TEE resource arrangement method, system and device in edge computing and storage medium

Abstract

The application provides a TEE resource arrangement method and system in multi-access edge computing, a device and a storage medium, relates to the technical field of cloud computing, and the method comprises the following steps: an MEO receives TEE capability information of an MEC host reported by a VIM managed by the MEC host; the MEO selects a VIM and an associated MEPM managed by the MEC host with TEE capability according to the received TEE capability information and based on TEE capability requirements on the user side, initiates an MEC APP instantiation request to the MEPM, and allocates resources in the MEC host with TEE capability, so as to realize TEE resource arrangement of the MEO; the MEC host performs remote verification on a TEE instance after the TEE capability is turned on; and a third-party application verifies a TEE application instance environment. The technical scheme provided by the application enables edge services to deploy a service processing function or module with high requirements for data and code privacy protection in infrastructure resources supporting TEE when deploying APP.

Description

Technical Field

[0001] This invention relates to the field of cloud computing technology, and in particular to a TEE resource orchestration method, a TEE resource orchestration system, a TEE resource orchestration device, and a computer-readable storage medium in multi-access edge computing. Background Technology

[0002] With the deployment of 5G, especially 5G private networks, the demand for data processing at the network edge is increasing. On one hand, specific business requirements necessitate low latency, demanding agile and rapid responses; on the other hand, data management policies dictate that business data should be processed within the campus. Multi-access Edge Computing (MEC) can provide IT services and cloud computing capabilities in data centers close to the network edge, and is increasingly being used by OTT services and operators as essential infrastructure for building edge business ecosystems. However, MEC deployment at the network edge presents a complex environment, with infrastructure and applications belonging to different owners, thus posing new requirements for the trustworthiness and privacy protection of data processing. Firstly, some business processes involve sensitive data, such as facial recognition, location data, and production data, which pose privacy risks in shared virtual environments built on general x86 architectures. Secondly, for data processed locally within the campus, dual protection is needed for both local data and third-party algorithms. Confidential computing based on Trusted Execution Environments (TEEs) is considered a scalable solution that achieves "data available but not accessible" characteristics. By inputting sensitive data and program code into the TEE in encrypted form to complete the calculation and outputting the calculation results, the privacy of data and code is protected.

[0003] However, MEC has the following problems when orchestrating IaaS (including VMs or Docker) resources: MEC hosts cannot inform VIM (Virtualized Infrastructure Managers) and the upper-layer MEO (Multi-access Edge Computing Orchestrator) whether they support TEE, whether the TEE function is enabled, and what types of TEE are supported; when MEO performs resource orchestration, on the one hand, the MEC APP Descriptor does not describe the TEE requirements, and on the other hand, MEO does not handle the affinity of TEE resource orchestration; when it comes to remote authentication using TEE, MEC does not provide authentication method selection. Summary of the Invention

[0004] This invention was completed to at least partially solve the technical problems existing in the prior art, such as MEC hosts not supporting TEE capability reporting, MEO not describing TEE requirements and handling affinity for TEE resource orchestration when performing resource orchestration, and MEC not providing authentication method selection.

[0005] According to one aspect of the present invention, a method for orchestrating Trusted Execution Environment (TEE) resources in multi-access edge computing is provided. The method includes the following steps: S1, the multi-access edge computing orchestrator (MEO) receives TEE capability information of the MEC host reported by the network function virtualization infrastructure management module (VIM) managed by the MEC host; S2, based on the received TEE capability information and the user's TEE capability requirements, the MEO selects the VIM managed by the MEC host with TEE capability and the associated MEPM (Mobile Edge Platform Manager), and initiates an MEC APP instantiation request to the MEPM, allocating resources in the MEC host with TEE capability to realize the TEE resource orchestration of the MEO; S3, the MEC host with TEE capability performs remote verification of the TEE instance after the TEE capability is enabled; S4, a third-party application verifies the TEE application instance environment.

[0006] Optionally, the TEE capability information includes whether TEE is supported, the type of TEE support, the TEE enabling status, and the TEE (necessary) configuration information. Step S1 includes: S11, the MEC host notifies the VIM of the TEE capability information; S12, the VIM records the TEE capability information and notifies the MEO of the TEE capability information; S13, the MEO receives the TEE capability information and records whether the MEC host supports TEE and information about the VIM.

