Method and apparatus for adjusting data security computing space boundary related to data assets

Abstract

Embodiments of the present application relate to a data security computing space boundary adjustment method and device related to data assets, the method comprising: determining, by a server, a security computing space and a data source for performing a computing task; outputting network adjustment information to cause a first computing node to be adjusted to within the boundary of the first data source; and outputting connection authentication information to establish an intra-domain connection between the first data source and the first computing node and a cross-domain connection between the first computing node and other computing nodes in the security computing space. According to the technical solution of the embodiments of the present application, each computing node is constructed as a dynamically adjustable security computing space according to the needs of the computing task, and part of the computing nodes can be divided into the network boundary corresponding to the data source, and then the computing is performed in the network boundary where the data source is located. By using the above technical solution, the principle of not taking the original data out of the domain is met, the potential data security risks are avoided, and the security of data computing is improved.

Description

Technical Field

[0001] This invention relates to the field of secure computing technology, and in particular to a method and apparatus for adjusting the spatial boundary of secure computing involving data assets. Background Technology

[0002] Data assets are data resources, recorded physically or electronically, owned or controlled by the data owner. Data assets can be provided to data users, for example, by providing raw data to users after secure computation. In existing technologies, secure computation involving data assets typically aggregates cloud service nodes into a computation space corresponding to a computation task. Within this computation space, each computation node acquires data uploaded from various data source nodes (each data source node is not considered a computation-capable node) and performs computations. Corresponding computation schemes may include multi-party secure computation, federated learning, or setting up a TEE environment for computation.

[0003] However, when the above method is used for calculation, the data is transmitted outside the local area where the data source is located, which does not comply with the secure calculation principle of data not leaving the domain and may pose a data security risk. Summary of the Invention

[0004] Based on the above-mentioned situation of the prior art, the purpose of this embodiment of the invention is to provide a method and apparatus for adjusting the boundary of data security computing space involving data assets, which constructs a dynamically adjustable secure computing space according to the needs of computing tasks, thereby improving the security of data computing.

[0005] To achieve the above objectives, according to one aspect of the present invention, a method for adjusting the boundary of a data security computing space is provided, applied on a server side, the method comprising:

[0006] A computing task is acquired, and a secure computing space and a data source for performing the computing are determined based on the computing task; the data source includes a first data source, and the secure computing space includes a first computing node to be adjusted to the boundary of the first data source;

[0007] Output network adjustment information to the first computing node so that the first computing node is adjusted to be within the boundary of the first data source;

[0008] Output connection authentication information to the first data source and the first computing node to establish intra-domain connection between the first data source and the first computing node and cross-domain connection between the first computing node and other computing nodes in the secure computing space, so as to transmit raw data through intra-domain connection and intermediate data through cross-domain connection.

[0009] Furthermore, the network adjustment information includes network information that needs to be adjusted, so that the first computing node adjusts the network of the first computing node and the network of the first data source to the same network according to the network adjustment information, so that the first computing node is adjusted to be within the boundary of the first data source. The target method includes at least one of the following: software-defined networking, adjusting the network gateway, and adjusting the network switch.

[0010] Furthermore, the secure computing space also includes a second computing node, which is used to connect with other computing nodes in the secure computing space;

[0011] The cross-domain connection between the first computing node and the second computing node is the second connection, which is used to transmit intermediate data.

[0012] Furthermore, the secure computing space also includes a third computing node, which is located on the same device as the second data source;

[0013] The cross-domain connection between the first computing node and the third computing node is the third connection, which is used to exchange intermediate data.

[0014] Furthermore, the second connection also includes a connection between the second computing node and the second computing node; the third connection also includes a connection between the third computing node and the third computing node, and a connection between the second computing node and the third computing node.

[0015] Furthermore, the secure computing space also includes a first computing node within the boundary of other data sources, and the cross-domain connection between the first computing nodes within different data source boundaries is a fourth connection, which is used to exchange intermediate data.

[0016] Furthermore, the method also includes:

[0017] Depending on the connection method between computing nodes, a key with an encryption level corresponding to the connection method is sent to each computing node; the encryption level corresponding to the cross-domain connection is higher than the encryption level corresponding to the intra-domain connection, or they can be the same encryption level.

[0018] Furthermore, the connection authentication information includes authentication certificates, enabling each computing node to authenticate each other based on the authentication certificates.

[0019] Furthermore, the method also includes:

[0020] Receive the trial connection feedback result sent by the computing node, and determine whether to replace the first computing node based on the trial connection feedback result.

