Edge node switching control method, system, device, equipment, medium and product

Abstract

The present invention discloses a mobile network edge node switching control method, system, device, terminal equipment, storage medium and program product, the method comprising: an MEC management platform receives an application layer security context migration request triggered by an application of a first MEC node, the application layer security context migration request is triggered when a network connection switch occurs during the movement of an application terminal, and the first MEC node providing application services for the application terminal needs to switch to a second MEC node and trigger the migration of the application; according to the application layer security context migration request, the first MEC node collaborates with a security management center to perform dynamic migration of the application layer security context between the first MEC node and the second MEC node. This solution ensures the application security consistency of the mobile communication network MEC service in the mobility scenario, avoids excessive occupation of scarce MEC resources, and can also be scaled on demand according to processing capacity requirements, so as to utilize MEC resources more efficiently.

Description

Technical Field

[0001] The present invention relates to the technical field of mobile network switching services, and in particular to a mobile network edge node switching control method, system, device, terminal equipment, storage medium and program product. Background Art

[0002] For edge computing (MEC) in mobile communication networks, it is necessary to deploy corresponding security measures for application scenarios to reduce security risks. In addition, in order to ensure the consistency of user application security, the security measures and policies of different MEC nodes should also be consistent for the same user during a continuous application use process. In terms of security requirements, due to the support of MEC for user mobility, it also has mobility characteristics. During the user's mobility, the mobile communication network will switch the user's wireless access network base station (such as 5G gNB), user plane service gateway (such as 5G UPF) and control plane access / mobility / session management (such as 5G AMF and SMF) according to the user's connection status and network deployment. This switching may cause the switching of MEC nodes that provide services to users, as well as the migration of the applications used. During the network switching process, the mobile communication network has the ability to synchronously migrate the network layer security context (Security Context) while switching the connection. If the network switching triggers the switching of MEC nodes and the migration of applications, there is also a need to coordinate the migration of MEC nodes and application layer security contexts between the two MEC nodes and the two related application instances to ensure the consistency of user application security.

[0003] At present, the method of statically deploying security protection capabilities and configuring security protection policies on all relevant MEC nodes is usually adopted to ensure application security. That is, security protection capabilities are fully deployed on each MEC node according to local security requirements, and corresponding security protection policies are configured. However, when the terminal undergoes MEC switching due to mobility, there is a lack of coordinated switching of security protection capabilities between different MEC nodes, and the differences in security protection capabilities required by different applications are not considered, resulting in a mismatch between security protection capabilities and security requirements after switching, which cannot meet the on-demand deployment of security protection capabilities and cannot achieve effective utilization of MEC node resources by security protection capabilities. Summary of the invention

[0004] The main purpose of the present invention is to provide a mobile network edge node switching control method, system, device, terminal equipment, storage medium and program product, aiming to realize on-demand deployment and policy configuration of security protection capabilities during MEC application migration, dynamically realize corresponding application layer security context migration, ensure the application security consistency of mobile communication network MEC services in mobility scenarios, and effectively utilize MEC node resources.

[0005] To achieve the above-mentioned object, an embodiment of the present invention provides a mobile network edge node switching control method, the method is applied to an MEC management platform, the MEC management platform is communicatively connected with a security management center, and collaboratively manages a plurality of MEC nodes of the mobile network; the plurality of MEC nodes include at least a first MEC node and a second MEC node, and the method comprises the following steps:

[0006] The MEC management platform receives an application layer security context migration request triggered by an application of the first MEC node, where the application layer security context migration request is triggered when a network connection switch occurs during the movement of the application terminal, and the first MEC node providing application services for the application terminal needs to switch to a second MEC node and trigger application migration;

[0007] According to the application layer security context migration request, collaborate with the security management center to perform dynamic migration of the application layer security context between the first MEC node and the second MEC node.

[0008] Optionally, before the step of the MEC management platform receiving the application layer security context migration request triggered by the application of the first MEC node, the step further includes:

[0009] The MEC management platform receives a MEC node switching and application migration request, which triggers the first MEC node to switch to a second MEC node and perform application migration when a network connection switching occurs in the application terminal movement process;

[0010] According to the MEC node switching and application migration request, the first MEC node is controlled to keep the application running, continue to provide application services for the application terminal, and synchronize the application status with the second MEC node.

[0011] Optionally, the step of performing dynamic migration of the application layer security context between the first MEC node and the second MEC node in collaboration with the security management center according to the application layer security context migration request includes:

[0012] The MEC management platform performs security collaboration and resource collaboration with the security management center based on the application layer security context migration request, and the security management center performs resource management, dynamically deploys, configures and enables the required security capability components on the virtualized infrastructure of the second MEC node on demand, and realizes dynamic migration of the application layer security context between the first MEC node and the second MEC node.

[0013] Optionally, the method further comprises:

[0014] After the dynamic migration of the application layer security context between the first MEC node and the second MEC node is completed, the MEC management platform returns a security context migration response message to the application of the first MEC node;

[0015] Control the second MEC node to provide application services to the application terminal, and control the first MEC node to stop application operation, complete application migration, deactivate relevant security capability components deployed in the first MEC node, and release and recycle virtualized infrastructure resources of the first MEC node.

[0016] Optionally, the security context migration response message includes: security context information updated after the security context migration, so that the application in the first MEC node forwards the updated security context to the application terminal, requiring the application terminal to update the security context.

[0017] Optionally, before the step of the MEC management platform receiving the application layer security context migration request triggered by the application of the first MEC node, the step further includes:

[0018] When a network connection switch occurs during the movement of the application terminal, the MEC management platform interacts with the first MEC node to determine that the first MEC node needs to be switched to the second MEC node.

[0019] The embodiment of the present invention further proposes a mobile network edge node switching control method, the method is applied to a security management center, the security management center is communicatively connected with an MEC management platform, and collaboratively manages a plurality of MEC nodes of the mobile network; the plurality of MEC nodes include at least a first MEC node and a second MEC node, and the method comprises the following steps:

[0020] The security management center receives an application layer security context migration request sent by the MEC management platform, where the application layer security context migration request is triggered when a network connection switch occurs during the movement of the application terminal, and the first MEC node providing application services for the application terminal needs to switch to the second MEC node and trigger the migration of the application;

[0021] According to the application layer security context migration request, collaborate with the MEC management platform to perform dynamic migration of the application layer security context between the first MEC node and the second MEC node.

[0022] Optionally, the step of performing dynamic migration of the application layer security context between the first MEC node and the second MEC node in collaboration with the MEC management platform according to the application layer security context migration request includes:

[0023] The security management center performs security collaboration and resource collaboration with the MEC management platform and performs resource management according to the application layer security context migration request, dynamically deploys, configures and enables the required security capability components on the virtualized infrastructure of the second MEC node on demand, and realizes the dynamic migration of the application layer security context between the first MEC node and the second MEC node.

[0024] Optionally, the security management center includes: a collaboration module and a deployment module;

[0025] The security management center performs security collaboration and resource collaboration with the MEC management platform according to the application layer security context migration request, and performs resource management, and dynamically deploys, configures, and enables required security capability components on the virtualized infrastructure of the second MEC node on demand, and the steps of implementing dynamic migration of the application layer security context between the first MEC node and the second MEC node include:

[0026] The security collaboration function of the collaboration module in the security management center performs security collaboration according to the received application layer security context migration request;

[0027] The security collaboration function forwards the security capability requirements and deployment requirements to the component deployment function of the deployment module in the security management center, requesting that the security capabilities required by the security context be deployed, configured and enabled in the second MEC node according to the deployment requirements;

[0028] The component deployment function sends a resource request to the resource management function of the deployment module to apply for virtualized infrastructure resources required to deploy the relevant security capability components in the second MEC node;

[0029] The resource management function forwards the resource request information to the resource coordination function of the coordination module in the security management center;

[0030] The resource coordination function initiates a resource coordination request to the MEC management platform, applying for allocation of the required virtualized infrastructure resources in the second MEC node. The MEC management platform issues a resource allocation instruction to the second MEC node based on the resource coordination request, and allocates the virtualized infrastructure resources on demand to achieve dynamic migration of application layer security context between the first MEC node and the second MEC node.

[0031] Optionally, the security management center performs security collaboration and resource collaboration with the MEC management platform according to the application layer security context migration request, and performs resource management, and dynamically deploys, configures, and enables required security capability components on the virtualized infrastructure of the second MEC node on demand, and the step of implementing dynamic migration of the application layer security context between the first MEC node and the second MEC node also includes:

[0032] The resource coordination function receives the resource allocation success notification sent by the MEC management platform, notifies the resource management function of the successful application for the required resources, and forwards the resource acquisition and usage parameter information to the resource management function;

[0033] The resource management function sends a resource occupation request to the second MEC node according to the resource acquisition and usage parameter information, requesting to occupy the allocated virtualized infrastructure resources;

[0034] After receiving the response message of successful resource occupation sent by the second MEC node, the resource management function notifies the component deployment function that the required resources are available, and forwards the resource acquisition and usage parameter information to the component deployment function;

[0035] The component deployment function issues a security capability component deployment instruction according to the security context requirements, deploys, configures and enables the required security capability components on the allocated second MEC node resources, and provides application security protection capabilities that meet the security context requirements.