[0007] Optionally, the user-side TEE capability requirements are provided by adding TEE-related description requirements to the description file of the MEC APP Descriptor.

[0008] Optionally, step S2 includes: S201, the MEO receives a MEC APP instantiation request sent by OSS (Operations Support System); S202, the MEO checks the MEC APP package configuration including the description file sent by OSS, parses the resource requirements and TEE capability requirements in the description file, and selects the VIM and associated MEPM to which the MEC host with TEE capability belongs; S203, the MEO initiates a MEC APP instantiation request to the MEPM; S204, the MEPM sends a resource allocation request to the VIM, carrying MEC APP software image information in the request message; S205, the VIM allocates corresponding resources on the MEC host with TEE capability based on the request of the MEPM, downloads the MEC APP software image, and instantiates the image on the MEC host with TEE capability; S206, the VIM sends a resource allocation request response to the MEPM; S207, the MEPM sends a request to the MEP (Mobile Edge Platform) for MEC APP instantiation. The APP service configuration request includes TEE-specific support library files and TEE remote verification configuration; S208, the MEP performs service configuration on the MEC APP; S209, the MEP sends a service configuration request response to the MEPM; S210, the MEPM sends a MEC APP instantiation result response to the MEO and reports the resource allocation status to the MEO; S211, the MEO returns the MEC APP instantiation result response to the OSS.

[0009] Optionally, step S3 includes: S301, after the TEE capability is enabled, the MEC host with TEE capability sends authentication information and CA certificate application information to the VIM, wherein the authentication information includes at least CPU ID, TEE instance ID, and TEE instance public key; S302, the VIM forwards the authentication information and CA certificate application information to the MEO managed by the VIM; S303, the MEO forwards the authentication information and CA certificate application information to the TEE vendor server; S304, the TEE vendor server verifies whether the TEE instance represented by the authentication information is a real TEE environment based on the TEE's factory information and obtains a remote authentication result; if the remote authentication result is successful, then the MEC host with TEE capability is provided with... The TEE public key issues a CA certificate; S305, the TEE vendor server returns the remote authentication result and the CA certificate to the MEO; S306, the MEO checks the remote authentication result and saves the CA certificate locally; S307, the MEO returns the remote authentication result and the CA certificate to the VIM; S308, the VIM returns the remote authentication result and the CA certificate to the MEC host with TEE capability; S309, the MEC host with TEE capability saves the CA certificate locally.

[0010] Optionally, in step S3, when the third-party application and the TEE application instance are in the same MEC environment, step S4 includes: S411, the TEE application instance generates an authentication report locally and sends the authentication report to the third-party application; S412, the third-party application sends the authentication report to its managed MEP to request authentication; S413, the MEP sends the authentication report to its managed MEPM to request authentication; S414, the MEPM sends the authentication report to its managed MEO to request authentication; the MEO verifies the signature information in the authentication report based on the locally stored CA certificate, completes remote authentication, and returns the remote authentication result to the MEPM; S415, the MEPM returns the remote authentication result to the MEP; S416, the MEP returns the remote authentication result to the third-party application; S417, the third-party application determines whether to continue interacting with the TEE application instance based on the remote authentication result; if the remote authentication result is successful, the third-party application and the TEE application instance establish trusted communication and continue interacting.

[0011] Optionally, when the third-party application and the TEE application instance are not in the same MEC environment, step S4 includes: S421, the TEE application instance generates an authentication report locally and sends the authentication report to the third-party application; S422, the third-party application sends the authentication report to the MEO to request authentication; the MEO verifies the signature information in the authentication report based on the locally stored CA certificate to complete remote authentication; S423, the MEO returns the authentication result to the third-party application.