[0021] According to a second aspect of the present invention, a method for adjusting the boundary of a data security computing space is also provided, applied to a computing node, the method comprising:

[0022] The system receives network adjustment information sent by the server and performs network adjustments based on this information to bring the computing node and the first data source into the same network, thereby placing the computing node within the boundary of the first data source. The computing node is located within a secure computing space, and the secure computing space and the first data source are determined according to the computing task.

[0023] It receives connection authentication information sent by the server, establishes intra-domain connections with the first data source and cross-domain connections with other computing nodes in the secure computing space, so as to transmit raw data through intra-domain connections and intermediate data through cross-domain connections.

[0024] According to a third aspect of the present invention, a method for adjusting the spatial boundary of data security computing is also provided, applied to a data source node, the method comprising:

[0025] The system receives network adjustment information sent by the server and adjusts the first computing node to within the boundary of the data source according to the network adjustment information; both the first computing node and the data source are located in a secure computing space, which is determined according to the computing task.

[0026] Receive connection authentication information sent by the server and establish an intra-domain connection with the first computing node to transmit raw data through the intra-domain connection.

[0027] According to a fourth aspect of the present invention, a data security computing space boundary adjustment device is also provided, applied on a server side, the device comprising:

[0028] An adjustment information determination module is used to acquire computing tasks and determine a secure computing space and data source for performing computing based on the computing tasks; the data source includes a first data source, and the secure computing space includes a first computing node to be adjusted to the boundary of the first data source;

[0029] The adjustment information output module is used to output network adjustment information to the first computing node so that the first computing node is adjusted to be within the boundary of the first data source;

[0030] The connection authentication information output module is used to output connection authentication information to the first data source and the first computing node to establish intra-domain connections between the first data source and the first computing node and cross-domain connections between the first computing node and other computing nodes in the secure computing space, so as to transmit raw data through intra-domain connections and intermediate data through cross-domain connections.

[0031] In summary, this invention provides a method and apparatus for adjusting the boundary of a secure computing space. The method includes: a server acquiring a computing task and determining a secure computing space and data source for computation based on the task; outputting network adjustment information to a first computing node to adjust the first computing node to the boundary of the first data source; and outputting connection authentication information to the first data source and the first computing node to establish an intra-domain connection between the first data source and the first computing node, and a cross-domain connection between the first computing node and other computing nodes in the secure computing space. This allows for the transmission of raw data via the intra-domain connection and intermediate data via the cross-domain connection. The technical solution of this invention constructs each computing node into a dynamically adjustable secure computing space according to the needs of the computing task. This allows some computing nodes to be allocated to the network boundary corresponding to the data source, enabling computation within the network boundary of the data source, and then transmitting the corresponding intermediate data for further computation. By adopting the above technical solution, the principle of ensuring that raw data does not leave the domain is satisfied, potential data security risks are avoided, and the security of data computation is improved. Attached Figure Description

[0032] Figure 1 This is a flowchart of a data security computing space boundary adjustment method provided in an embodiment of the present invention;

[0033] Figure 2 This is a flowchart of a data security computing space boundary adjustment method provided in another embodiment of the present invention;

[0034] Figure 3 This is a flowchart of a data security computing space boundary adjustment method provided in another embodiment of the present invention;

[0035] Figure 4 This is a schematic diagram of the network boundary and data interaction between nodes in an embodiment of the present invention;

[0036] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0037] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to specific embodiments and the accompanying drawings. It should be understood that these descriptions are merely exemplary and not intended to limit the scope of the invention. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concept of the invention.

[0038] It should be noted that, unless otherwise defined, the technical or scientific terms used in one or more embodiments of the present invention should have the ordinary meaning understood by one of ordinary skill in the art to which this disclosure pertains. The terms "first," "second," and similar terms used in one or more embodiments of the present invention do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the element or object listed following the word and its equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect.

