is the standard deviation, and its calculation formula is: Where N′ is the number of focused nodes, N is the average value obtained by dividing the total number of surrounding nodes by the number of focused nodes; i =N i1 +N i3 , N i1 is the number of nodes around the focused node, N i2 is the number of nodes between domains, N i3 is the correction value of the number of nodes between domains, and the correction value calculation formula is: TA and TB are the transmission delays from the inter-domain node to this focused node and to the focused node to which it belongs, respectively; Normalize the standard deviation to get the focusing weight calculation formula: The larger the focus weight of the focused node, the fewer the surrounding nodes are, and new surrounding nodes need to be added; the smaller the focus weight of the focused node, the more surrounding nodes are in excess, and the surrounding nodes need to be moved out; Step 4: Update the speed of each cryptographic resource node according to the single node protection capability and focus weight. Each cryptographic resource node updates its position according to the calculated speed. After repeated iterations, the optimal position and optimal overall layout of each cryptographic resource node are finally obtained. Updating the speed and position includes the following steps: Step a, the speed and position update module sends a speed and position update request M16={Cid} to the node status storage module; Step b, after receiving the request M16, the node state storage module queries RST (Cid), finds the corresponding node in RST (Cid) according to the Cid in M16, obtains the current position from the COORDINATE (Cid) field of the node, obtains the speed value of the previous iteration from the v field, obtains its historical optimal position from the pbest field, and finds the Cid of the corresponding focus node from the FocusCid field of the node; Step c: The node state storage module searches for RST(Cid) according to the Cid of the focused node, obtains the focus weight WEI of the corresponding node and the position COORDINATE(Cid) of the focused node, and the W in the particle speed calculation formula is the value of the WEI field, gbest id The value of the COORDINATE(Cid) field; Step d, the node status storage module combines the information queried in steps b and c with the single node guarantee capability E0 calculated by the single node guarantee capability calculation module to form a message M17, and sends it to the speed and position update module; Step e: The speed and position update module receives M17, extracts the data therein, and calculates the speed of this round of iteration according to the speed update formula. If the speed value exceeds V MAX , then set it to V MAX ; Calculate the position of this round of iteration according to the position update formula, and form message M18 to send to the cross-border check and end judgment module; Step f, after receiving M18, the cross-border check and end judgment module judges the received data according to the end condition. If it crosses the border, the node state storage module is notified. After receiving the message, the node state storage module no longer stores the result data of this round of iteration; if it does not cross the border, the message is handed over to the node state storage module for storage; if the end condition is met, all modules are notified to end; The speed update formula is: Where i = 1, 2, ... N, N is the total number of cryptographic resource nodes, k represents the number of iterations, represents the d-th dimension component of the speed of the cryptographic resource node, w represents the inertia weight, which adjusts the convergence speed of the algorithm, c1, c2 and c3 represent acceleration constants, which adjust the maximum learning step size, r1, r2, r3 are random numbers between (0, 1), and pbest id Indicates the historical optimal position of the cryptographic resource node, which represents the position of the cryptographic resource node with the highest historical security capability. is the position of the password resource node after the previous iteration, gbest id Indicates the optimal position of the region, that is, the position of the focus node; W is the focus weight of the focus node to which the cryptographic resource node belongs, E_need is the required protection capability of the cryptographic task node served by the cryptographic resource node, and E0 is the current single-node protection capability of the cryptographic task node served by the cryptographic resource node; The position update formula is: In the formula, T is the time of each iteration.

2. The multi-source and multi-target cryptographic resource scheduling method according to claim 1, characterized in that: Initializing the relevant parameters of the cryptographic resource node and the cryptographic task node, and sending these parameters to the node state storage module for storage in a binary search tree structure, comprises the following steps: The initialization module initializes the distance L, transmission delay T, task matching degree X, and resource quantity R of each cryptographic resource node to a single cryptographic task node, generates a resource-task node relationship tuple RTC(Did, Cid), RTC(Did, Cid)={Did, Cid, L, T, X, R}, and sends a message M2={RTC(Did, Cid)} to the node status storage module; The node status storage module receives M2, uses each RTC (Did, Cid) as a node of a binary search tree to generate and store RTCT (Did, Cid), where RTCT (Did, Cid) represents a resource-task node relationship tree.