[0012] According to another aspect of the present invention, a Trusted Execution Environment (TEE) resource orchestration system for multi-access edge computing is provided. The system includes: a Trusted Execution Environment (MEP), a Mobile Edge Platform Manager (MEPM) for managing the MEP, a Multi-Access Edge Computing (MEC) host, a Network Function Virtualization Infrastructure Management Module (VIM) for managing the MEC host, and a Multi-Access Edge Computing Orchestrator (MEO). The MEO is used to receive TEE capability information of the MEC host from the VIM managed by the MEC host. Based on the received TEE capability information and the TEE capability requirements on the user side, the MEO selects the VIM managed by the MEC host with TEE capability and the associated MEPM, and initiates an MEC APP instantiation request to the MEPM. Resources are allocated in the MEC host with TEE capability to realize the TEE resource orchestration of the MEO. Furthermore, the MEC host with TEE capability is used to perform remote verification of TEE instances after the TEE capability is enabled, and third-party applications can remotely authenticate the TEE application instance environment.

[0013] According to another aspect of the present invention, a TEE resource orchestration device is provided, including a memory and a processor, wherein the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor executes the aforementioned TEE resource orchestration method in multi-access edge computing.

[0014] According to another aspect of the present invention, a computer-readable storage medium is provided having a computer program stored thereon, wherein when the computer program is executed by a processor, the processor performs the aforementioned TEE resource orchestration method in multi-access edge computing.

[0015] The technical solution provided by this invention may include the following beneficial effects:

[0016] The TEE resource orchestration method in edge computing provided by this invention adds TEE-supporting computing resource orchestration capabilities to MEC, enabling edge services to deploy business processing functions or modules with high requirements for data and code privacy protection in infrastructure resources that support TEE when deploying APP, thereby protecting business security and data privacy in MEC deployed in complex environments.

[0017] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the description, claims, and drawings. Attached Figure Description

[0018] The accompanying drawings are provided to further understand the technical solutions of the present invention and constitute a part of the specification. They are used together with the embodiments of the present invention to explain the technical solutions of the present invention, and do not constitute a limitation on the technical solutions of the present invention.

[0019] Figure 1 A flowchart illustrating the TEE resource orchestration method in edge computing provided in this embodiment of the invention;

[0020] Figure 2 This is a schematic diagram of the structure of a TEE resource orchestration system in edge computing provided in an embodiment of the present invention;

[0021] Figure 3 This is a schematic diagram illustrating the process of MEC host TEE capability reporting in the TEE resource orchestration method for edge computing provided in this embodiment of the invention.

[0022] Figure 4 This is a schematic diagram illustrating the process of MEO identifying and orchestrating TEE resource requirements in the TEE resource orchestration method provided in this embodiment of the invention.

[0023] Figure 5 This is a schematic diagram illustrating the process of TEE identity authentication and CA certificate acquisition in the TEE resource orchestration method for edge computing provided in this embodiment of the invention.

[0024] Figure 6 This is a flowchart illustrating the first embodiment of the third-party application's authentication of the TEE instance environment in the TEE resource orchestration method for edge computing provided in this invention.

[0025] Figure 7 This is a flowchart illustrating a second embodiment of the third-party application's authentication of the TEE instance environment in the TEE resource orchestration method for edge computing provided in this invention.

[0026] Figure 8This is a schematic diagram of the structure of the TEE resource orchestration device provided in an embodiment of the present invention. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the specific implementation methods of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific implementation methods described herein are for illustration and explanation only and are not intended to limit the present invention.

[0028] A Trusted Execution Environment (TEE) is an execution environment that enforces the restriction that only authorized program code can execute within the TEE, and the data used by this program code cannot be read or tampered with by code outside the TEE. The TEE is a secure area within the CPU. The TEE runs in an independent environment and in parallel with the operating system. The CPU ensures the confidentiality and integrity of the code and data within the TEE. Trusted applications running in the TEE can access the full functionality of the device's main processor and memory, while hardware isolation protects these components from user-installed applications running on the main operating system. Therefore, some data-sensitive applications can be executed within the TEE, such as key generation and storage, payment account authentication, and privacy data processing. Typical hardware TEEs include Intel SGX, ARM TrustZone, and AMD SEV, and can be deployed on general-purpose x86 servers.