[0039] The technical solution of the present invention will now be described in detail with reference to the accompanying drawings. An embodiment of the present invention provides a method for adjusting the boundary of a secure computing space, applied to a server-side application. This server-side application can be, for example, a regulatory body that monitors and manages the secure computing process. Figure 1 The flowchart of the data security computing space boundary adjustment method provided in this embodiment is shown below. Figure 1 As shown, the method includes the following steps:

[0040] S102. Obtain the computing task and determine the secure computing space and data source for performing the computing based on the computing task. The data source includes a first data source, and the secure computing space includes a first computing node to be adjusted to the boundary of the first data source. The computing task can be obtained from the client. In addition to the task to be computed, the computing task also includes the hardware, platform, algorithm, and data requirements required for the computing, or it can directly specify the data source of the required data so that the server can quickly locate the relevant data source node. In this step, the secure computing space and data source for performing the computing are determined based on the obtained computing task. The data source is used to provide the data required for the computing, but is not a node capable of performing the computing. The computing node is used to receive raw data sent by the data source or intermediate data sent by other computing nodes to perform the computing.

[0041] S104. Output network adjustment information to the first computing node so that the first computing node is adjusted to be within the boundary of the first data source. After determining the computing nodes in the secure computing space, determine the network adjustment information related to the secure computing space. The network adjustment information refers to the network information that needs to be adjusted. This network adjustment information enables the first computing node to adjust its network and the network of the first data source to be on the same network according to the target method, so that the first computing node is adjusted to be within the boundary of the first data source. The target method may include at least one of the following: software-defined networking, adjusting the network gateway, and adjusting the network switch.

[0042] S106. Output connection authentication information to the first data source and the first computing node to establish an intra-domain connection between the first data source and the first computing node, and a cross-domain connection between the first computing node and other computing nodes in the secure computing space. This allows for the transmission of raw data via the intra-domain connection and intermediate data via the cross-domain connection. After network adjustments, outputting connection authentication information to the first data source and the first computing node enables them to establish mutual authentication connections and authentication connections with other computing nodes in the secure computing space based on the connection authentication information. The connection authentication information may include authentication certificates or other common authentication methods, allowing computing nodes to authenticate each other based on the authentication certificates. Specifically, after network adjustments, the first data source and the first computing node are moved to the same network (an internal network, such as a local area network). The connection between the first data source and the first computing node is an intra-domain connection, which allows for the transmission of raw data with higher security. The connection between the first computing node and other computing nodes in the secure computing space is a cross-domain connection, which allows for the transmission of intermediate data with slightly lower security requirements.

[0043] The computing nodes involved in this embodiment of the invention can be classified into a first computing node, a second computing node, and a third settlement node. The first computing node refers to a computing node that needs network adjustment to be located within the same network as a predetermined first data source. The second computing node refers to a computing node that is not located in the same device as any data source, nor does it need to be assigned to any data source's network boundary; it can connect with other computing nodes in the secure computing space to perform multi-party computation. The third computing node refers to a computing node located in the same device as a predetermined second data source, which is a different data source from the first data source in the above embodiments. A cross-domain connection between the first and second computing nodes is defined as a second connection, used for transmitting intermediate data. A cross-domain connection between the first and third computing nodes is defined as a third connection, used for exchanging intermediate data. The connection between the first computing node and the data source adjusted to the same network in the above embodiments is defined as a first connection (i.e., an intra-domain connection), which can be used to transmit the original data provided by the data source. The second connection may further include connections between second computing nodes, i.e., connections between computing nodes that are not located in the same device as any data source; the third connection may further include connections between third computing nodes, and connections between second computing nodes, i.e., connections between computing nodes located in the same device as the second data source, or connections between other computing nodes that are not located in the same device as any data source. The first computing node, the second computing node, and / or the third computing node may constitute a secure computing space, wherein the computing nodes in the secure computing space include computing nodes within the network boundary of a data source and / or computing nodes outside the network boundary of the data source node.

[0044] According to certain optional embodiments, the secure computing space may further include a first computing node within the boundary of another data source, and the cross-domain connection between the first computing nodes within different data source boundaries is a fourth connection, which is used to exchange intermediate data.

[0045] According to some optional embodiments, the method further includes: sending a key with an encryption level corresponding to the connection method to each computing node, so that each computing node uses the key to encrypt the data to be transmitted, the calculation results, etc.; the encryption level corresponding to the cross-domain connection is higher than the encryption level corresponding to the intra-domain connection. In the above embodiments, different computing nodes are classified, and the connection methods are classified according to the connection between different categories of computing nodes. Among them, the first connection is an intra-domain connection, and the second, third, and fourth connections are all cross-domain connections. The encryption level of the cross-domain connection is higher than the encryption level of the intra-domain connection, thereby ensuring the security of intermediate data during transmission between computing nodes. Different encryption levels can also be set for the second, third, and fourth connections according to the actual situation.