[0036] Optionally, the security management center performs security collaboration and resource collaboration with the MEC management platform according to the application layer security context migration request, and performs resource management, and dynamically deploys, configures, and enables required security capability components on the virtualized infrastructure of the second MEC node on demand, and the step of implementing dynamic migration of the application layer security context between the first MEC node and the second MEC node also includes:

[0037] When the component deployment function receives the security capability component deployment, configuration and activation result returned by the second MEC node, the component deployment function feeds back the security capability component deployment, configuration and activation result to the security collaboration function;

[0038] The security collaboration function feeds back the deployment, configuration and activation results of the security capability component to the MEC management platform, and the MEC management platform returns a security context migration response message to the application of the first MEC node.

[0039] In addition, an embodiment of the present invention further proposes a mobile network edge node switching control system, the system comprising: a security management center and an MEC management platform, the MEC management platform is communicatively connected to the security management center, and collaboratively manages a number of MEC nodes of the mobile network; the MEC management platform manages resources and applications in each MEC node, the security management center manages security capability components in each MEC node, the several MEC nodes include at least a first MEC node and a second MEC node, wherein:

[0040] The MEC management platform is configured to receive an application layer security context migration request triggered by an application of the first MEC node, forward the application layer security context migration request to the security management center, and collaborate with the security management center according to the application layer security context migration request to perform dynamic migration of the application layer security context between the first MEC node and the second MEC node, wherein the application layer security context migration request is triggered when a network connection switching occurs during the movement of the application terminal, and the first MEC node providing application services for the application terminal needs to switch to the second MEC node and trigger the migration of the application;

[0041] The security management center is used to receive an application layer security context migration request sent by the MEC management platform, and collaborate with the MEC management platform according to the application layer security context migration request to perform dynamic migration of the application layer security context between the first MEC node and the second MEC node.

[0042] In addition, an embodiment of the present invention further proposes a mobile network edge node switching control device, which is applied to an MEC management platform, and the MEC management platform is communicatively connected with a security management center to collaboratively manage a plurality of MEC nodes of the mobile network; the plurality of MEC nodes include at least a first MEC node and a second MEC node, and the device includes:

[0043] A first receiving module is used to receive an application layer security context migration request triggered by an application of the first MEC node, where the application layer security context migration request is triggered when a network connection switch occurs during the movement of the application terminal, and the first MEC node providing application services for the application terminal needs to switch to a second MEC node and trigger the migration of the application;

[0044] The first migration module is used to collaborate with the security management center to perform dynamic migration of the application layer security context between the first MEC node and the second MEC node according to the application layer security context migration request.

[0045] In addition, an embodiment of the present invention further proposes a mobile network edge node switching control device, which is applied to a security management center, and the security management center is communicatively connected with an MEC management platform to collaboratively manage a plurality of MEC nodes of the mobile network; the plurality of MEC nodes include at least a first MEC node and a second MEC node, and the device includes:

[0046] A second receiving module is used to receive an application layer security context migration request sent by the MEC management platform, where the application layer security context migration request is triggered when a network connection switch occurs during the movement of the application terminal, and the first MEC node providing application services for the application terminal needs to switch to the second MEC node and trigger the migration of the application;

[0047] The second migration module is used to collaborate with the MEC management platform according to the application layer security context migration request to perform dynamic migration of the application layer security context between the first MEC node and the second MEC node.

[0048] In addition, an embodiment of the present invention also proposes a terminal device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the computer program is executed by the processor, the mobile network edge node switching control method as described above is implemented, or the mobile network edge node switching control method as described above is implemented.

[0049] In addition, an embodiment of the present invention further proposes a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the mobile network edge node switching control method as described above, or the mobile network edge node switching control method as described above, is implemented.

[0050] In addition, an embodiment of the present invention further proposes a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the mobile network edge node switching control method as described above, or the mobile network edge node switching control method as described above.

[0051] The mobile network edge node switching control method, system, apparatus, terminal device, storage medium and program product proposed in the embodiments of the present invention mainly involve dynamic migration of application layer security context between edge computing nodes in mobility scenarios by deploying an MEC management platform and a security management center in a cloud-edge network. The MEC management platform is communicatively connected to the security management center to collaboratively manage several MEC nodes of the mobile network; the several MEC nodes include at least a first MEC node and a second MEC node, wherein the MEC management platform receives an application layer security context migration request triggered by an application of the first MEC node, and the application layer security context migration request is triggered when a network connection switch occurs during the movement of the application terminal, and the first MEC node providing application services for the application terminal needs to switch to the second MEC node and trigger application migration; according to the application layer security context migration request, collaborate with the security management center to perform dynamic migration of application layer security context between the first MEC node and the second MEC node. Therefore, through the collaboration between the security management center and the MEC management platform (MANO: MEC management and orchestration), the on-demand deployment and policy configuration of security protection capability components during the MEC application migration process are realized, and the corresponding application layer security context migration is dynamically realized to ensure the application security consistency of the mobile communication network MEC service in the mobility scenario. Compared with the existing static full deployment of security protection capabilities and configuration of security protection policies, on the one hand, the security protection capability can use MEC resources on demand to avoid excessive occupation of scarce MEC resources, and on the other hand, it can also be scaled on demand according to processing capacity requirements to make more efficient use of MEC resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 This is a functional module diagram of a terminal device to which the mobile network edge node switching control device of the present invention belongs;

[0053] Figure 2 A schematic diagram of the architecture of a mobile network edge node switching control system according to an embodiment of the present invention;

[0054] Figure 3 A flow chart of an exemplary embodiment of a method for controlling a handover of a mobile network edge node according to the present invention;

[0055] Figure 4 A flowchart of another exemplary embodiment of a mobile network edge node handover control method of the present invention;

[0056] Figure 5 A flowchart of another exemplary embodiment of a mobile network edge node handover control method according to the present invention;

[0057] Figure 6A detailed flow chart of an embodiment of a method for controlling handover of a mobile network edge node according to the present invention;

[0058] Figure 7 The figure is a flow chart of another exemplary embodiment of the method for controlling handover of a mobile network edge node according to the present invention.

[0059] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0060] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0061] The main solution of an embodiment of the present invention is: by deploying an MEC management platform and a security management center in a cloud-edge network, it mainly involves dynamic migration of application layer security contexts between edge computing nodes in mobility scenarios. The MEC management platform is communicatively connected to the security management center to collaboratively manage several MEC nodes of the mobile network; the several MEC nodes include at least a first MEC node and a second MEC node, wherein the MEC management platform receives an application layer security context migration request triggered by an application of the first MEC node, and the application layer security context migration request is triggered when a network connection switch occurs during the movement of the application terminal, and the first MEC node that provides application services to the application terminal needs to switch to the second MEC node and trigger application migration; according to the application layer security context migration request, collaborate with the security management center to perform dynamic migration of application layer security contexts between the first MEC node and the second MEC node. Therefore, through the collaboration between the security management center and the MEC management platform (MANO: MEC management and orchestration), the on-demand deployment and policy configuration of security protection capability components during the MEC application migration process are realized, and the corresponding application layer security context migration is dynamically realized to ensure the application security consistency of the mobile communication network MEC service in the mobility scenario. Compared with the existing static full deployment of security protection capabilities and configuration of security protection policies, on the one hand, the security protection capability can use MEC resources on demand to avoid excessive occupation of scarce MEC resources, and on the other hand, it can also be scaled on demand according to processing capacity requirements to make more efficient use of MEC resources.

[0062] Technical terms involved in the embodiments of the present invention:

[0063] MEC (Mobile Edge Computing) is a technology based on the 5G evolution architecture that deeply integrates mobile access networks with Internet services. It sinks computing and processing capabilities to the edge closest to the business. On the one hand, MEC can improve user experience, save bandwidth resources, reduce congestion and burden on core and transmission networks, alleviate network bandwidth pressure, and achieve low latency. On the other hand, by sinking computing power to mobile edge nodes and providing third-party application integration, it provides unlimited possibilities for service innovation at the mobile edge entrance, and can quickly respond to user requests and improve service quality.

[0064] Security context is a temporary state information related to security established by the network for the device, including key information and data protection information, etc. The purpose is to reduce the resource consumption of mutual authentication between the device and the network when switching between different states, so as to facilitate the device to quickly switch from the idle state to the connected state and communicate securely. In mobile communication networks, the migration and management of security contexts need to be considered when the device moves and switches between different access networks. During the migration process, different networks support different cryptographic algorithms, which involves algorithm renegotiation, context identification and storage security. For edge computing (MEC) in mobility scenarios, the concept of security context can be extended to the application layer, that is, to establish temporary state information related to security at the application layer, including application layer key information, application layer data protection information, and application security protection information such as access control and threat detection. Device movement may trigger the switching of MEC nodes and the migration of applications in use. In order to ensure application security consistency, the application layer security context also needs to be migrated synchronously.

[0065] The embodiments of the present invention take into account that, in the existing related solutions, a method of statically deploying security protection capabilities and configuring security protection policies in all relevant MEC nodes is usually adopted to ensure application security, that is, security protection capabilities are fully deployed in each MEC node according to local security requirements, and corresponding security protection policies are configured. However, when the terminal device undergoes MEC switching due to movement, there is a lack of coordinated switching of security protection capabilities between different MEC nodes, and the differences in security protection capabilities required by different applications are not considered, resulting in a mismatch between the security protection capabilities and security requirements after switching, and the on-demand deployment of security protection capabilities cannot be met, and the effective utilization of MEC node resources by security protection capabilities cannot be achieved.

