Resource management method, resource allocation method, device, equipment and storage medium

Abstract

The application provides a resource management method, a resource allocation method, a device, equipment and a storage medium. The method comprises the following steps: determining at least one computing node for executing a task and the number of computing resources required for each execution environment in each computing node of the at least one computing node according to the identity of the task, the execution environment where the computing resources allocated to the task are located, the total number of computing resources required for each execution environment and resource management information; and sending a first instruction to each computing node, so that the computing node runs a client application program of a TEE in a REE and a trusted application program in the TEE under the condition that the execution environment where the computing resources allocated to the task are located comprises the TEE, and the trusted application program in the TEE sends the identity of the computing resources for executing the task to the client application program of the TEE. In this way, the resource management node can communicate with the TEE through the REE, thereby completing unified management and scheduling of resources.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of distributed systems, and particularly relates to a resource management method, a resource allocation method, a device, an apparatus and a storage medium. BACKGROUND

[0002] A trusted execution environment (TEE) is a secure trusted area in a processor, which can guarantee the security, confidentiality and integrity of codes and data placed therein. The TEE provides an isolated execution environment, and codes and data can run in the trusted area, and the calculation during the running process can be guaranteed not to be disturbed by a regular operating system, so that the confidentiality and integrity of the codes and data can be guaranteed. There are many implementation manners of the TEE, such as Intel's SGX, AMD's SEV, ARM's TrustZone (trusted area) and the like.

[0003] At present, in a distributed system, a resource manager is usually used to manage the allocation and scheduling of computing resources in computing nodes in the distributed system. However, in the related art, the execution environment of the computing node is usually divided into a TEE and a rich execution environment (REE). However, since the TEE provides an isolated execution environment, the resource manager cannot manage the computing resources corresponding to the TEE.

[0004] Therefore, a scheme capable of uniformly managing and scheduling the computing resources corresponding to the TEE and the computing resources corresponding to the REE is needed. SUMMARY

[0005] Embodiments of the present application provide a resource management method, a resource allocation method, a device, an apparatus and a storage medium. By running a client application in the REE and a trusted application in the TEE, the use of the computing resources in the TEE is obtained through the client application, and the computing resources corresponding to the TEE and the computing resources corresponding to the REE are uniformly managed and scheduled.

[0006] In a first aspect, an embodiment of the present application provides a resource management method applied to a resource management node in a distributed system. The resource management node stores resource management information, and the resource management information is used to indicate the resource use in all computing nodes in the distributed system. The method comprises the following steps.

[0007] determining resource allocation information, the resource allocation information carrying an identity of a task, an execution environment where a computing resource allocated to the task is located, and a total number of computing resources needed to be allocated to the task in each execution environment, the task management node being a computing node for managing running of the task;

[0008] determining, according to the identity of the task, the execution environment where the computing resource allocated to the task is located, the total number of computing resources needed to be allocated to the task in each execution environment, and the resource management information, at least one computing node for executing the task and a number of computing resources needed to be allocated to the task in each execution environment in each computing node of the at least one computing node;

[0009] sending, to each computing node, a first instruction for indicating the identity of the task, the execution environment where the computing resource allocated to the task is located, and the number of computing resources needed to be allocated to the task in each execution environment, so that the computing node runs a client application of a TEE in the REE and a trusted application in the TEE in a case where the execution environment where the computing resource allocated to the task is located includes the TEE, so that the client application of the TEE sends a second instruction including the number of computing resources allocated to the task to the trusted application in the TEE, and the trusted application in the TEE sends, to the client application of the TEE, an identity of a computing resource for executing the task according to the number of computing resources allocated to the task.

[0010] According to an embodiment of the present application, a client application of a TEE is deployed in an REE to communicate with a trusted application in the TEE. In this way, the resource management node can communicate with the TEE through the REE to complete unified management and scheduling of resources.

[0011] In a possible implementation, the method further includes:

[0012] receiving task information sent by a client, the task information including a task to be executed, an execution environment where a computing resource allocated to the task is located, and a total number of computing resources needed to be allocated to the task in each execution environment;

[0013] sending, to a task management node, the task information for the task management node to store the task and allocate a container for managing running of the task.