[0029] Multi-access edge computing (MEC) is a system that provides IT services and cloud computing capabilities close to the user, at the edge of an access network containing one or more access technologies. Due to its proximity to the user, MEC is highly attractive for services with high requirements for low-latency processing and privacy protection. MEC receives user-side requests through the MEC orchestrator (MEO) network element, performs unified orchestration of MEC IaaS resources, manages the lifecycle of MEC applications, and manages VIM and MEPM (Mobile Edge Platform Manager). VIM manages IaaS resources in the local data center, including resource reporting, resource allocation, and VM / Docker startup / deactivation. Additionally, VIM manages MEC hosts, which run MEPs (Mobile Edge Platforms), and MEPM manages the MEPs (see [link to relevant documentation]). Figure 2 ).

[0030] Typically, MEC hosts do not support TEE capability reporting, MEO lacks descriptions of TEE requirements and affinity handling for TEE resource orchestration during resource orchestration, and MEC does not provide authentication method selection. (Reference) Figure 1This disclosure provides a method for orchestrating TEE resources in edge computing. The method includes: TEE capability reporting (S1), MEO identification and orchestration of TEE resource requirements (S2), and MEO remote authentication of TEE instances (S3).

[0031] More specifically, this disclosure provides a method for orchestrating TEE computing resources in edge computing. (See reference) Figure 1 and Figure 2 The method includes the following steps: S1, MEO 16 receives the TEE capability information of MEC host 13 from VIM 14, which is managed by MEC host 13; S2, based on the received TEE capability information and the user's TEE capability requirements, MEO 16 selects VIM 14 and associated MEPM 15, which are managed by MEC host 13 with TEE capability, and initiates a MEC APP instantiation request to MEPM 15, allocating resources in MEC host 13 with TEE capability to realize TEE resource orchestration of MEO 16; S3, after TEE capability is enabled, MEC host 13 with TEE capability performs TEE authentication and obtains a CA certificate through the TEE vendor server (TEE signer), and third-party applications authenticate the TEE application instance.

[0032] The following describes the specific steps S1~S3 of the TEE computing resource orchestration method in edge computing.

[0033] TEE Capability Reporting (S1)

[0034] refer to Figure 3 Step S1 includes the following steps:

[0035] S11: Server host 13 (hereinafter also referred to as the host or MEC host) deployed in the MEC edge data center notifies its TEE support status, support type, TEE capability enabled status, and other TEE configuration information (necessary TEE configuration information) to its managing VIM (the VIM managing the host is the VIM used to manage this host). TEE support status refers to whether the host supports hardware TEE capabilities. TEE support type refers to the specific manufacturer and TEE model, CPU model, etc., such as Intel SGX2, Xeon D-2752TER. TEE capability enabled refers to whether the TEE capability is enabled in the host. Other TEE configuration information (necessary TEE configuration information) includes the TEE remote authentication URL, certificate type, etc. It should be noted that before the host notifies the VIM of its TEE support status, the host should have already completed the installation and configuration of the necessary TEE support library files.

[0036] S12: VIM 14 records the TEE information reported by the host and notifies the MEO 16 to which VIM 14 belongs of whether TEE is supported, the type of support, the TEE capability enabled, and other TEE configuration information (necessary TEE configuration information).

[0037] S13: MEO 16 records information on whether the host TEE is supported, as well as the VIM to which it belongs and data center information (here, the VIM to which the MEO belongs means that the MEO is the MEO used to manage the VIM).

[0038] MEO's identification and orchestration of TEE resource requirements (S2)

[0039] MEO 16 orchestrates infrastructure resources based on user-side requirements to meet the computing, storage, and network resources needed for MEC APP creation. MEC APP creation resources are described using the MEC APP Descriptor. ETSIGS MEC 010-2 V2.2.1 defines the data types for the MEC APP Descriptor, but does not include TEE-related parameters. To provide MEO with the ability to orchestrate TEE resources and meet user-side requirements, this invention provides type definitions for TEE resources in the MEC APP Descriptor, including, for example, newly added data fields as shown in the table below:

[0040] After providing the user-side TEE capability requirements by adding TEE-related description requirements to the MEC APP Descriptor as described above, MEO 16 can be used to orchestrate TEE computing resources.