[0066] Among them, the method of statically deploying security protection capabilities and configuring security protection policies on all relevant MEC nodes requires full deployment of the required security protection capabilities and configuration of full security protection policies for the security requirements of all applications supported by MEC. Since different applications running in MEC have different security requirements, different users will also have different security requirements when using the same application. For example (taking data security as an example), in the Internet of Vehicles scenario, real-time traffic query applications and real-time location sharing applications have different security requirements. The former usually only requires ensuring the integrity of the data, that is, only preventing the traffic information from being tampered with; the latter requires both ensuring the integrity of the data and ensuring the confidentiality of the data, preventing the location information from being tampered with, and preventing the location information from being leaked and maliciously tracked; for another example (still taking data security as an example), for ordinary users (such as private cars), the real-time traffic query application only requires ensuring the integrity of the data, but for special users (such as military vehicles), both the integrity and confidentiality of the data must be protected to prevent behavioral analysis of them through interactive content. During the movement of the vehicle, the MEC node providing application services may switch to a new MEC node due to the switching of network connections, triggering the migration of the used applications and ensuring the security of the migrated applications. If the method of statically deploying security protection capabilities and configuring security protection policies is adopted, on the one hand, it will cause a mismatch between security protection capabilities and security requirements, and on the other hand, it will cause excessive consumption of MEC node resources by security protection capabilities.

[0067] Therefore, the embodiment of the present invention proposes a solution. Through the collaboration of the security management center and the MEC management platform (MANO: MEC management and orchestration), on-demand deployment and policy configuration of security protection capabilities in the MEC application migration process can be achieved, and the corresponding application layer security context migration can be dynamically implemented to ensure the application security consistency of MEC services in mobile communication networks in mobility scenarios and effectively utilize MEC node resources.

[0068] Specifically, refer to Figure 1 , Figure 1 The functional module diagram of the terminal device to which the mobile network edge node switching control device of the present invention belongs is shown. The mobile network edge node switching control device can be a device independent of the terminal device and capable of realizing dynamic migration of application layer security context between edge computing nodes in a mobility scenario, which can be carried on the terminal device in the form of hardware or software. The terminal device can be a smart mobile terminal such as a mobile phone or a tablet computer.

[0069] In this embodiment, the terminal device to which the mobile network edge node switching control apparatus belongs includes at least an output module 110 , a processor 120 , a memory 130 and a communication module 140 .

[0070] The memory 130 stores an operating system and a mobile network edge node switching control program. The mobile network edge node switching control device can store information such as an application layer security context migration request triggered by an application of the first MEC node in the memory 130; the output module 110 can be a display screen, a speaker, etc. The communication module 140 can include a WIFI module, a mobile communication module, a Bluetooth module, etc., and communicates with an external device or server through the communication module 140.

[0071] As an embodiment, when the mobile network edge node switching control program in the memory 130 is executed by the processor, the following steps are implemented:

[0072] The MEC management platform receives an application layer security context migration request triggered by an application of the first MEC node, where the application layer security context migration request is triggered when a network connection switch occurs during the movement of the application terminal, and the first MEC node providing application services for the application terminal needs to switch to the second MEC node and trigger the migration of the application;

[0073] According to the application layer security context migration request, collaborate with the security management center to perform dynamic migration of the application layer security context between the first MEC node and the second MEC node.

[0074] Furthermore, when the mobile network edge node switching control program in the memory 130 is executed by the processor, the following steps are also implemented:

[0075] The MEC management platform receives a MEC node switching and application migration request that triggers the first MEC node to switch to a second MEC node and perform application migration when a network connection switch occurs in the application terminal movement process;

[0076] According to the MEC node switching and application migration request, the first MEC node is controlled to keep the application running, continue to provide application services for the application terminal, and synchronize the application status with the second MEC node.

[0077] Furthermore, when the mobile network edge node switching control program in the memory 130 is executed by the processor, the following steps are also implemented:

[0078] The MEC management platform performs security collaboration and resource collaboration with the security management center based on the application layer security context migration request, and the security management center performs resource management, dynamically deploys, configures and enables the required security capability components on the virtualized infrastructure of the second MEC node on demand, and realizes dynamic migration of the application layer security context between the first MEC node and the second MEC node.

[0079] Furthermore, when the mobile network edge node switching control program in the memory 130 is executed by the processor, the following steps are also implemented:

[0080] After the dynamic migration of the application layer security context between the first MEC node and the second MEC node is completed, the MEC management platform returns a security context migration response message to the application of the first MEC node;

[0081] Control the second MEC node to provide application services to the application terminal, and control the first MEC node to stop application operation, complete application migration, deactivate relevant security capability components deployed in the first MEC node, and release and recycle virtualized infrastructure resources of the first MEC node.

[0082] Furthermore, when the mobile network edge node switching control program in the memory 130 is executed by the processor, the following steps are also implemented:

[0083] When a network connection switch occurs during the movement of the application terminal, the MEC management platform interacts with the first MEC node to determine that the first MEC node needs to be switched to the second MEC node.

[0084] As an embodiment, when the mobile network edge node switching control program in the memory 130 is executed by the processor, the following steps are implemented:

[0085] The security management center receives an application layer security context migration request sent by the MEC management platform, where the application layer security context migration request is triggered when a network connection switch occurs during the movement of the application terminal, and the first MEC node providing application services for the application terminal needs to switch to the second MEC node and trigger the migration of the application;

[0086] According to the application layer security context migration request, collaborate with the MEC management platform to perform dynamic migration of the application layer security context between the first MEC node and the second MEC node.

[0087] Furthermore, when the mobile network edge node switching control program in the memory 130 is executed by the processor, the following steps are also implemented:

[0088] The security management center performs security collaboration and resource collaboration with the MEC management platform and performs resource management according to the application layer security context migration request, dynamically deploys, configures and enables the required security capability components on the virtualized infrastructure of the second MEC node on demand, and realizes the dynamic migration of the application layer security context between the first MEC node and the second MEC node.

[0089] Furthermore, when the mobile network edge node switching control program in the memory 130 is executed by the processor, the following steps are also implemented:

[0090] The security management center performs security collaboration and resource collaboration with the MEC management platform according to the application layer security context migration request, and performs resource management, and dynamically deploys, configures, and enables required security capability components on the virtualized infrastructure of the second MEC node on demand, and the steps of implementing dynamic migration of the application layer security context between the first MEC node and the second MEC node include:

[0091] The security collaboration function of the collaboration module in the security management center performs security collaboration according to the received application layer security context migration request;

[0092] The security collaboration function forwards the security capability requirements and deployment requirements to the component deployment function of the deployment module in the security management center, requesting that the security capabilities required by the security context be deployed, configured and enabled in the second MEC node according to the deployment requirements;

[0093] The component deployment function sends a resource request to the resource management function of the deployment module to apply for virtualized infrastructure resources required to deploy the relevant security capability components in the second MEC node;

[0094] The resource management function forwards the resource request information to the resource coordination function of the coordination module in the security management center;

[0095] The resource coordination function initiates a resource coordination request to the MEC management platform, applying for allocation of the required virtualized infrastructure resources in the second MEC node. The MEC management platform issues a resource allocation instruction to the second MEC node based on the resource coordination request, and allocates the virtualized infrastructure resources on demand to achieve dynamic migration of application layer security context between the first MEC node and the second MEC node.

[0096] Furthermore, when the mobile network edge node switching control program in the memory 130 is executed by the processor, the following steps are also implemented:

[0097] The resource coordination function receives the resource allocation success notification sent by the MEC management platform, notifies the resource management function of the successful application for the required resources, and forwards the resource acquisition and usage parameter information to the resource management function;

[0098] The resource management function sends a resource occupation request to the second MEC node according to the resource acquisition and usage parameter information, requesting to occupy the allocated virtualized infrastructure resources;

[0099] After receiving the response message of successful resource occupation sent by the second MEC node, the resource management function notifies the component deployment function that the required resources are available, and forwards the resource acquisition and usage parameter information to the component deployment function;

[0100] The component deployment function issues a security capability component deployment instruction according to the security context requirements, deploys, configures and enables the required security capability components on the allocated second MEC node resources, and provides application security protection capabilities that meet the security context requirements.

[0101] Furthermore, when the mobile network edge node switching control program in the memory 130 is executed by the processor, the following steps are also implemented:

[0102] When the component deployment function receives the security capability component deployment, configuration and activation result returned by the second MEC node, the component deployment function feeds back the security capability component deployment, configuration and activation result to the security collaboration function;

[0103] The security collaboration function feeds back the deployment, configuration and activation results of the security capability component to the MEC management platform, and the MEC management platform returns a security context migration response message to the application of the first MEC node.

[0104] This embodiment, through the above scheme, deploys the MEC management platform and the security management center in the cloud edge network, mainly involving the dynamic migration of application layer security context between edge computing nodes in the mobility scenario, the MEC management platform and the security management center are connected in communication, and jointly manage several MEC nodes of the mobile network; the several MEC nodes include at least the first MEC node and the second MEC node, wherein the MEC management platform receives the application layer security context migration request triggered by the application of the first MEC node, and the application layer security context migration request is triggered when the network connection switching occurs during the movement of the application terminal, and the first MEC node providing application services for the application terminal needs to switch to the second MEC node and trigger the migration of the application; according to the application layer security context migration request, the security management center is coordinated to perform the dynamic migration of the application layer security context between the first MEC node and the second MEC node. Therefore, through the collaboration of the security management center and the MEC management platform (MANO: MEC management and orchestration), the on-demand deployment and policy configuration of the security protection capability component in the MEC application migration process are realized, the corresponding application layer security context migration is dynamically realized, and the application security consistency of the mobile communication network MEC service in the mobility scenario is ensured. Compared with the existing solution of statically deploying security protection capabilities and configuring security protection policies, on the one hand, security protection capabilities can use MEC resources on demand to avoid excessive occupation of scarce MEC resources; on the other hand, they can also be scaled on demand according to processing capacity requirements, making more efficient use of MEC resources.