[0014] In a possible implementation, the method further includes:

[0015] receive a registration request sent by a task management node, the task management node being a computing node for managing execution of the task;

[0016] in response to the registration request, send an identity of the task to the task management node for the task management node to store the task in association with the identity of the task.

[0017] In a possible implementation, the method further includes:

[0018] determine an identity of a computing resource for executing the task;

[0019] store the identity of the computing resource for executing the task in association with the identity of the task in resource management information.

[0020] In a second aspect, an embodiment of the present application provides a resource allocation method applied to a computing node in a distributed system, the computing node running a development execution environment (REE) and a trusted execution environment (TEE), a client application of the TEE running in the REE, a trusted application running in the TEE, the client application and the trusted application communicating through an interface, and the method including:

[0021] receive a first instruction sent by a resource management node, the first instruction being used for indicating an identity of a task, an execution environment in which a computing resource allocated to the task is located, and a quantity of the computing resource in each execution environment that needs to be allocated to the task;

[0022] in a case where the execution environment in which the computing resource allocated to the task is located includes the TEE, run the client application of the TEE in the REE and the trusted application in the TEE, so that the client application of the TEE sends a second instruction to the trusted application in the TEE, the second instruction including the quantity of the computing resource allocated to the task, and the trusted application in the TEE sends an identity of the computing resource for executing the task to the client application of the TEE according to the quantity of the computing resource allocated to the task.

[0023] According to an embodiment of the present application, the client application of the TEE is deployed in the REE, so as to communicate with the trusted application in the TEE. In this way, the resource management node can communicate with the TEE through the REE, thereby completing unified management and scheduling of resources.

[0024] In a possible implementation, the second instruction further includes the identity of the task, so as to be used for the trusted application in the TEE to bind the task with the computing resource for executing the task.

[0025] In a possible implementation, the method further includes:

[0026] receiving a third instruction for starting the task, the third instruction including the identity of the task, the third instruction being an instruction generated in a case where the allocation of the computing resource for the task is completed;

[0027] determining the computing resource bound by the task according to the identity of the task;

[0028] executing the task by the computing resource.

[0029] In a possible implementation, in a case where the computing node is a task management node for managing the running of the task, the method further includes:

[0030] determining a third instruction for starting the task, the third instruction including the identity of the task, the third instruction being an instruction generated in a case where the allocation of the computing resource for the task is completed;

[0031] determining the computing resource bound by the task according to the identity of the task;

[0032] executing the task by the computing resource.

[0033] In a possible implementation, the method further includes:

[0034] receiving the task information sent by the resource management node, the task information including the task to be executed, the execution environment in which the computing resource allocated to the task is located, and the total number of the computing resources to be allocated to the task in each execution environment;

[0035] storing the task.

[0036] In a possible implementation, the method further includes:

[0037] sending a registration request to the resource management node to request the identity of the task from the resource management node;

[0038] receiving the identity sent by the resource management node;

[0039] storing the task in association with the identity of the task.

[0040] In a possible implementation, the method further includes:

[0041] sending the resource allocation information to the resource management node, the resource allocation information carrying the identity of the task, the execution environment in which the computing resource allocated to the task is located, and the total number of the computing resources to be allocated to the task in each execution environment.

[0042] In a possible implementation, the method further includes:

[0043] sending, to the resource management node, identity of the computing resource for executing the task, so that the resource management node stores the identity of the computing resource for executing the task and the identity of the task in the resource management information in association.