[0041] Specifically, the prerequisite for MEO 16 to orchestrate TEE computing resources is that the MEC APP on-board package has been generated by the user side, sent to MEO 16 via OSS 11, and loaded onto MEO 16. The MEC APP image included in the MEC APP on-board package requires TEE capability support, as specified in the APP descriptor. The MEC APP on-board package contains the software image (or image link) for building the MEC APP and the APP descriptor file.

[0042] refer to Figure 4 A resource orchestration step (step S2) for instantiating a MEC APP that includes TEE capability requirements may include the following steps:

[0043] S201: OSS 11 sends a MEC APP instantiation request to MEO 16.

[0044] S202: MEO 16 checks the MEC APP package configuration, parses the resource requirements and TEE capability requirements in the MEC APP description file, and selects VIM 14 (the VIM managed by host 13 with TEE capability) and associated MEPM 15.

[0045] S203: MEO 16 sends a request to MEPM 15 to instantiate the MEC APP.

[0046] S204: MEPM 15 sends a resource allocation request to VIM 14, which manages host 13 with TEE capabilities, and carries MEC APP software image information (such as image address) in the request message. The requested resources include computing resources, storage resources, network resources, and memory space used by the TEE.

[0047] S205: VIM 14, based on the request of MEPM 15, allocates the corresponding resources on MEC host 13 (a host with TEE capability), downloads the MEC APP software image, and instantiates the image on MEC host 13.

[0048] S206: VIM 14 sends a resource allocation request response to MEPM 15.

[0049] S207: MEPM 15 sends a service configuration request for MEC APP to MEP 12, which includes TEE-specific support library files, TEE remote verification configuration, etc.

[0050] S208: MEP 12 configures services for the MEC APP, including TEE-specific support library files, TEE remote verification configuration, etc.

[0051] S209: MEP 12 sends a service configuration request response to MEPM 15.

[0052] S210: MEPM 15 sends a response to MEO 16 regarding the instantiation result of the MEC APP and reports the resource allocation status to MEO16.

[0053] S211: MEO 16 returns the MEC APP instantiation result response to OSS 11.

[0054] MEC host performs remote verification of TEE instance (S3)

[0055] When the TEE function is enabled on MEC host 13 (a host with TEE capabilities), for TEEs without pre-installed certificates, it is necessary to verify the TEE identity and the private key generated within the TEE, and then issue a certificate. It should be noted that "without pre-installed certificates" means that the private key is generated after the TEE is enabled, and a CA certificate is applied for independently. However, since MEC host 13 with TEEs cannot always directly access the internet for remote authentication of the TEE identity and TEE instance by the CPU manufacturer containing the TEE, the MEC network element needs to act as a proxy.

[0056] The specific authentication process involving TEE mainly includes: 1. TEE identity authentication and CA certificate acquisition when TEE is activated; 2. Verifying whether the TEE instance environment meets the requirements for integrity and the authenticity of trusted execution capabilities.

[0057] The following is for reference. Figure 5 The description of TEE identity authentication and CA certificate acquisition may include the following steps.

[0058] S301: After enabling TEE capability, MEC host 13 (a host with TEE capability) completes the installation and configuration of the necessary TEE library files, and sets the remote authentication method and remote authentication URL address. MEC host 13 initiates remote authentication to MEO 16, carrying information such as CPU ID, TEE instance ID, locally generated public key of the TEE instance, and authentication address, to verify the authenticity of the TEE environment and whether it has trusted execution capabilities, and applies for a CA certificate from the TEE vendor server (e.g., TEE signer). It should be noted that MEC host 13 can be configured for remote authentication; the URL address can be either MEO as a proxy address or the TEE vendor signer server address. When MEC host 13 cannot directly connect to the internet, it should be configured to use MEO as a proxy address; the TEE vendor signer generally refers to the manufacturer of the TEE chip.

[0059] S302: After receiving the authentication request and CA certificate application message from MEC host 13, VIM 14 forwards the information to MEO 16, which is managed by VIM 14.

[0060] S303: After receiving the authentication request and CA certificate application message from MEC host 13 forwarded by VIM 14, MEO 16 forwards the message to the TEE vendor signer server corresponding to the TEE according to the pre-configured proxy settings. Optionally, MEO 16 signs the authentication request and CA certificate application message of MEC host 13 using its own private key.