[0046] According to some optional embodiments, the method further includes: receiving trial connection feedback results sent by the computing node, and determining whether to replace the first computing node based on the trial connection feedback results. After the computing node performs network adjustments based on the network adjustment information from the server, it can also perform trial connections with the data source and other computing nodes. These trial connections can be initiated based on trial connection instructions issued by the server or can be initiated spontaneously by the computing node. Through connection testing via trial connections, the computing node can determine whether it can establish a connection and transmit data with the data source or other computing nodes, and send the trial connection feedback results to the server. If the feedback results indicate that the connection failed after the network adjustment, the server can determine whether to replace the first computing node requiring network adjustments after analyzing the feedback results.

[0047] An embodiment of the present invention also provides a method for adjusting the boundary of a data security computing space, which is applied to a computing node, such as a related node capable of providing data computing power. Figure 2 The flowchart of the data security computing space boundary adjustment method provided in this embodiment is shown below. Figure 2 As shown, the method includes the following steps:

[0048] S202. Receive network adjustment information sent by the server, and perform network adjustment according to the network adjustment information to adjust the computing node and the first data source to the same network, so that the computing node is adjusted to be within the boundary of the first data source; the computing node is located in a secure computing space, and the secure computing space and the first data source are determined according to the computing task. In this embodiment of the present invention, the computing node is, for example, the first computing node that needs network adjustment. The first computing node and the first data source do not belong to the same device. After network adjustment according to the network adjustment information, it is adjusted to be within the network boundary of the first data source, that is, within the same network (local area network) as the first data source. This allows the first computing node to perform calculations using data from the first data source while remaining within the boundary of the first data source, satisfying the principle that the original data does not leave the domain and improving the security of data calculation.

[0049] S204. Receive connection authentication information sent by the server, establish intra-domain connection with the first data source and cross-domain connection with other computing nodes in the secure computing space, so as to transmit raw data through intra-domain connection and intermediate data through cross-domain connection.

[0050] According to some optional embodiments, the method further includes: after adjusting the network according to the network adjustment information, establishing a trial connection with the data source and other computing nodes, and sending the feedback result of the trial connection to the server. This trial connection can be initiated based on a trial connection command issued by the server, or it can be initiated spontaneously by the computing node. By conducting connection tests through trial connections, the computing node can determine whether it can establish a connection with the data source or other computing nodes and perform data transmission, and sends the feedback result of the trial connection to the server.

[0051] An embodiment of the present invention also provides a method for adjusting the boundary of a data security computing space, which is applied to a data source node, such as a related node that can provide the data required for computing. Figure 3 The flowchart of the method for dynamically adjusting the boundary of the secure computing space provided in this embodiment is shown below. Figure 3 As shown, the method includes the following steps:

[0052] S302. Receive network adjustment information sent by the server, and adjust the first computing node to the boundary of the data source according to the network adjustment information; both the first computing node and the data source are located in a secure computing space, and the secure computing space and the data source are determined according to the computing task.

[0053] S304. Receive connection authentication information sent by the server and establish an intra-domain connection with the first computing node to transmit raw data through the intra-domain connection.

[0054] The technical solution provided in this embodiment of the present invention corresponds to the method for dynamically adjusting the boundary of the secure computing space of the server and computing nodes involved in the above embodiments, and its repeated description will be omitted here.

[0055] An embodiment of the present invention also provides a data security computing space boundary adjustment device, applied on a server side, the device comprising:

[0056] An adjustment information determination module is used to acquire computing tasks and determine a secure computing space and data source for computing based on the computing tasks; the data source includes a first data source, and the secure computing space includes a first computing node to be adjusted to the boundary of the first data source.

[0057] The adjustment information output module is used to output network adjustment information to the first computing node so that the first computing node is adjusted to be within the boundary of the first data source.

[0058] The connection authentication information output module is used to output connection authentication information to the first data source and the first computing node to establish intra-domain connections between the first data source and the first computing node and cross-domain connections between the first computing node and other computing nodes in the secure computing space, so as to transmit raw data through intra-domain connections and intermediate data through cross-domain connections.

[0059] The specific process by which each module in the data security computing space boundary adjustment device provided in the above embodiments of the present invention realizes its function is the same as the steps of the dynamic boundary adjustment method of the secure computing space provided in the above embodiments of the present invention. Therefore, the repeated description will be omitted here.