[0044] In a third aspect, an embodiment of the present application provides a resource management apparatus applied to a resource management node in a distributed system, the resource management node storing resource management information, the resource management information being used to indicate resource usage in all computing nodes in the distributed system, and the method includes:

[0045] a first determining module configured to determine resource allocation information, the resource allocation information carrying identity of a task, an execution environment where computing resources allocated to the task are located, and a total number of computing resources of each execution environment that need to be allocated to the task, the task management node being a computing node used to manage running of the task;

[0046] a second determining module configured to determine, according to the identity of the task, the execution environment where the computing resources allocated to the task are located, the total number of computing resources of each execution environment that need to be allocated to the task, and the resource management information, at least one computing node used to execute the task and a number of computing resources of each execution environment in each computing node of the at least one computing node that need to be allocated to the task;

[0047] a sending module configured to send, to each computing node, a first instruction, the first instruction being used to indicate the identity of the task, the execution environment where the computing resources allocated to the task are located, and the number of computing resources of each execution environment that need to be allocated to the task, so that, in a case where the execution environment where the computing resources allocated to the task are located includes a TEE, the computing node runs a client application of the TEE in the REE and a trusted application in the TEE, the client application of the TEE sends a second instruction to the trusted application in the TEE, the second instruction including the number of computing resources allocated to the task, and the trusted application in the TEE sends, to the client application of the TEE, identity of the computing resource for executing the task according to the number of computing resources allocated to the task.

[0048] According to an embodiment of the present application, a client application of a TEE is deployed in an REE, so as to communicate with a trusted application in the TEE. In this way, the resource management node can communicate with the TEE through the REE, thereby completing unified management and scheduling of resources.

[0049] In a possible implementation, the apparatus further includes:

[0050] The receiving module is configured to receive task information sent by a client, the task information including a task to be executed, an execution environment where a computing resource allocated to the task is located, and a total number of computing resources to be allocated to the task in each execution environment;

[0051] The sending module is further configured to send the task information to a task management node, so that the task management node stores the task and allocates a container for managing running of the task to the task.

[0052] In a possible implementation, the apparatus further includes:

[0053] The receiving module is configured to receive a registration request sent by a task management node, the task management node being a computing node for managing running of the task.

[0054] The sending module is further configured to send an identity to the task management node in response to the registration request, so that the task management node stores the task in association with the identity of the task.

[0055] In a possible implementation, the apparatus further includes:

[0056] The third determining module is configured to determine an identity of a computing resource for executing the task.

[0057] The storage module is configured to store the identity of the computing resource for executing the task in association with the identity of the task in resource management information.

[0058] In a fourth aspect, an embodiment of the present application provides a resource allocation apparatus, applied to a computing node in a distributed system, the computing node running a remote execution environment (REE) and a trusted execution environment (TEE), a client application of the TEE running in the REE, a trusted application running in the TEE, the client application and the trusted application communicating through an interface, and the apparatus including:

[0059] The receiving module is configured to receive a first instruction sent by a resource management node, the first instruction being used to indicate an identity of a task, an execution environment where a computing resource allocated to the task is located, and a number of computing resources to be allocated to the task in each execution environment.

[0060] The running module is configured to run the client application of the TEE in the REE and the trusted application in the TEE in the case where the execution environment where the computing resource allocated to the task is located comprises the TEE, so that the client application of the TEE sends a second instruction to the trusted application in the TEE, and the second instruction comprises the number of computing resources allocated to the task, and the trusted application in the TEE sends the identity of the computing resource used to execute the task to the client application of the TEE according to the number of computing resources allocated to the task.

[0061] According to the embodiment of the present application, the client application of the TEE is deployed in the REE, so as to communicate with the trusted application in the TEE. In this way, the resource management node can communicate with the TEE through the REE, thereby completing unified management and scheduling of resources.

[0062] In a possible implementation, the second instruction further comprises the identity of the task, so as to enable the trusted application in the TEE to bind the task with the computing resource used to execute the task.

[0063] In a possible implementation, the receiving module is further configured to receive a third instruction for starting the task, the third instruction comprising the identity of the task, and the third instruction being an instruction generated in the case where the allocation of the computing resource of the task is completed.

[0064] The determining module is configured to determine the computing resource bound by the task according to the identity of the task.

[0065] The executing module is configured to execute the task by using the computing resource.

[0066] In a possible implementation, in the case where the computing node is a task management node used to manage the running of tasks, the apparatus further comprises:

[0067] The determining module is configured to determine a third instruction for starting the task, the third instruction comprising the identity of the task, and the third instruction being an instruction generated in the case where the allocation of the computing resource of the task is completed.

[0068] The determining module is further configured to determine the computing resource bound by the task according to the identity of the task.