[0105] Reference Figure 2 , Figure 2 The present invention is a schematic diagram of the architecture of a mobile network edge node switching control system according to an embodiment of the present invention.

[0106] In the embodiment of the present invention, a security system architecture for the MEC security protection system is first established, and then the dynamic migration process of the application layer security context is implemented on this basis. The security system architecture is an easily expandable system architecture that can support the dynamic migration of the application layer security context. From the perspective of MEC security protection capabilities, it comprehensively considers the security challenges and security demand characteristics faced by MEC, establishes a security management center, and provides a variety of functional modules such as security capability management, orchestration, deployment, monitoring and collaboration; provides specific MEC security protection capabilities for specific security needs, and deploys pooled security components that adapt to different MEC landing forms; while managing and providing security capabilities, it realizes a collaborative interface with the MEC management platform to support the dynamic migration of application layer security contexts between edge computing nodes in mobility scenarios.

[0107] The mobile network edge node referred to in this embodiment is an edge computing node of a mobile communication network.

[0108] like Figure 2 As shown, the system architecture supporting dynamic migration of application layer security context between edge computing nodes in mobility scenarios is deployed in a cloud-edge network. The system includes: a security management center and an MEC management platform. The MEC management platform is connected to the security management center in communication. Several MEC nodes ( Figure 2 (shown as MEC#1 and MEC#2 in the figure), each MEC node is deployed with MEC applications, security capability components and virtualized infrastructure, the security capability components include pooled security components, the MEC management platform and the security management center jointly manage several MEC nodes of the mobile network, wherein the MEC management platform manages resources and applications in each MEC node, and the security management center manages the security capability components in each MEC node, and the several MEC nodes include at least a first MEC node (MEC#1) and a second MEC node (MEC#2), wherein:

[0109] The security management center is deployed with a collaboration module and a deployment module. The collaboration module includes resource collaboration functions and security collaboration functions, and the deployment module includes resource management functions and component deployment functions.

[0110] The MEC management platform is configured to receive an application layer security context migration request triggered by an application of the first MEC node, forward the application layer security context migration request to the security management center, and collaborate with the security management center according to the application layer security context migration request to perform dynamic migration of the application layer security context between the first MEC node and the second MEC node, wherein the application layer security context migration request is triggered when a network connection switching occurs during the movement of the application terminal, and the first MEC node providing application services for the application terminal needs to switch to the second MEC node and trigger the migration of the application;

[0111] The security management center is used to receive an application layer security context migration request sent by the MEC management platform, and collaborate with the MEC management platform according to the application layer security context migration request to perform dynamic migration of the application layer security context between the first MEC node and the second MEC node.

[0112] Specifically, the system architecture provided in this embodiment adopts a cloud-edge collaboration model, and the system architecture includes a security management center and an MEC management platform. The security management center is deployed in a cloud computing environment (such as a core cloud) on the core side of the network, and centrally manages and controls the security capability components of many MECs (only MEC#1 and MEC#2 are shown in the figure) deployed on the edge of the network. When it is necessary to support dynamic migration of application layer contexts between edge computing nodes in mobility scenarios, the security management center needs to collaborate with the MEC management platform.

[0113] The security management center manages, orchestrates, deploys and monitors various security capability components in each MEC node as needed. Security capability components report and upload security events and security logs to the security management center in accordance with management policies, and apply for virtualized infrastructure resources to the security management center when necessary (for example, deploying pooled security components or expanding or shrinking security processing capabilities when migrating security contexts).

[0114] In general, the security management center provides functional modules such as security capability management, security capability orchestration, security capability deployment, security operation monitoring, and security capability collaboration. In view of the dynamic migration of application layer security context between edge computing nodes in mobility scenarios, the security management center conducts security collaboration and resource collaboration with the MEC management platform through collaboration modules and deployment modules. Security collaboration meets the security context migration requirements during MEC service switching, and resource collaboration meets the requirements of deploying security capability components on the virtualized infrastructure of MEC and resource allocation and recovery when scaling security capabilities on demand.

[0115] The security capability component provides various security protection capabilities required to ensure the safe operation of mobile communication network MEC and its applications. For the dynamic migration of application layer security context between edge computing nodes in mobility scenarios, the security capability component provides pooled security components on the MEC side. Pooled security components are virtualized security capability components that support the concept of software-defined security (SDSec) and can be dynamically deployed on demand in the MEC environment to provide local security protection services.

[0116] MEC provides virtualized infrastructure resources, which are centrally managed by the mobile edge computing MEC management platform (MANO), and can provide the resources required to deploy and run applications and security capability components.

[0117] In the mobility scenario, the application terminal switches the network connection during the movement, triggering the switching of the MEC node providing the application and the migration of the application. Accordingly, the application layer security context also needs to be migrated synchronously. The security management center collaborates with the MEC management platform to allocate the corresponding MEC virtualization infrastructure resources, deploy, configure and enable the pooled security components required in the security capability components, and realize the dynamic migration of the application layer security context.

[0118] Therefore, through the collaboration between the security management center and the MEC management platform (MANO: MEC management and orchestration), the on-demand deployment and policy configuration of security protection capability components during the MEC application migration process are realized, and the corresponding application layer security context migration is dynamically realized to ensure the application security consistency of the mobile communication network MEC service in the mobility scenario. Compared with the existing static full deployment of security protection capabilities and configuration of security protection policies, on the one hand, the security protection capability can use MEC resources on demand to avoid excessive occupation of scarce MEC resources, and on the other hand, it can also be scaled on demand according to processing capacity requirements to make more efficient use of MEC resources.

[0119] Based on the above terminal device and system architecture but not limited to the above architecture, an embodiment of the method of the present invention is proposed.

[0120] Reference Figure 3 , Figure 3 The present invention is a flowchart of an exemplary embodiment of a method for controlling the switching of a mobile network edge node. The method for controlling the switching of a mobile network edge node is applied to an MEC management platform, the MEC management platform is connected to a security management center for communication, and collaboratively manages a number of MEC nodes of the mobile network; the number of MEC nodes include at least a first MEC node and a second MEC node, and the method includes the following steps:

[0121] Step S101, the MEC management platform receives an application layer security context migration request triggered by an application of the first MEC node, wherein the application layer security context migration request is triggered when a network connection switch occurs during the movement of the application terminal, and the first MEC node providing application services for the application terminal needs to switch to a second MEC node and trigger the migration of the application;

[0122] Specifically, during the movement of the application terminal, if the network connection is switched, the mobile communication network will dynamically complete the network connection switch and the corresponding network layer security context migration. If the network connection switch triggers the MEC node switch, it is necessary to dynamically perform application migration and the corresponding application layer security context migration. After the migration is completed, the application will continue to run on the new MEC node. Before the MEC node switch and the corresponding application switch are completed, the original MEC will keep the application running and synchronize the application status with the new MEC node.

[0123] The solution of this embodiment mainly involves the dynamic migration of application layer security context between edge computing nodes in a mobility scenario.

[0124] As described above, based on the system architecture supporting dynamic migration of application layer security context between edge computing nodes in mobility scenarios proposed in the embodiment of the present invention, the deployment module (including resource management function and component deployment function) and the collaboration module (including resource collaboration function and security collaboration function) of the security management center are deployed in the cloud, and the pooled security components of the security capability components are deployed on the MEC node. When the network connection switching of the application terminal triggers the MEC node switching and application migration, and the application layer security context migration needs to be performed, the security management center performs security collaboration and resource collaboration with the MEC management platform through the collaboration module, performs resource management and component deployment through the deployment module, and dynamically deploys, configures and enables the required pooled security components on demand on the virtualized infrastructure of the new MEC node, so as to realize the dynamic migration of the application layer security context of the MEC application in the mobility scenario. The MEC management platform manages the resources and applications in each MEC, and the security management center manages the pooled security components in each MEC node.

[0125] In this embodiment, when a network connection switch occurs during the movement of an application terminal, the first MEC node that provides application services for the application terminal needs to switch to the second MEC node and trigger application migration, while triggering an application layer security context migration request. The MEC management platform receives the application layer security context migration request triggered by the application of the first MEC node.

[0126] When a network connection switch occurs during the movement of the application terminal, the MEC management platform interacts with the first MEC node to determine that the first MEC node needs to be switched to the second MEC node.

[0127] Step S102: According to the application layer security context migration request, collaborate with the security management center to perform dynamic migration of the application layer security context between the first MEC node and the second MEC node.

[0128] Specifically, after receiving the application layer security context migration request, the MEC management platform performs security collaboration and resource collaboration with the security management center based on the application layer security context migration request, and the security management center performs resource management, and dynamically deploys, configures and enables the required security capability components on the virtualized infrastructure of the second MEC node on demand, thereby realizing dynamic migration of the application layer security context between the first MEC node and the second MEC node.