[0060] Figure 4 The diagram illustrates the network boundary and data interaction between nodes in the data security computing space boundary adjustment method provided by an embodiment of the present invention, as shown below. Figure 4 As shown, in this method for dynamically adjusting the boundaries of the secure computing space, the server (e.g., the regulator) determines the computing framework and its component information and sends them to each computing node and data source node, so that each computing node and data source node can adjust the network according to the component information. Figure 4The illustrated embodiment includes computing node 1 (the first computing node), computing node 2 (the second computing node), computing node 3 (the third computing node), and data source 1 and data source 2. Computing node 1 and the node containing data source 1 are configured into an intranet with the same network boundary through network boundary adjustments. Computing node 1 and the node containing data source 1 can transmit raw data within this intranet. Computing node 3 is a data node provided by the node containing data source 2, meaning that computing node 3 and data source 2 belong to the same device. Computing nodes 1, 2, and 3 constitute a secure computing space, and intermediate data can be exchanged between each of them to achieve multi-party computation. The technical solution of this embodiment satisfies the principle that raw data does not leave the domain. In each computation of each computing node, data crossing the boundary is secure and compliant, and each boundary change of each node is secure, thereby achieving secure data computation.

[0061] An embodiment of the present invention also provides an electronic device. Figure 5 The diagram shown is a structural schematic of an electronic device provided according to an embodiment of the present invention. Figure 5 As shown, the electronic device 500 includes: one or more processors 501 and a memory 502; and computer program instructions stored in the memory 502, which, when executed by the processor 501, cause the processor 501 to perform the data security computing space boundary adjustment method as described in any of the above embodiments. The processor 501 may be a central processing unit (CPU) or other form of processing unit with data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions.

[0062] The memory 502 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and / or cache memory. Non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 501 may execute the program instructions to implement the steps in the data security computing space boundary adjustment method of the various embodiments of the present invention described above, and / or other desired functions.

[0063] In some embodiments, the electronic device 500 may further include an input device 503 and an output device 504, these components being connected via a bus system and / or other forms of connection mechanisms. Figure 5(Not shown in the diagram) Interconnected. For example, when the electronic device is a standalone device, the input device 503 can be a communication network connector for receiving acquired input signals from external mobile devices. Furthermore, the input device 503 may also include, for example, a keyboard, mouse, microphone, etc. The output device 504 can output various information to the outside, and may include, for example, a monitor, speaker, printer, and communication network and its connected remote output devices.

[0064] In addition to the methods and devices described above, embodiments of the present invention may also be computer program products, including computer program instructions, which, when executed by a processor, cause the processor to perform the steps in the data security computing space boundary adjustment method of any of the above embodiments.

[0065] Computer program products can be written in any combination of one or more programming languages ​​to perform the operations of the embodiments of the present invention. The programming languages ​​include object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0066] Furthermore, embodiments of the present invention may also be computer-readable storage media storing computer program instructions thereon, which, when executed by a processor, cause the processor to perform the steps in the data security computing space boundary adjustment method of various embodiments of the present invention.

[0067] Computer-readable storage media may take the form of any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may, for example, include, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0068] It should be understood that the processor in the embodiments of the present invention can be a Central Processing Unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0069] In summary, this invention relates to a method and apparatus for adjusting the boundary of a secure computing space. The method includes: a server acquiring a computing task and determining a secure computing space and a data source for computation based on the task; outputting network adjustment information to a first computing node to adjust the first computing node to the boundary of the first data source; and outputting connection authentication information to the first data source and the first computing node to establish an intra-domain connection between the first data source and the first computing node, and a cross-domain connection between the first computing node and other computing nodes in the secure computing space. This allows for the transmission of raw data via the intra-domain connection and intermediate data via the cross-domain connection. The technical solution of this invention constructs each computing node into a dynamically adjustable secure computing space according to the needs of the computing task. This allows some computing nodes to be allocated to the network boundary corresponding to the data source, enabling computation within the network boundary of the data source, and then transmitting the corresponding intermediate data for further computation. By adopting the above technical solution, the principle of ensuring that raw data does not leave the domain is satisfied, potential data security risks are avoided, and the security of data computation is improved.

[0070] It should be understood that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of the invention (including the claims) is limited to these examples. Within the framework of this invention, technical features of the above embodiments or different embodiments can also be combined, steps can be implemented in any order, and many other variations exist regarding different aspects of one or more embodiments of the invention as described above, which are not provided in the details for the sake of brevity. The specific embodiments described above are merely illustrative or explanatory of the principles of the invention and do not constitute a limitation thereof. Therefore, any modifications, equivalent substitutions, improvements, etc., made without departing from the spirit and scope of the invention should be included within the protection scope of the invention. Furthermore, the appended claims are intended to cover all variations and modifications falling within the scope and boundaries of the appended claims, or equivalent forms of such scope and boundaries.