[0069] The executing module is configured to execute the task by using the computing resource.

[0070] In a possible implementation, the apparatus further comprises:

[0071] receive the task information sent by the resource management node, the task information comprising a task to be executed, an execution environment where computing resources allocated to the task are located, and a total number of computing resources to be allocated to the task in each execution environment;

[0072] The storage module is configured to store the task.

[0073] In a possible implementation, the apparatus further comprises:

[0074] The sending module is configured to send a registration request to the resource management node to request an identity of the task from the resource management node;

[0075] The receiving module is configured to receive the identity sent by the resource management node.

[0076] The storage module is configured to store the task in association with the identity of the task.

[0077] In a possible implementation, the apparatus further comprises:

[0078] The sending module is configured to send resource allocation information to the resource management node, the resource allocation information carrying the identity of the task, the execution environment where computing resources allocated to the task are located, and the total number of computing resources to be allocated to the task in each execution environment.

[0079] In a possible implementation, the apparatus further comprises:

[0080] The sending module is configured to send an identity of a computing resource used to execute the task to the resource management node, so that the resource management node stores the identity of the computing resource used to execute the task in association with the identity of the task in resource management information.

[0081] In a fifth aspect, an embodiment of the present application provides a resource management system, comprising:

[0082] The resource management node is configured to execute the method in the first aspect.

[0083] The computing node is configured to execute the method in the second aspect.

[0084] In a sixth aspect, an embodiment of the present application provides a computing device, comprising:

[0085] at least one memory configured to store a program;

[0086] At least one processor configured to execute a program stored in the memory, when the program stored in the memory is executed, the processor is configured to execute the method of the first aspect, or is configured to execute the method of the second aspect.

[0087] In a seventh aspect, an embodiment of the present application provides a computing device, characterized in that the device runs computer program instructions to execute the method provided in the first aspect, or executes the method provided in the second aspect. For example, the device can be a chip or a processor.

[0088] In one example, the device can include a processor which can be coupled with a memory, reads instructions in the memory and executes the method provided in the first aspect according to the instructions, or executes the method provided in the second aspect according to the instructions. Wherein, the memory can be integrated in the chip or the processor, or can be independent of the chip or the processor.

[0089] In an eighth aspect, an embodiment of the present application provides a computer storage medium, and the computer storage medium stores instructions, when the instructions are run on a computer, the computer executes the method provided in the first aspect, or executes the method provided in the second aspect.

[0090] In a ninth aspect, an embodiment of the present application provides a computer program product containing instructions, when the instructions are run on a computer, the computer executes the method provided in the first aspect, or executes the method provided in the second aspect. BRIEF DESCRIPTION OF DRAWINGS

[0091] Figure 1 is a system architecture diagram of a distributed system provided by an embodiment of the present application;

[0092] Figure 2 is a system architecture diagram of a Yarn resource management system provided by an embodiment of the present application;

[0093] Figure 3 is another system architecture diagram of a Yarn resource management system provided by an embodiment of the present application;

[0094] Figure 4 is a flowchart of a resource management method provided by an embodiment of the present application;

[0095] Figure 5 is another system architecture diagram of a Yarn resource management system provided by an embodiment of the present application;

[0096] Figure 6 is another flowchart of a resource management method provided by an embodiment of the present application;

[0097] Figure 7is a flowchart of a resource allocation method provided by an embodiment of the present application;

[0098] Figure 8 is a structural diagram of a resource management apparatus provided by an embodiment of the present application;

[0099] Figure 9 is a structural diagram of a resource allocation apparatus provided by an embodiment of the present application;

[0100] Figure 10 is a structural diagram of a computing device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0101] In order to make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described below with reference to the drawings.

[0102] In the description of the embodiments of the present application, the words "exemplary", "for example", or "for instance" are used to mean serving as an example, instance or illustration. Any embodiment or design solution described as "exemplary", "for example" or "for instance" in the embodiments of the present application should not be interpreted as being more advantageous or preferred than other embodiments or design solutions. In fact, the use of the words "exemplary", "for example" or "for instance" is intended to present the relevant concept in a specific manner.