[0061] S304: The TEE vendor's signer server verifies whether the TEE instance is a real TEE environment based on the TEE's ID and other factory information; if the verification is successful, it issues a CA certificate for the public key provided by MEC host 13 TEE.

[0062] S305: The TEE vendor's signer server returns the remote authentication result and CA certificate to MEO 16.

[0063] S306: MEO 16 checks the remote authentication result and saves the CA certificate locally.

[0064] S307: MEO 16 returns the TEE remote authentication result and CA certificate to VIM 14.

[0065] S308: VIM 14 returns the TEE remote authentication result and CA certificate to MEC host 13.

[0066] S309: MEC host 13 stores the CA certificate locally.

[0067] Third-party applications verify the TEE application instance environment (S4)

[0068] The following is for reference. Figures 6 to 7 This describes various implementations of third-party application authentication for TEE instance environments (TEE application instances).

[0069] When a third-party application needs to interact with the executable program in the TEE instance environment, such as using encrypted data as input to code in the TEE instance environment, it is necessary to determine whether the TEE instance environment is a real and trusted environment. It should be noted that the TEE instance environment can be a separate application instance environment of the TEE or the TEE environment itself. The TEE instance environment is used to host third-party application code and sensitive data.

[0070] refer to Figure 6 When a third-party application and a TEE application instance are in the same MEC environment, the authentication of the TEE application instance by the third-party application may include the following steps:

[0071] S411: The TEE application instance generates an authentication report locally. The authentication report may include CPU security information, TEE security information, a summary of the TEE application instance's execution environment security attributes and configuration information, the TEE CA certificate, and an integrity signature of the authentication report. The TEE application instance then sends the authentication report to third-party applications.

[0072] S412: A third-party application sends a TEE application instance authentication report request to the MEP 12 it belongs to manage for authentication.

[0073] S413: MEP 12 sends a TEE application instance authentication report request to the MEPM 15 under its management.

[0074] S414: MEPM 15 sends a TEE application instance authentication report request to its managed MEO 16; MEO 16 verifies the signature information in the TEE application instance authentication report based on the locally stored TEE CA certificate, completes remote authentication, and returns the remote authentication result. It should be noted that when an MEC provider has multiple levels of MEO network elements, the MEO in this step can be the top-level MEO of that MEC provider.

[0075] S415: MEPM 15 returns the remote authentication result of the TEE application instance to MEP 12.

[0076] S416: MEP 12 returns the remote authentication result of the TEE application instance to a third-party application.

[0077] S417: The third-party application determines whether to continue interacting with the TEE application instance based on the remote authentication result of the TEE application instance; if the remote authentication of the TEE application instance is successful, the third-party application and the TEE application instance can establish trusted communication and continue interacting.

[0078] refer to Figure 7 When a third-party application and a TEE application instance are not in the same MEC environment, the third-party application can directly access the MEO to remotely authenticate the TEE application instance. Specifically, the authentication of a TEE application instance by a third-party application may include the following steps:

[0079] S421: The TEE application instance generates an authentication report locally. The TEE application instance then sends the authentication report to the third-party application.

[0080] S422: A third-party application sends a TEE application instance authentication report request to MEO 16; MEO 16 verifies the signature information in the TEE application instance authentication report based on the locally stored TEE CA certificate, and completes remote authentication.

[0081] S423: MEO 16 returns authentication results to third-party applications.

[0082] It should be noted that the third-party application here can be other cloud applications or MEC APP applications belonging to other MEO management.

[0083] This invention also provides a TEE resource orchestration system 10 for edge computing, see reference. Figure 2The system includes MEP 12, MEPM 15 for managing MEP 12, MEC host 13, VIM 14 for managing MEC host 13, and MEO 16. MEO 16 receives TEE capability information of MEC host 13 from VIM 14, which is managed by MEC host 13. Based on the received TEE capability information and the user's TEE capability requirements, MEO 16 selects VIM 14 and associated MEPM 15, which are managed by MEC host 13 with TEE capability, and initiates a MEC APP instantiation request to MEPM 15. It allocates resources in MEC host 13 with TEE capability to realize TEE resource orchestration of MEO 16. MEC host 13 with TEE capability is used to remotely verify TEE instances after TEE capability is enabled, and third-party applications can remotely authenticate the TEE application instance environment. The TEE resource orchestration method described above in edge computing can be executed through the TEE resource orchestration system 10 in edge computing. It should be understood that the TEE resource orchestration system 10 may also include other necessary modules.