3. The multi-source and multi-target cryptographic resource scheduling method according to claim 2, characterized in that: Determining the focus node includes: The focused node determination module sends a message M3 = {Did} to the node status storage module; The node state storage module searches the RTCT (Did, Cid) tree for the RTC (Did, Cid) node that matches the current Did according to the received Did, and sends a message M4 = {Did, RTC (Did, Cid)} to the focus node determination module; After receiving M4, the focus node determination module extracts T, X and R in RTC (Did, Cid) and calculates the basic guarantee capability E according to the basic guarantee capability calculation formula; The focused node determination module sends a message M5 = {Did, E, Cid} to the node status storage module; The node status storage module receives the message M5, uses the information therein as the node of the binary search tree to generate ET (Did) and stores it, where ET (Did) represents the basic guarantee capability tree; After calculating the basic guarantee capability of each node, the focus node determination module sends a maximum basic guarantee capability query message M6={Did} to the node status storage module; After receiving M6, the node status storage module searches for the corresponding ET(Did) according to Did, finds the node with the largest basic guarantee capability, obtains its Cid, and updates the node in RST(Cid), setting the ServDid of the corresponding node to Did and the FocusCid field to its own Cid.

4. The multi-source and multi-target cryptographic resource scheduling method according to claim 3, characterized in that: The basic protection capability is defined as the protection capability that a cryptographic resource node can provide to a cryptographic task node, and the calculation formula is as follows: Where T is the transmission delay, R is the amount of resources, X is the task matching degree, and η is the adjustment factor.

5. The multi-source and multi-target cryptographic resource scheduling method according to claim 4, characterized in that: Determining surrounding nodes and collapse domains involves the following steps: Step 1: The peripheral node determination module sends a query request to the node status storage module to query the status information of all focused nodes; Step 2: After receiving the query request, the node status storage module traverses each node of RST(Cid). If the FOC field of the node is 1, the traversal is stopped and a message M7={Cid, COORDINATE(Cid), ServDid} is sent to the surrounding node determination module, where Cid is the Cid of the current node; if the FOC field of the node is 0, no operation is performed and the traversal continues; Step 3, after receiving M7, the surrounding node determination module calculates the distance L_Res between the surrounding nodes and the current focused node, and the calculation results are stored in the binary search tree PFT(Cid1) with {Cid1, L_Res, Cid2} as nodes, where PFT(Cid1) represents the surrounding-focused node relationship tree, Cid1 is the Cid of the surrounding node, Cid2 is the Cid of the focused node, and one surrounding node corresponds to one tree. After the calculation of the current surrounding node is completed, it continues to send a request to the node status storage module; Step 4: After receiving the request, the node status storage module continues to traverse downwards, and after traversing all nodes, sends a traversal completion message ACK to the surrounding node determination module; Step 5: After receiving the traversal completion message ACK, the surrounding node determination module traverses each PFT tree and finds the node with the smallest L_Res in each tree to determine the ownership of the surrounding node; then sends a message M8 = {Cid1, Cid2, L_Res} to the node status storage module; Step 6, the node status storage module receives message M8, stores Cid2 in the FocusCid field of the RST (Cid) corresponding to the current surrounding node, uses Cid2 as the index to search for the node in RST (Cid), compares the value of L_Res with Gather_Range, and if L_Res is larger, updates the value of Gather_Range to L_Res, obtains the value of ServDid, recorded as ServDid0; after the traversal is completed, Gather_Range is the radius of the focus node's convergence domain; uses Cid1 as the index to search for the node in RST (Cid), and updates the value of PER in the node to 1, and updates the content of ServDid to ServDid0.

6. The multi-source and multi-target cryptographic resource scheduling method according to claim 1, characterized in that: The formula for calculating the single node guarantee capability E0 is: E0=∑E.

Images