[0103] In the description of the embodiments of the present application, the term "and / or" is merely used to describe an association relationship of associated objects, and means that there can be three relationships, for example, A and / or B can mean that there are three cases of A alone, B alone, and A and B simultaneously. In addition, unless otherwise specified, the term "multiple" means two or more. For example, multiple systems mean two or more systems, and multiple terminals mean two or more terminals.

[0104] In addition, the terms "first", "second" are used for description purposes only, and should not be interpreted or implied to indicate relative importance or implicitly indicate the indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include one or more features. The terms "include", "contain", "have" and their variants mean "include but not limited to", unless otherwise specifically emphasized.

[0105] Before the present application is described in detail, the professional terms involved in the present application are first described.

[0106] TrustZone technology: ARM system provides a secure hardware architecture, the TrustZone hardware architecture aims to provide a security framework, so that the device can resist the many specific threats that will be encountered. TrustZone conceptually divides the hardware and software resources of a System on Chip (SoC) into a Secure World and a Normal World.

[0107] TEE: Trusted Execution Environment, corresponding to the Secure World.

[0108] REE: Rich OS Application Environment, corresponding to the Normal World.

[0109] Yet Another Resource Negotiator (Yarn): a resource manager of Hadoop, it is a general resource management system that provides unified resource management and scheduling for upper-layer applications. Its introduction brings great benefits to cluster utilization, resource unified management and data sharing.

[0110] Kubernetes: for short k8s, used to manage containerized applications on multiple hosts in the cloud platform. The goal of Kubernetes is to make it simple and efficient to deploy containerized applications. Kubernetes provides a mechanism for application deployment, planning, updating and maintenance.

[0111] At present, various big data resource management mechanisms provide unified resource management and resource scheduling for upper-layer applications. For example, Yarn resource management mechanism and k8s resource management mechanism. Figure 1 As shown in the figure, a distributed system with a resource management mechanism usually includes a resource management node 101 and a plurality of computing nodes 102 (such as 1021 to 102N in the figure). Figure 1 Among them, the resource management node 101 is used to manage and schedule resources in the plurality of computing nodes 102, such as managing and scheduling computing resources and storage resources in the computing nodes. The plurality of computing nodes 102 are responsible for data processing and other computing functions.

[0112] In some embodiments, the resource management node can be regarded as a computing node with a resource management mechanism, which can perform resource management and resource scheduling.

[0113] In some embodiments, the resource management node and the computing node provided by the embodiments of the present application can be devices or device clusters with computing and storage functions, such as servers or server clusters.

[0114] Exemplarily, Figure 2 An architecture diagram of a Yarn resource management system is shown. As Figure 2 shown, the Yarn resource management system includes a resource management module (Resource Manager, RM) 201, a node management module (Node Manager, NM) 202, and an application master (Application Master, AM) 203. Here, the Yarn resource management system can be regarded as a distributed system with a Yarn resource management mechanism. Some modules in the Yarn resource management system are deployed in the computing nodes in the distributed system, such as the NM and the AM.

[0115] In this example, the Yarn resource management system has only one RM, which is used for unified management and scheduling of resources, and the main functions include processing requests from clients, starting / monitoring AMs, monitoring NMs, and performing resource allocation and scheduling. Each computing node in the Yarn resource management system is deployed with an NM, which is used for management and use of resources of the computing node, and is specifically used for management of resources and tasks on the computing node and processing of commands from the AM and the RM. Each computing node includes multiple applications, and the AM is used for management of the applications in the computing node, and is specifically used for application for resources such as CPU and memory by the applications, and further allocation of tasks to the computing node, which are tasks submitted by the client. Here, the AM and the application are in a one-to-one correspondence, that is, one AM can only manage one application. The AM is also used for monitoring of tasks and fault tolerance of the tasks. The container is an abstraction of the running environment of the task, and can describe information in the running process of the task, such as running resources of the task, starting instructions of the task, and the running environment of the task.