[0129] Specifically, the security management center conducts security and resource collaboration with the MEC management platform through the collaboration module, performs resource management and component deployment through the deployment module, and dynamically deploys, configures, and enables the required pooled security components on demand on the virtualized infrastructure of the new MEC node, thereby realizing the dynamic migration of the application layer security context of MEC applications in mobility scenarios.

[0130] This embodiment, through the above scheme, deploys the MEC management platform and the security management center in the cloud edge network, mainly involving the dynamic migration of application layer security context between edge computing nodes in the mobility scenario, the MEC management platform and the security management center are connected in communication, and jointly manage several MEC nodes of the mobile network; the several MEC nodes include at least the first MEC node and the second MEC node, wherein the MEC management platform receives the application layer security context migration request triggered by the application of the first MEC node, and the application layer security context migration request is triggered when the network connection switching occurs during the movement of the application terminal, and the first MEC node providing application services for the application terminal needs to switch to the second MEC node and trigger the migration of the application; according to the application layer security context migration request, the security management center is coordinated to perform the dynamic migration of the application layer security context between the first MEC node and the second MEC node. Therefore, through the collaboration of the security management center and the MEC management platform (MANO: MEC management and orchestration), the on-demand deployment and policy configuration of the security protection capability component in the MEC application migration process are realized, the corresponding application layer security context migration is dynamically realized, and the application security consistency of the mobile communication network MEC service in the mobility scenario is ensured. Compared with the existing solution of statically deploying security protection capabilities and configuring security protection policies, on the one hand, security protection capabilities can use MEC resources on demand to avoid excessive occupation of scarce MEC resources; on the other hand, they can also be scaled on demand according to processing capacity requirements, making more efficient use of MEC resources.

[0131] Reference Figure 4 , Figure 4 FIG. 1 is a flow chart of another exemplary embodiment of the method for controlling the handover of a mobile network edge node according to the present invention. Figure 3In the embodiment shown, in the above step S101, before the MEC management platform receives the application layer security context migration request triggered by the application of the first MEC node, the embodiment also includes:

[0132] Step S1001, the MEC management platform receives a MEC node switching and application migration request, which triggers the first MEC node to switch to a second MEC node and perform application migration when a network connection switch occurs in the application terminal movement process;

[0133] Step S1002: According to the MEC node switching and application migration request, the first MEC node is controlled to keep the application running, continue to provide application services for the application terminal, and synchronize the application status with the second MEC node.

[0134] Compared with the above embodiment, this embodiment also includes processing of MEC node switching and application migration requests.

[0135] Specifically, when the network connection switching of the application terminal triggers the MEC node switching and application migration, the application of the first MEC node where the application terminal is currently located sends a MEC node switching and application migration request to the MEC management platform, indicating that the first MEC node needs to switch to the second MEC node and perform application migration. When the network connection switching occurs during the movement of the application terminal, the MEC management platform interacts with the first MEC node to determine that the first MEC node needs to switch to the second MEC node.

[0136] The MEC management platform receives the MEC node switching and application migration request sent by the application of the first MEC node, and controls the first MEC node to keep the application running and continue to provide application services for the application terminal according to the MEC node switching and application migration request, and controls the first MEC node to synchronize the application status with the second MEC node. That is, before the MEC node switching and the corresponding application switching are completed, the original MEC will keep the application running and synchronize the application status with the new MEC node.

[0137] Through the above scheme, this embodiment deploys an MEC management platform and a security management center in a cloud-edge network, which mainly involves dynamic migration of application layer security contexts between edge computing nodes in mobility scenarios. The MEC management platform is connected to the security management center for communication, and collaboratively manages a number of MEC nodes in the mobile network; the several MEC nodes include at least a first MEC node and a second MEC node, wherein the MEC management platform receives an application of the first MEC node, and when a network connection switch occurs during the movement of the application terminal, the MEC management platform triggers a MEC node switching and application migration request that the first MEC node needs to switch to the second MEC node and perform application migration; according to the MEC node switching and application Migration request, control the first MEC node to keep the application running, continue to provide application services for the application terminal, and synchronize the application status with the second MEC node; the MEC management platform receives the application layer security context migration request triggered by the application of the first MEC node, the application layer security context migration request is triggered when the network connection switching occurs during the movement of the application terminal, and the first MEC node providing application services for the application terminal needs to switch to the second MEC node and trigger the migration of the application; according to the application layer security context migration request, collaborate with the security management center to perform dynamic migration of the application layer security context between the first MEC node and the second MEC node. Therefore, through the collaboration of the security management center and the MEC management platform (MANO: MEC management and orchestration), the on-demand deployment and policy configuration of the security protection capability component in the MEC application migration process are realized, the corresponding application layer security context migration is dynamically realized, and the application security consistency of the mobile communication network MEC service in the mobility scenario is ensured. Compared with the existing solution of statically deploying security protection capabilities and configuring security protection policies, on the one hand, security protection capabilities can use MEC resources on demand to avoid excessive occupation of scarce MEC resources; on the other hand, they can also be scaled on demand according to processing capacity requirements, making more efficient use of MEC resources.

[0138] Reference Figure 5 , Figure 5 FIG. 1 is a flow chart of another exemplary embodiment of the mobile network edge node switching control method of the present invention. Figure 4 In the embodiment shown, in this embodiment, the method further includes:

[0139] Step S103: After the dynamic migration of the application layer security context between the first MEC node and the second MEC node is completed, the MEC management platform returns a security context migration response message to the application of the first MEC node;

[0140] Among them, the security context migration response message includes: security context information updated after the security context migration. After the application of the first MEC node receives the security context migration response message returned by the MEC management platform, it forwards the updated security context to the application terminal and requires the application terminal to update the security context.

[0141] Step S104, controlling the second MEC node to provide application services to the application terminal, and controlling the first MEC node to stop application operation, complete application migration, deactivate relevant security capability components deployed in the first MEC node, and release and recycle virtualized infrastructure resources of the first MEC node.

[0142] After the dynamic migration of the application layer security context between the first MEC node and the second MEC node is completed, the MEC management platform controls the second MEC node to provide application services to the application terminal, and controls the first MEC node to stop the application running, complete the application migration, deactivate the relevant security capability components deployed in the first MEC node, release and recycle the virtualization infrastructure resources of the first MEC node, that is, after the migration is completed, the application will continue to run on the new MEC node (the second MEC node).

[0143] Therefore, through the collaboration between the security management center and the MEC management platform (MANO: MEC management and orchestration), the on-demand deployment and policy configuration of security protection capability components during the MEC application migration process are realized, and the corresponding application layer security context migration is dynamically realized to ensure the application security consistency of the mobile communication network MEC service in the mobility scenario. Compared with the existing static full deployment of security protection capabilities and configuration of security protection policies, on the one hand, the security protection capability can use MEC resources on demand to avoid excessive occupation of scarce MEC resources, and on the other hand, it can also be scaled on demand according to processing capacity requirements to make more efficient use of MEC resources.

[0144] The following combination Figure 6 , the implementation process of dynamic migration of security context in this embodiment is described in detail:

[0145] like Figure 6 As shown, the implementation process of dynamic security context migration in this embodiment includes three stages, namely, a migration triggering stage, a migration execution stage, and a post-migration processing stage.

[0146] In the migration triggering phase, the movement of the application terminal causes its network connection to switch, triggering the switching of the MEC node (MEC#1) that provides application services for it, thereby triggering the migration of applications between the new MEC node (MEC#2) and the original MEC node (MEC#1) and the associated application layer security context migration.

[0147] During the migration execution phase, the applications in the original MEC nodes are migrated to the MEC management platform ( Figure 6 The MANO in the application layer initiates an application layer security context migration request, and the MANO collaborates with the security management center to perform the security context migration process.

[0148] In the post-migration processing phase, the migration of applications and their security contexts is completed, and the application terminals begin to interact with the applications in the new MEC nodes. The applications and related security capabilities in the original MEC nodes will be deactivated, and the MEC virtualization infrastructure resources in the original MEC nodes will be released and recycled.

[0149] The following describes in detail the implementation process of dynamic security context migration, including:

[0150] 1.1 Initial application interaction: Assuming that the application terminal uses the application service provided by MEC#1 at the beginning, in the process of end-to-end application security protection, in addition to the security protection capabilities provided by the application itself, the security protection capabilities provided by the pooled security components in MEC#1 are also used. During the application operation, the security protection capabilities provided by the network may also be used, but it is not related to the application layer security context migration and will not be detailed here.

[0151] 1.2 Network connection switching triggers MEC node switching and application migration: When the application terminal switches the network connection during the mobile process and triggers MEC node switching and application migration, MEC#1 will interact with MANO to decide which MEC node to switch to. Assume that Figure 6 As shown in , MEC#2 is selected, and then MEC#1 starts the process of migrating the application to MEC#2 (application migration is implemented based on the MEC application layer migration mechanism). If the application migration involves the migration of related security contexts, MEC#1 will start the dynamic migration process of the security context. Please refer to the description below for the dynamic migration process of the security context. In order to make the description more concise, the solution of the present invention only considers the security protection capabilities provided by the pooled security components involved in the security context migration process. By default, the migration of the security protection capabilities provided by the application itself is completed in the application state synchronization (step 1.3).

[0152] 1.3 Maintain application services and synchronize application status: Before the migration of the application and its related security context is completed, the application in MEC#1 continues to provide services to the application terminal and synchronizes the application status to the application in MEC#2.

[0153] 2.1 Request security context migration: The application in MEC#1 sends security context related information to MANO, requesting security context migration to the corresponding application in MEC#2.