Claims

1. A method for adjusting the boundary of a data security computing space, characterized in that, Applied to the server side, the method includes: A computing task is acquired, and a secure computing space and a data source for performing the computing are determined based on the computing task; the data source includes a first data source, and the secure computing space includes a first computing node to be adjusted to the boundary of the first data source; Output network adjustment information to the first computing node so that the first computing node is adjusted to be within the boundary of the first data source; the network adjustment information includes network information that needs to be adjusted so that the first computing node adjusts the network of the first computing node and the network of the first data source to be the same network according to the network adjustment information, so that the first computing node is adjusted to be within the boundary of the first data source. Output connection authentication information to the first data source and the first computing node to establish intra-domain connection between the first data source and the first computing node and cross-domain connection between the first computing node and other computing nodes in the secure computing space, so as to transmit raw data through intra-domain connection and intermediate data through cross-domain connection.

2. The method according to claim 1, characterized in that, The target method includes at least one of the following: software-defined networking, adjusting the gateway, and adjusting the network switch.

3. The method according to claim 2, characterized in that, The secure computing space also includes a second computing node, which is used to connect with other computing nodes in the secure computing space. The cross-domain connection between the first computing node and the second computing node is the second connection, which is used to transmit intermediate data.

4. The method according to claim 3, characterized in that, The secure computing space also includes a third computing node, which is located on the same device as the second data source. The cross-domain connection between the first computing node and the third computing node is the third connection, which is used to exchange intermediate data.

5. The method according to claim 3 or 4, characterized in that, The second connection also includes a connection between the second computing node and the second computing node; the third connection also includes a connection between the third computing node and the third computing node, and a connection between the second computing node and the third computing node.

6. The method according to claim 5, characterized in that, The secure computing space also includes a first computing node within the boundary of other data sources. The cross-domain connection between the first computing nodes within different data source boundaries is a fourth connection, which is used to exchange intermediate data.

7. The method according to claim 6, characterized in that, The method further includes: Based on the connection method between computing nodes, a key corresponding to the encryption level of the connection method is sent to each computing node; the encryption level corresponding to the cross-domain connection is higher than the encryption level corresponding to the intra-domain connection.

8. The method according to claim 1, characterized in that, The connection authentication information includes authentication certificates, enabling each computing node to authenticate each other based on the authentication certificates.

9. The method according to claim 1, characterized in that, The method further includes: Receive the trial connection feedback result sent by the computing node, and determine whether to replace the first computing node based on the trial connection feedback result.

10. A method for adjusting the boundary of a data security computing space, characterized in that, Applied to compute nodes, the method includes: The system receives network adjustment information sent by the server and performs network adjustments based on this information to bring the computing node and the first data source into the same network, thereby placing the computing node within the boundary of the first data source. The computing node is located within a secure computing space, and the secure computing space and the first data source are determined according to the computing task. The network adjustment information includes network information that needs to be adjusted, so that the first computing node, according to the network adjustment information, adjusts the network of the first computing node and the network of the first data source into the same network through a target method, thereby placing the first computing node within the boundary of the first data source. It receives connection authentication information sent by the server, establishes intra-domain connections with the first data source and cross-domain connections with other computing nodes in the secure computing space, so as to transmit raw data through intra-domain connections and intermediate data through cross-domain connections.

11. A data security computing space boundary adjustment device, characterized in that, The device, applied to the server side, includes: An adjustment information determination module is used to acquire computing tasks and determine a secure computing space and data source for performing computing based on the computing tasks; the data source includes a first data source, and the secure computing space includes a first computing node to be adjusted to the boundary of the first data source; An adjustment information output module is used to output network adjustment information to the first computing node so that the first computing node is adjusted to be within the boundary of the first data source; the network adjustment information includes network information that needs to be adjusted so that the first computing node adjusts the network of the first computing node and the network of the first data source to the same network according to the network adjustment information, so that the first computing node is adjusted to be within the boundary of the first data source. The connection authentication information output module is used to output connection authentication information to the first data source and the first computing node to establish intra-domain connections between the first data source and the first computing node and cross-domain connections between the first computing node and other computing nodes in the secure computing space, so as to transmit raw data through intra-domain connections and intermediate data through cross-domain connections.

Images