[0116] However, after the introduction of the TrustZone technology in the distributed system, the Yarn resource management mechanism is invalid in some scenarios. For example, when the request submitted by the client is to process private data, the computing node needs to put the operation involving the private data into the TEE to execute. When the task of processing the private data is executed in the TEE, the use of the CPU and the memory is not controlled by the Yarn, and thus the resources in the computing node can be exhausted.

[0117] Exemplarily, asFigure 3 As shown, the computing node includes the REE and the TEE. Among them, the NM in the REE can communicate with the RM in the resource management node, so as to report the resource usage in the REE in the computing node to the RM, and the RM uniformly manages and schedules the computing resources of the REE according to the resource usage in the REE in the plurality of computing nodes. However, due to the introduction of the TrustZone technology, the RM cannot uniformly manage and schedule the computing resources of the TEE in all computing nodes.

[0118] Based on this, the embodiment of the application provides a resource management method, device, equipment and storage medium, by deploying a client application of the TEE in the REE, thereby communicating with the trusted application in the TEE. In this way, the resource management node can communicate with the TEE through the REE, thereby completing the unified management and scheduling of resources.

[0119] Next, based on Figure 2 The Yarn resource management system in the corresponding embodiment, the resource management method related to the embodiment of the application is described in detail.

[0120] Figure 4 is a flowchart of the resource management method provided by the embodiment of the application. The resource management method provided by the embodiment of the application is applied to Figure 2 The Yarn resource management system as shown. As Figure 4 The resource management method provided by the embodiment of the application includes steps S401-S410.

[0121] S401, the resource management node receives the task sent by the client.

[0122] As Figure 5 shown, the user can submit a task to the resource management node AM through the client, and the task is any kind of data processing task, for example, calculating data, training a neural network model, etc.

[0123] S402, the resource management node sends task information to the task management node, wherein the task information includes the task to be executed, the execution environment where the computing resources allocated to the task are located, and the total number of computing resources of each execution environment that needs to be allocated to the task.

[0124] The task management node is a computing node for managing tasks in the plurality of computing nodes. The task management node can be randomly allocated by the resource management node from the plurality of computing nodes.

[0125] The resources required by different tasks and the required running environment are different. The resource management node can determine the number of computing resources required when running the task, the execution environment where the computing resources are located, and the total number of computing resources allocated to the task under each execution environment.

[0126] As a possible implementation, the user can specify the number of resources required to run the task and the running environment to which the resources belong through the client when submitting the task. For example, the task is to calculate the area of a square, which requires 2 cores of CPU in the REE and 2 cores of CPU in the TEE.

[0127] As another possible implementation, the resource management node can specify the number of resources required to run the task and the running environment to which the resources belong according to the task.

[0128] The resource management node forwards the task and the information of the resources required to execute the task to the task management node. Specifically, the resource management module in the resource management node sends the task information to the node management module in the task management node.

[0129] S403, the task management node sends a registration request to the resource management node according to the task information.

[0130] S404, the resource management node parses the registration request to save the identity of the task.

[0131] The task management node can generate the identity of the task according to the task information and send a registration request to the resource management node. The registration request carries the identity of the task. In this way, the resource management node can uniformly schedule and manage the resources required by the task according to the identity of the task.

[0132] In some embodiments, after the task management node registers the task, the resource management node can monitor the running state of the task and can apply for resources for the task to uniformly manage and schedule the resources in different running environments.

[0133] S405, the task management node sends resource allocation information to the resource management node, which carries the identity of the task, the execution environment of the computing resources allocated to the task, and the total number of computing resources of each execution environment required to be allocated to the task.

[0134] The resource allocation information is used to indicate the number of resources required to be allocated to the task and the running environment of the resources. The resource management node can allocate resources to the task based on the resource allocation information.

[0135] S406, the resource management node determines at least one computing node for executing the task and the number of computing resources of each execution environment in each computing node required to be allocated to the task according to the resource allocation information and the resource management information.

[0136] The resource management information is used to indicate the usage of the computing resources in all computing nodes, for example, the number of used CPU cores in the REE of the computing node, the total number of CPU cores, the identity of the task to be executed, the total capacity of the memory and the used capacity of the memory, the total number of CPU cores in the TEE of the computing node, the number of used CPU cores, the identity of the task to be executed, the total capacity of the memory and the used capacity of the memory.