[0154] 2.2 Request security collaboration: MANO forwards the relevant information to the security collaboration function of the collaboration module in the security management center, and requests to complete the dynamic migration of security context between the corresponding applications of MEC#1 and MEC#2 through security collaboration.

[0155] 2.3 Request deployment: The security collaboration function forwards the security capability requirements and deployment requirements to the component deployment function of the deployment module in the security management center, requesting that the security capabilities required by the security context be deployed, configured, and enabled in MEC#2 according to the deployment requirements.

[0156] 2.4 Requesting resources: If the resources in MEC are also dynamically allocated, the component deployment function sends a resource request to the resource management function of the deployment module to apply for the MEC virtualization infrastructure resources required to deploy the relevant security components in MEC#2.

[0157] 2.5 Requesting resources: The resource management function forwards the resource request information to the resource coordination function of the coordination module in the security management center.

[0158] 2.6 Request resource coordination: The resource coordination function initiates a resource coordination request to MANO to apply for the allocation of the required MEC infrastructure resources in MEC#2.

[0159] 2.7 Resource Allocation: MANO issues resource allocation instructions to MEC#2 based on the request of the resource coordination function, and allocates MEC virtualized infrastructure resources on demand.

[0160] 2.8 Resource allocation response: MEC#2 feeds back the resource allocation result (including resource acquisition and usage parameters, etc.) to MANO. It is assumed here that the resource allocation is successful.

[0161] 2.9 Resource coordination response: MANO notifies the resource coordination function of successful resource allocation and forwards information such as resource acquisition and usage parameters.

[0162] 2.10 Resource response: The resource coordination function notifies the resource management function that the required resource application is successful, and forwards information such as resource acquisition and usage parameters.

[0163] 2.11 Request for resource occupation: The resource management function sends a resource occupation request to MEC#2 based on the resource acquisition and usage information, requesting to occupy the allocated MEC virtualization infrastructure resources.

[0164] 2.12 Resource occupation response: MEC#2 returns the resource occupation result. It is assumed here that the resource occupation is successful.

[0165] 2.13 Resource response: The resource management function notifies the component deployment function that the resources required are available and forwards resource acquisition and usage parameter information.

[0166] 2.14 On-demand deployment of security components: The component deployment function issues pooled security component deployment instructions based on security context requirements, deploys, configures, and enables the required pooled security components on the allocated MEC#2 resources, and provides application security protection capabilities that meet security context requirements.

[0167] 2.15 Security component deployment response: MEC#2 feeds back the deployment, configuration, and activation results of the security component to the component deployment function. It is assumed that all operations are successful.

[0168] 2.16 Deployment Response: The component deployment function feeds back the security component deployment, configuration, and activation results to the security collaboration function.

[0169] 2.17 Security Collaboration Response: The security collaboration function feeds back the security component deployment, configuration, and activation results to MANO.

[0170] 2.18 Security context migration response: MANO notifies the application in MEC#1 that the relevant security context migration process is successful, confirming that the dynamic migration of the security context is complete. Because some information in the security context after migration may change (such as encryption key update, etc.), MANO also forwards the updated security context information after migration to the application in MEC#1.

[0171] 2.19 Security context update: The application in MEC#1 forwards the updated security context to the application terminal, requiring the application terminal to update the security context.

[0172] 2.20 Update response: The application terminal feeds back the security context update result to the application in MEC#1. It is assumed here that the update is successful.

[0173] 3.1 Application information change: After the application migration and its related security context dynamic migration are completed, the application in MEC#1 sends the application change information to the application terminal, notifying the application terminal that the application has been migrated to MEC#2. The application terminal establishes a connection with the application in MEC#2 based on the application change information.

[0174] 3.2 Terminate application services and complete application migration: The application in MEC#1 stops providing services, and the application migration process ends. If the application is also dynamically deployed and enabled, subsequent operations such as application deactivation and resource release and recycling are performed.

[0175] 3.3 New application interaction: The application terminal terminates the interaction with the application in MEC#1 and continues to interact with the corresponding application in MEC#2.

[0176] 3.4 Deactivate security capabilities and release resources: After the migration of the application and its security context is completed, deactivate the relevant pooled security capabilities deployed in MEC#1 and release the MEC virtualization infrastructure resources occupied by it.

[0177] 3.5 Resource recovery: MANO recovers the released resources in MEC#1 to meet other resource requirements.

[0178] This embodiment, through the above scheme, deploys the MEC management platform and the security management center in the cloud edge network, mainly involving the dynamic migration of application layer security context between edge computing nodes in the mobility scenario, the MEC management platform and the security management center are connected in communication, and jointly manage several MEC nodes of the mobile network; the several MEC nodes include at least the first MEC node and the second MEC node, wherein the MEC management platform receives the application layer security context migration request triggered by the application of the first MEC node, and the application layer security context migration request is triggered when the network connection switching occurs during the movement of the application terminal, and the first MEC node providing application services for the application terminal needs to switch to the second MEC node and trigger the migration of the application; according to the application layer security context migration request, the security management center is coordinated to perform the dynamic migration of the application layer security context between the first MEC node and the second MEC node. Therefore, through the collaboration of the security management center and the MEC management platform (MANO: MEC management and orchestration), the on-demand deployment and policy configuration of the security protection capability component in the MEC application migration process are realized, the corresponding application layer security context migration is dynamically realized, and the application security consistency of the mobile communication network MEC service in the mobility scenario is ensured. Compared with the existing solution of statically deploying security protection capabilities and configuring security protection policies, on the one hand, security protection capabilities can use MEC resources on demand to avoid excessive occupation of scarce MEC resources; on the other hand, they can also be scaled on demand according to processing capacity requirements, making more efficient use of MEC resources.

[0179] In addition, if Figure 7 As shown, Figure 7 The figure is a flow chart of another exemplary embodiment of the method for controlling handover of a mobile network edge node according to the present invention.

[0180] The method is applied to a security management center, the security management center is connected to the MEC management platform for communication, and collaboratively manages a plurality of MEC nodes of the mobile network; the plurality of MEC nodes include at least a first MEC node and a second MEC node, and the method comprises the following steps:

[0181] Step S201, the security management center receives an application layer security context migration request sent by the MEC management platform, where the application layer security context migration request is triggered when a network connection switch occurs during the movement of the application terminal, and the first MEC node providing application services for the application terminal needs to switch to the second MEC node and trigger the migration of the application;

[0182] Specifically, during the movement of the application terminal, if the network connection is switched, the mobile communication network will dynamically complete the network connection switch and the corresponding network layer security context migration. If the network connection switch triggers the MEC node switch, it is necessary to dynamically perform application migration and the corresponding application layer security context migration. After the migration is completed, the application will continue to run on the new MEC node. Before the MEC node switch and the corresponding application switch are completed, the original MEC will keep the application running and synchronize the application status with the new MEC node.

[0183] The solution of this embodiment mainly involves the dynamic migration of application layer security context between edge computing nodes in a mobility scenario.

[0184] As described above, based on the system architecture supporting dynamic migration of application layer security context between edge computing nodes in mobility scenarios proposed in the embodiment of the present invention, the deployment module (including resource management function and component deployment function) and the collaboration module (including resource collaboration function and security collaboration function) of the security management center are deployed in the cloud, and the pooled security components of the security capability components are deployed on the MEC node. When the network connection switching of the application terminal triggers the MEC node switching and application migration, and the application layer security context migration needs to be performed, the security management center performs security collaboration and resource collaboration with the MEC management platform through the collaboration module, performs resource management and component deployment through the deployment module, and dynamically deploys, configures and enables the required pooled security components on demand on the virtualized infrastructure of the new MEC node, so as to realize the dynamic migration of the application layer security context of the MEC application in the mobility scenario. The MEC management platform manages the resources and applications in each MEC, and the security management center manages the pooled security components in each MEC node.

[0185] In this embodiment, when a network connection switch occurs during the movement of an application terminal, the first MEC node that provides application services for the application terminal needs to switch to the second MEC node and trigger application migration, while triggering an application layer security context migration request. The MEC management platform receives the application layer security context migration request triggered by the application of the first MEC node.

[0186] When a network connection switch occurs during the movement of the application terminal, the MEC management platform interacts with the first MEC node to determine that the first MEC node needs to be switched to the second MEC node.

[0187] After receiving the application layer security context migration request, the MEC management platform forwards the application layer security context migration request to the security management center.

[0188] Step S202: According to the application layer security context migration request, collaborate with the MEC management platform to perform dynamic migration of the application layer security context between the first MEC node and the second MEC node.

[0189] The security management center collaborates with the MEC management platform according to the application layer security context migration request to perform dynamic migration of the application layer security context between the first MEC node and the second MEC node.

[0190] Specifically, the security management center performs security collaboration and resource collaboration with the MEC management platform and performs resource management based on the application layer security context migration request, and dynamically deploys, configures and enables the required security capability components on the virtualized infrastructure of the second MEC node on demand to achieve dynamic migration of the application layer security context between the first MEC node and the second MEC node.