[0084] Based on the same technical concept, this embodiment of the invention also provides a TEE resource orchestration device 20, such as... Figure 8 As shown, the TEE resource orchestration device 20 includes a memory 21 and a processor 22. The memory 21 stores a computer program. When the processor 22 runs the computer program stored in the memory 21, the processor 22 executes the aforementioned TEE resource orchestration method in multi-access edge computing.

[0085] Based on the same technical concept, the present invention also provides a computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, the processor executes the aforementioned TEE resource orchestration method in multi-access edge computing.

[0086] In summary, the TEE resource orchestration method, system, device, and storage medium provided in this embodiment of the invention, by adding TEE-supporting computing resource orchestration capabilities to MEC, enable edge services to deploy business processing functions or modules with high requirements for data and code privacy protection in TEE-supporting infrastructure resources when deploying APP, thereby protecting business security and data privacy in MEC deployed in complex environments.

[0087] It will be understood by those skilled in the art that all or some of the steps, systems, or apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware implementations, the division between functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit (ASIC). Such software may be distributed on a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0088] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for orchestrating Trusted Execution Environment (TEE) resources in multi-access edge computing, characterized in that, Includes the following steps: S1. The Multi-Access Edge Computing Orchestrator (MEO) receives the TEE capability information of the Multi-Access Edge Computing (MEC) host from the Network Function Virtualization Infrastructure Management (VIM) module managed by the MEC host. S2. Based on the received TEE capability information and the user's TEE capability requirements, the MEO selects the VIM managed by the MEC host with TEE capability and the associated Mobile Edge Platform Manager (MEPM), and initiates a Mobile Edge Platform MEC APP instantiation request to the MEPM. Resources are allocated in the MEC host with TEE capability to realize the TEE resource orchestration of the MEO. S3. The MEC host with TEE capability performs remote verification of TEE instances after the TEE capability is enabled. S4. Third-party applications verify the TEE application instance environment.

2. The Trusted Execution Environment (TEE) resource orchestration method in multi-access edge computing according to claim 1, characterized in that, The TEE capability information includes whether TEE is supported, the type of TEE support, the TEE enabling status, and the TEE configuration information. Step S1 includes: S11. The MEC host transmits the TEE capability information to the VIM. S12. The VIM records the TEE capability information and reports the TEE capability information to the MEO; S13. The MEO receives the TEE capability information and records whether the MEC host supports the TEE and information about the VIM.

3. The Trusted Execution Environment (TEE) resource orchestration method in multi-access edge computing according to claim 1, characterized in that, The user-side TEE capability requirements are provided by adding TEE-related description requirements to the description file of the MEC APP Descriptor.

4. The Trusted Execution Environment (TEE) resource orchestration method in multi-access edge computing according to claim 3, characterized in that, Step S2 includes: S201, The MEO receiving operation supports the MEC APP instantiation request sent by the OSS system; S202. The MEO checks the MEC APP package configuration sent by the OSS, which includes the description file, parses the resource requirements and TEE capability requirements in the description file, and selects the VIM and associated MEPM to which the MEC host with TEE capability belongs. S203, The MEO initiates a MEC APP instantiation request to the MEPM; S204. The MEPM sends a resource allocation request to the VIM, and carries the MEC APP software image information in the request message; S205. Based on the request from the MEPM, the VIM allocates corresponding resources on the MEC host with TEE capability, downloads the MEC APP software image, and instantiates the image on the MEC host with TEE capability. S206, The VIM sends a resource allocation request response to the MEPM; S207. The MEPM sends a service configuration request for the MEC APP to the MEP, wherein the service configuration request includes TEE-specific support library files and TEE remote verification configuration. S208. The MEP configures services for the MEC APP; S209. The MEP sends a service configuration request response to the MEPM. S210. The MEPM sends a response to the MEO regarding the instantiation result of the MEC APP and reports the resource allocation status to the MEO. S211. The MEO returns a response to the OSS regarding the instantiation result of the MEC APP.