[0137] Exemplarily, the resource management information in the resource management node is shown in Table 1. The number of CPU cores in node 1 is 16 cores, of which the number of used CPU cores in the REE is 4, and the identity of the task to be executed by the 4-core CPU is task 1. The number of used CPU cores in the TEE is 4, and the identity of the task to be executed by the 4-core CPU is task 2. The total number of CPU cores in node 2 is 16, of which the number of used CPU cores in the REE is 8, and the identity of the task to be executed by the 8-core CPU is task 2. The number of used CPU cores in the TEE is 8, and the identity of the task to be executed by the 8-core CPU is task 1. Table 1 is only to explain one form of the resource management information in the resource management node, and the embodiments of the present application do not specifically limit the resource management information.

[0138] Table 1

[0139] REE CPU TEE CPU Node 1 cores 4 (cores 16) task 1 cores 4 (cores 16) task 2 Node 2 cores 8 (cores 16) task 2 cores 8 (cores 16) task 1 Node 3 cores 2 (cores 16) task 1 cores 2 (cores 16) task 1

[0140] The resource management node allocates the computing nodes for executing the tasks according to the resource allocation request and the resource management information.

[0141] In S407, the resource management node sends a first instruction to each computing node, and the first instruction is used to indicate the identity of the task, the execution environment to which the computing resource allocated to the task belongs, and the number of computing resources of each execution environment to be allocated to the task.

[0142] The number of resources required by different tasks is different, and the task may run on one computing node or may run on multiple computing nodes. The resource management node can determine the computing node for running the task and the resource allocated to the task in each running environment of the computing node according to the number of resources required by the task and the usage of the computing resources in all computing nodes.

[0143] S408, when the execution environment in which the computing resources allocated to the task reside includes a TEE, the compute node runs a client application in the TEE and a trusted application in the TEE, so that the client application in the TEE sends a second instruction to the trusted application in the TEE, the second instruction including the number of computing resources allocated to the task, and the trusted application in the TEE sends the identity identifier of the computing resources used to execute the task to the client application in the TEE according to the number of computing resources allocated to the task.

[0144] In a Relay-based Application Environment (REE), client applications within a TEE can communicate with trusted applications within the TEE. The client application sends a second instruction to the trusted application within the TEE, requesting resources needed to execute a task. This second instruction can be viewed as a request for resources from the TEE. The second instruction carries the amount of computing resources allocated to the task. The trusted application in the TEE retrieves a CPU, thereby identifying the CPU. In this way, the task can be bound to that CPU. Figure 5 As shown, the NM in the REE deploys the TEE client application (TEE NM CA), and the TEE deploys the trusted application (NM TA). The TEE client application and the trusted application can communicate with each other to negotiate computing resources within the TEE. The NM in the REE can also communicate with the resource management node, sending information about the computing resources provided by the TEE to the resource management node, enabling the resource management node to uniformly manage and schedule resources in both the REE and TEE.

[0145] S409, the computing node sends information about the computing resources used to execute the task to the resource management node, wherein the information about the computing resources used to execute the task includes the identity identifier of the computing resources and the identity identifier of the task.

[0146] S410, the resource management node associates and stores the identity identifiers of computing resources and tasks in the resource management information.

[0147] Resource management information records the resource usage of different execution environments in each computing node. In this way, the resource management node can uniformly manage and schedule the resource usage of different execution environments in the computing node based on the resource management information.

[0148] In this embodiment of the application, the Yarn resource management system deploys TEE applications within the REE of the compute node, enabling communication with trusted applications within the TEE. Thus, the resource management node can request resources from the TEE through the REE, thereby allowing for unified management and scheduling of resources in both the REE and TEE of the compute node.

[0149] The resource management scheme provided by the embodiments of the present application can also be applied to a distributed system based on a k8s resource management mechanism, that is, an application program with a TEE deployed in the REE of a computing node, so as to be able to communicate with a trusted application program in the TEE. In this way, the resource management node can request resources in the TEE through the REE, so that the resource management node can uniformly manage and schedule the resources in the REE and the TEE in the computing node. For details, refer to the detailed description of the Yarn resource management system in Figure 4 .