[0191] This embodiment, through the above scheme, deploys the MEC management platform and the security management center in the cloud edge network, mainly involving the dynamic migration of application layer security context between edge computing nodes in the mobility scenario, the MEC management platform and the security management center are connected in communication, and jointly manage several MEC nodes of the mobile network; the several MEC nodes include at least the first MEC node and the second MEC node, wherein the security management center receives the application layer security context migration request sent by the MEC management platform, the application layer security context migration request is triggered when the network connection switching occurs during the movement of the application terminal, and the first MEC node providing application services for the application terminal needs to switch to the second MEC node and trigger the migration of the application; according to the application layer security context migration request, the MEC management platform is coordinated to perform the dynamic migration of the application layer security context between the first MEC node and the second MEC node. Therefore, through the collaboration of the security management center and the MEC management platform (MANO: MEC management and orchestration), the on-demand deployment and policy configuration of the security protection capability component in the MEC application migration process are realized, the corresponding application layer security context migration is dynamically realized, and the application security consistency of the mobile communication network MEC service in the mobility scenario is ensured. Compared with the existing solution of statically deploying security protection capabilities and configuring security protection policies, on the one hand, security protection capabilities can use MEC resources on demand to avoid excessive occupation of scarce MEC resources; on the other hand, they can also be scaled on demand according to processing capacity requirements, making more efficient use of MEC resources.

[0192] Wherein, as an implementation mode, the security management center includes: a collaboration module and a deployment module;

[0193] The security management center performs security collaboration and resource collaboration with the MEC management platform according to the application layer security context migration request, and performs resource management, and dynamically deploys, configures, and enables required security capability components on the virtualized infrastructure of the second MEC node on demand. The steps of implementing dynamic migration of the application layer security context between the first MEC node and the second MEC node may include:

[0194] The security collaboration function of the collaboration module in the security management center performs security collaboration according to the received application layer security context migration request;

[0195] The security collaboration function forwards the security capability requirements and deployment requirements to the component deployment function of the deployment module in the security management center, requesting that the security capabilities required by the security context be deployed, configured and enabled in the second MEC node according to the deployment requirements;

[0196] The component deployment function sends a resource request to the resource management function of the deployment module to apply for virtualized infrastructure resources required to deploy the relevant security capability components in the second MEC node;

[0197] The resource management function forwards the resource request information to the resource coordination function of the coordination module in the security management center;

[0198] The resource coordination function initiates a resource coordination request to the MEC management platform, applying for allocation of the required virtualized infrastructure resources in the second MEC node. The MEC management platform issues a resource allocation instruction to the second MEC node based on the resource coordination request, and allocates the virtualized infrastructure resources on demand to achieve dynamic migration of application layer security context between the first MEC node and the second MEC node.

[0199] Further, the resource coordination function receives a notification of successful resource allocation sent by the MEC management platform, notifies the resource management function of the successful application for the required resources, and forwards resource acquisition and usage parameter information to the resource management function;

[0200] The resource management function sends a resource occupation request to the second MEC node according to the resource acquisition and usage parameter information, requesting to occupy the allocated virtualized infrastructure resources;

[0201] After receiving the response message of successful resource occupation sent by the second MEC node, the resource management function notifies the component deployment function that the required resources are available, and forwards the resource acquisition and usage parameter information to the component deployment function;

[0202] The component deployment function issues a security capability component deployment instruction according to the security context requirements, deploys, configures and enables the required security capability components on the allocated second MEC node resources, and provides application security protection capabilities that meet the security context requirements.

[0203] Further, upon receiving the security capability component deployment, configuration and activation result returned by the second MEC node, the component deployment function feeds back the security capability component deployment, configuration and activation result to the security collaboration function;

[0204] The security collaboration function feeds back the deployment, configuration and activation results of the security capability component to the MEC management platform, and the MEC management platform returns a security context migration response message to the application of the first MEC node.

[0205] Therefore, by establishing a cloud-edge collaborative system architecture, enabling centralized unified management, distributed on-demand deployment, establishing an interactive mechanism between the security management center and the MEC management platform, enabling security collaboration and resource collaboration, establishing pooled security components, enabling on-demand deployment, configuration and activation of security protection capabilities, and through the collaboration between the security management center and the MEC management platform (MANO: MEC management and orchestration), the on-demand deployment and policy configuration of security protection capability components during the MEC application migration process are realized, and the corresponding application layer security context migration is dynamically realized to ensure the application security consistency of the mobile communication network MEC service in the mobility scenario. Compared with the existing static full deployment of security protection capabilities and configuration of security protection policies, on the one hand, the security protection capabilities can use MEC resources on demand to avoid excessive occupation of scarce MEC resources, and on the other hand, they can be scaled on demand according to processing capacity requirements to make more efficient use of MEC resources.

[0206] The specific process of implementing application layer security context migration in this embodiment can refer to the above embodiments and Figure 6 , I will not go into details here.

[0207] In addition, an embodiment of the present invention further proposes a mobile network edge node switching control device, which is applied to an MEC management platform, and the MEC management platform is communicatively connected with a security management center to collaboratively manage a plurality of MEC nodes of the mobile network; the plurality of MEC nodes include at least a first MEC node and a second MEC node, and the device includes:

[0208] A first receiving module is used to receive an application layer security context migration request triggered by an application of the first MEC node, where the application layer security context migration request is triggered when a network connection switch occurs during the movement of the application terminal, and the first MEC node providing application services for the application terminal needs to switch to a second MEC node and trigger the migration of the application;

[0209] The first migration module is used to collaborate with the security management center to perform dynamic migration of the application layer security context between the first MEC node and the second MEC node according to the application layer security context migration request.

[0210] For the principle and implementation process of implementing security context migration in this embodiment, please refer to the above embodiments and will not be repeated here.

[0211] In addition, an embodiment of the present invention further proposes a mobile network edge node switching control device, which is applied to a security management center, and the security management center is communicatively connected with an MEC management platform to collaboratively manage a plurality of MEC nodes of the mobile network; the plurality of MEC nodes include at least a first MEC node and a second MEC node, and the device includes:

[0212] A second receiving module is used to receive an application layer security context migration request sent by the MEC management platform, where the application layer security context migration request is triggered when a network connection switch occurs during the movement of the application terminal, and the first MEC node providing application services for the application terminal needs to switch to the second MEC node and trigger the migration of the application;

[0213] The second migration module is used to collaborate with the MEC management platform according to the application layer security context migration request to perform dynamic migration of the application layer security context between the first MEC node and the second MEC node.

[0214] For the principle and implementation process of implementing security context migration in this embodiment, please refer to the above embodiments and will not be repeated here.

[0215] In addition, an embodiment of the present invention also proposes a terminal device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the mobile network edge node switching control method described in the above embodiment, or the mobile network edge node switching control method described in the above embodiment.

[0216] Since the mobile network edge node switching control program adopts all the technical solutions of all the aforementioned embodiments when executed by the processor, it at least has all the beneficial effects brought by all the technical solutions of all the aforementioned embodiments, which will not be described one by one here.

[0217] In addition, an embodiment of the present invention also proposes a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the mobile network edge node switching control method described in the above embodiment or the mobile network edge node switching control method described in the above embodiment is implemented.

[0218] Since the mobile network edge node switching control program adopts all the technical solutions of all the aforementioned embodiments when executed by the processor, it at least has all the beneficial effects brought by all the technical solutions of all the aforementioned embodiments, which will not be described one by one here.

[0219] In addition, an embodiment of the present invention also proposes a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the mobile network edge node switching control method described in the above embodiment, or the mobile network edge node switching control method described in the above embodiment.

[0220] Since the mobile network edge node switching control program adopts all the technical solutions of all the aforementioned embodiments when executed by the processor, it at least has all the beneficial effects brought by all the technical solutions of all the aforementioned embodiments, which will not be described one by one here.

[0221] Compared with the prior art, the mobile network edge node switching control method, system, apparatus, terminal device, storage medium and program product proposed in the embodiments of the present invention mainly involve dynamic migration of application layer security context between edge computing nodes in mobility scenarios by deploying an MEC management platform and a security management center in a cloud-edge network. The MEC management platform is communicated with the security management center to collaboratively manage several MEC nodes of the mobile network; the several MEC nodes include at least a first MEC node and a second MEC node, wherein the MEC management platform receives an application layer security context migration request triggered by an application of the first MEC node, and the application layer security context migration request is triggered when a network connection switch occurs during the movement of the application terminal, and the first MEC node providing application services for the application terminal needs to switch to the second MEC node and trigger application migration; according to the application layer security context migration request, collaborate with the security management center to perform dynamic migration of application layer security context between the first MEC node and the second MEC node. Therefore, through the collaboration between the security management center and the MEC management platform (MANO: MEC management and orchestration), the on-demand deployment and policy configuration of security protection capability components during the MEC application migration process are realized, and the corresponding application layer security context migration is dynamically realized to ensure the application security consistency of the mobile communication network MEC service in the mobility scenario. Compared with the existing static full deployment of security protection capabilities and configuration of security protection policies, on the one hand, the security protection capability can use MEC resources on demand to avoid excessive occupation of scarce MEC resources, and on the other hand, it can also be scaled on demand according to processing capacity requirements to make more efficient use of MEC resources.

[0222] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0223] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0224] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as above, and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, a controlled terminal, or a network device, etc.) to execute the method of each embodiment of the present invention.