5. The Trusted Execution Environment (TEE) resource orchestration method in multi-access edge computing according to claim 1, characterized in that, Step S3 includes: S301. After the TEE capability is enabled, the MEC host with TEE capability sends authentication information and CA certificate application information to the VIM. The authentication information includes at least CPU ID, TEE instance ID and TEE instance public key. S302, The VIM forwards the authentication information and the CA certificate application information to the MEO to which the VIM belongs; S303, The MEO forwards the authentication information and the CA certificate application information to the TEE vendor server; S304. The TEE vendor server verifies whether the TEE instance represented by the authentication information is a real TEE environment based on the TEE's factory information, and obtains the remote authentication result; if the remote authentication result is successful, it issues a CA certificate for the public key of the TEE instance provided by the MEC host with TEE capability. S305. The TEE vendor server returns the remote authentication result and the CA certificate to the MEO. S306. The MEO checks the remote authentication result and saves the CA certificate locally; S307. The MEO returns the remote authentication result and the CA certificate to the VIM; S308. The VIM returns the remote authentication result and the CA certificate to the MEC host with TEE capability; S309. The MEC host with TEE capability stores the CA certificate locally.

6. The Trusted Execution Environment (TEE) resource orchestration method in multi-access edge computing according to claim 1, characterized in that, When the third-party application and the TEE application instance are in the same MEC environment, step S4 includes: S411. The TEE application instance generates an authentication report locally and sends the authentication report to the third-party application. S412, The third-party application sends the authentication report to the MEP it manages to request authentication; S413, The MEP sends the authentication report to the MEPM it manages to request authentication; S414. The MEPM sends the authentication report to the MEO it manages to request authentication; the MEO verifies the signature information in the authentication report based on the locally stored CA certificate, completes remote authentication, and returns the remote authentication result to the MEPM. S415, The MEPM returns the remote authentication result to the MEP; S416. The MEP returns the remote authentication result to the third-party application; S417. The third-party application determines whether to continue interacting with the TEE application instance based on the remote authentication result; if the remote authentication result is successful, the third-party application establishes trusted communication with the TEE application instance and continues to interact.

7. The Trusted Execution Environment (TEE) resource orchestration method in multi-access edge computing according to claim 1, characterized in that, When the third-party application and the TEE application instance are not in the same MEC environment, step S4 includes: S421. The TEE application instance generates an authentication report locally and sends the authentication report to the third-party application. S422. The third-party application sends the authentication report to MEO to request authentication; MEO verifies the signature information in the authentication report based on the locally stored CA certificate to complete remote authentication. S423, The MEO returns the authentication result to the third-party application.

8. A Trusted Execution Environment (TEE) resource orchestration system for multi-access edge computing, characterized in that, include: The system includes a Mobile Edge Platform (MEP), a Mobile Edge Platform Manager (MEPM) for managing the MEP, a Multi-Access Edge Computing (MEC) host, a Network Function Virtualization Infrastructure Management Module (VIM) for managing the MEC host, and a Multi-Access Edge Computing Orchestrator (MEO). The MEO is used to receive TEE capability information of the MEC host from the VIM to which the MEC host belongs. The MEO selects the VIM and associated MEPM to which the MEC host with TEE capability belongs, based on the received TEE capability information and the user's TEE capability requirements. It then initiates a MEC APP instantiation request to the MEPM and allocates resources in the MEC host with TEE capability to realize the TEE resource orchestration of the MEO. The MEC host with TEE capability is used to perform remote verification of TEE instances after the TEE capability is enabled, and third-party applications can remotely authenticate the TEE application instance environment.

9. A TEE resource orchestration device, characterized in that, It includes a memory and a processor, wherein the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor executes the Trusted Execution Environment (TEE) resource orchestration method in multi-access edge computing according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, the processor executes the Trusted Execution Environment (TEE) resource orchestration method in multi-access edge computing according to any one of claims 1 to 7.

Images