[0225] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A mobile network edge node switching control method, characterized in that: The method is applied to an MEC management platform, the MEC management platform is connected to a security management center for collaborative management of a plurality of MEC nodes of the mobile network; the plurality of MEC nodes include at least a first MEC node and a second MEC node, and the method comprises the following steps: The MEC management platform receives an application layer security context migration request triggered by an application of the first MEC node, where the application layer security context migration request is triggered when a network connection switch occurs during the movement of the application terminal, and the first MEC node providing application services for the application terminal needs to switch to a second MEC node and trigger application migration; According to the application layer security context migration request, security collaboration and resource collaboration are performed with the security management center, and the security management center performs resource management, and the required security capability components are dynamically deployed, configured and enabled on demand on the virtualized infrastructure of the second MEC node to achieve dynamic migration of the application layer security context between the first MEC node and the second MEC node.

2. The mobile network edge node switching control method according to claim 1, characterized in that: Before the step of the MEC management platform receiving the application layer security context migration request triggered by the application of the first MEC node, the step further includes: The MEC management platform receives a MEC node switching and application migration request, which triggers the first MEC node to switch to a second MEC node and perform application migration when a network connection switch occurs in the application terminal movement process; According to the MEC node switching and application migration request, the first MEC node is controlled to keep the application running, continue to provide application services for the application terminal, and synchronize the application status with the second MEC node.

3. The mobile network edge node switching control method according to claim 1, characterized in that: The method further comprises: After the dynamic migration of the application layer security context between the first MEC node and the second MEC node is completed, the MEC management platform returns a security context migration response message to the application of the first MEC node; Control the second MEC node to provide application services to the application terminal, and control the first MEC node to stop application operation, complete application migration, deactivate relevant security capability components deployed in the first MEC node, and release and recycle virtualized infrastructure resources of the first MEC node.

4. The mobile network edge node switching control method according to claim 3, characterized in that: The security context migration response message includes: security context information updated after the security context migration, so that the application in the first MEC node forwards the updated security context to the application terminal, requiring the application terminal to update the security context.

5. The mobile network edge node switching control method according to any one of claims 1 to 4, characterized in that: Before the step of the MEC management platform receiving the application layer security context migration request triggered by the application of the first MEC node, the step further includes: When a network connection switch occurs during the movement of the application terminal, the MEC management platform interacts with the first MEC node to determine that the first MEC node needs to be switched to the second MEC node.

6. A mobile network edge node switching control method, characterized in that: The method is applied to a security management center, the security management center is connected to the MEC management platform for communication, and collaboratively manages a plurality of MEC nodes of the mobile network; the plurality of MEC nodes include at least a first MEC node and a second MEC node, and the method comprises the following steps: The security management center receives an application layer security context migration request sent by the MEC management platform, where the application layer security context migration request is triggered when a network connection switch occurs during the movement of the application terminal, and the first MEC node providing application services for the application terminal needs to switch to the second MEC node and trigger the migration of the application; The security management center performs security collaboration and resource collaboration with the MEC management platform and performs resource management according to the application layer security context migration request, dynamically deploys, configures and enables the required security capability components on the virtualized infrastructure of the second MEC node on demand, and realizes the dynamic migration of the application layer security context between the first MEC node and the second MEC node.

7. The mobile network edge node switching control method according to claim 6, characterized in that: The security management center includes: a collaboration module and a deployment module; The security management center performs security collaboration and resource collaboration with the MEC management platform according to the application layer security context migration request, and performs resource management, and dynamically deploys, configures, and enables required security capability components on the virtualized infrastructure of the second MEC node on demand, and the steps of implementing dynamic migration of the application layer security context between the first MEC node and the second MEC node include: The security collaboration function of the collaboration module in the security management center performs security collaboration according to the received application layer security context migration request; The security collaboration function forwards the security capability requirements and deployment requirements to the component deployment function of the deployment module in the security management center, requesting that the security capabilities required by the security context be deployed, configured and enabled in the second MEC node according to the deployment requirements; The component deployment function sends a resource request to the resource management function of the deployment module to apply for virtualized infrastructure resources required to deploy the relevant security capability components in the second MEC node; The resource management function forwards the resource request information to the resource coordination function of the coordination module in the security management center; The resource coordination function initiates a resource coordination request to the MEC management platform, applying for allocation of the required virtualized infrastructure resources in the second MEC node. The MEC management platform issues a resource allocation instruction to the second MEC node based on the resource coordination request, and allocates the virtualized infrastructure resources on demand to achieve dynamic migration of application layer security context between the first MEC node and the second MEC node.

8. The mobile network edge node switching control method according to claim 7, characterized in that: The security management center performs security collaboration and resource collaboration with the MEC management platform according to the application layer security context migration request, and performs resource management, and dynamically deploys, configures, and enables required security capability components on the virtualized infrastructure of the second MEC node on demand, and the step of implementing dynamic migration of the application layer security context between the first MEC node and the second MEC node also includes: The resource coordination function receives the resource allocation success notification sent by the MEC management platform, notifies the resource management function of the successful application for the required resources, and forwards the resource acquisition and usage parameter information to the resource management function; The resource management function sends a resource occupation request to the second MEC node according to the resource acquisition and usage parameter information, requesting to occupy the allocated virtualized infrastructure resources; After receiving the response message of successful resource occupation sent by the second MEC node, the resource management function notifies the component deployment function that the required resources are available, and forwards the resource acquisition and usage parameter information to the component deployment function; The component deployment function issues a security capability component deployment instruction according to the security context requirements, deploys, configures and enables the required security capability components on the allocated second MEC node resources, and provides application security protection capabilities that meet the security context requirements.

9. The mobile network edge node switching control method according to claim 8, characterized in that: The security management center performs security collaboration and resource collaboration with the MEC management platform according to the application layer security context migration request, and performs resource management, and dynamically deploys, configures, and enables required security capability components on the virtualized infrastructure of the second MEC node on demand, and the step of implementing dynamic migration of the application layer security context between the first MEC node and the second MEC node also includes: When the component deployment function receives the security capability component deployment, configuration and activation result returned by the second MEC node, the component deployment function feeds back the security capability component deployment, configuration and activation result to the security collaboration function; The security collaboration function feeds back the deployment, configuration and activation results of the security capability component to the MEC management platform, and the MEC management platform returns a security context migration response message to the application of the first MEC node.

10. A mobile network edge node switching control system, characterized in that: The system includes: a security management center and an MEC management platform, wherein the MEC management platform is connected to the security management center for communication and collaboratively manages a plurality of MEC nodes of the mobile network; the MEC management platform manages resources and applications in each MEC node, and the security management center manages security capability components in each MEC node, wherein the plurality of MEC nodes include at least a first MEC node and a second MEC node, wherein: The MEC management platform is configured to receive an application layer security context migration request triggered by an application of the first MEC node, forward the application layer security context migration request to the security management center, and collaborate with the security management center according to the application layer security context migration request to perform dynamic migration of the application layer security context between the first MEC node and the second MEC node, wherein the application layer security context migration request is triggered when a network connection switching occurs during the movement of the application terminal, and the first MEC node providing application services for the application terminal needs to switch to the second MEC node and trigger the migration of the application; The security management center is used to receive an application layer security context migration request sent by the MEC management platform, perform security collaboration and resource collaboration with the MEC management platform according to the application layer security context migration request, and perform resource management, dynamically deploy, configure and enable required security capability components on the virtualized infrastructure of the second MEC node on demand, and realize dynamic migration of application layer security context between the first MEC node and the second MEC node.

11. A mobile network edge node switching control device, characterized in that: The device is applied to an MEC management platform, the MEC management platform is connected to a security management center for communication, and collaboratively manages a plurality of MEC nodes of the mobile network; the plurality of MEC nodes include at least a first MEC node and a second MEC node, and the device includes: A first receiving module is used to receive an application layer security context migration request triggered by an application of the first MEC node, where the application layer security context migration request is triggered when a network connection switch occurs during the movement of the application terminal, and the first MEC node providing application services for the application terminal needs to switch to a second MEC node and trigger the migration of the application; The first migration module is used to perform security collaboration and resource collaboration with the security management center according to the application layer security context migration request, and the security management center performs resource management, dynamically deploys, configures and enables required security capability components on the virtualized infrastructure of the second MEC node on demand, and realizes dynamic migration of application layer security context between the first MEC node and the second MEC node.

12. A mobile network edge node switching control device, characterized in that: The device is applied to a security management center, the security management center is connected to the MEC management platform for communication, and collaboratively manages a plurality of MEC nodes of the mobile network; the plurality of MEC nodes include at least a first MEC node and a second MEC node, and the device includes: A second receiving module is used to receive an application layer security context migration request sent by the MEC management platform, where the application layer security context migration request is triggered when a network connection switch occurs during the movement of the application terminal, and the first MEC node providing application services for the application terminal needs to switch to the second MEC node and trigger the migration of the application; The second migration module is used to perform security collaboration and resource collaboration with the MEC management platform and perform resource management according to the application layer security context migration request, dynamically deploy, configure and enable the required security capability components on the virtualized infrastructure of the second MEC node on demand, and realize dynamic migration of the application layer security context between the first MEC node and the second MEC node.

13. A terminal device, characterized in that: The terminal device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the mobile network edge node switching control method as described in any one of claims 1 to 5 or the mobile network edge node switching control method as described in any one of claims 6 to 9 is implemented.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, the mobile network edge node switching control method according to any one of claims 1 to 5 or the mobile network edge node switching control method according to any one of claims 6 to 9 is implemented.

15. A computer program product, characterized in that The computer program product includes a computer program, and when the computer program is executed by a processor, the mobile network edge node switching control method according to any one of claims 1 to 5 or the mobile network edge node switching control method according to any one of claims 6 to 9 is implemented.

Images