[0150] Based on the distributed system shown in Figure 1 , the Yarn resource management system shown in Figure 2 , and the resource management method in the embodiments, the embodiments of the present application provide another resource management method. The resource management method is a summary of the resource management methods for distributed systems in various application scenarios, such as Figure 4 the resource management method in the scenario of the Yarn resource management mechanism in the embodiments. Figure 4

[0151] Figure 6 is a flowchart of a resource management method provided by the embodiments of the present application. The resource management method provided by the embodiments of the present application is executed by a resource management node in a distributed system shown in Figure 1 . As shown in Figure 6 , the resource management method provided by the embodiments of the present application includes S601 to S603.

[0152] S601, determine resource allocation information, the resource allocation information carrying an identity of a task, an execution environment of a computing resource allocated to the task, and a total quantity of the computing resource in each execution environment that needs to be allocated to the task, the task management node being a computing node for managing running of the task.

[0153] The resource allocation information refers to the quantity of the resource that needs to be allocated to the task, the running environment corresponding to the resource allocated to the task, and the like.

[0154] The computing resource and the running environment required by different tasks are different. The task can be executed in the TEE alone, the task can be executed in the REE alone, or the part of the task that needs to be encrypted is executed in the TEE, and the remaining part is executed in the REE.

[0155] In some embodiments, the resource allocation information is information sent by a computing node for managing the task to the resource management node.

[0156] ​The resource allocation information carries the identity of the task, the execution environment to which the computing resource allocated to the task belongs, and the total number of computing resources in each execution environment that need to be allocated to the task. As a possible implementation, the user can specify the number of resources required to run the task and the running environment to which the resources belong through the client when submitting the task. For example, the task is to calculate the area of a square, and the number of CPUs in the REE is 2 cores, and the number of CPUs in the TEE is 2 cores. As another possible implementation, the resource management node can specify the number of resources required to run the task and the running environment to which the resources belong according to the task. For details, see Figure 4 Embodiments of S401 to S406 are described above and will not be described in detail here.

[0157] S602, according to the identity of the task, the execution environment to which the computing resource allocated to the task belongs, the total number of computing resources in each execution environment that need to be allocated to the task, and the resource management information, determining at least one computing node for executing the task and the number of computing resources in each execution environment in each computing node that need to be allocated to the task.

[0158] The resource management information is used to indicate the total number of resources in all computing nodes and the usage of the resources, such as the total number of CPU cores in each computing node and the number of used CPU cores. The resource management information changes as the usage of the resources changes. For example, the information recorded in the resource management information is that the number of CPU cores in node 1 is 16 cores, of which the number of CPU cores used by the TEE is 4 cores, and is used to run task 1. When task 1 ends, the number of used CPU cores will be released, and the information recorded in the resource management information is that the number of CPU cores in node 1 is 16 cores. For details of the resource management information, see Figure 4 Embodiments of S406 are described above and will not be described in detail here.

[0159] S603, sending a first instruction to each computing node, the first instruction being used to indicate the identity of the task, the execution environment to which the computing resource allocated to the task belongs, and the number of computing resources in each execution environment that need to be allocated to the task, so that the computing node runs the client application of the TEE in the REE and the trusted application in the TEE in the case that the execution environment to which the computing resource allocated to the task belongs includes the TEE, so that the client application of the TEE sends a second instruction to the trusted application in the TEE, the second instruction including the number of computing resources allocated to the task, and the trusted application in the TEE sends the identity of the computing resource for executing the task to the client application of the TEE according to the number of computing resources allocated to the task.

[0160] The number of resources used by different tasks is different. The resource management node can allocate the computing node for running the task according to the resource required by the task and the resource management information. The task can be run on multiple computing nodes, or the task can be run on only one computing node. For details, see Figure 4 The detailed description of S407 to S408 in the embodiment.

[0161] According to the embodiment of the application, the resource management node sends an instruction to the REE in the computing node according to the resource required for running the task, so as to communicate with the TEE through the REE, and allocate the resource in the TEE, thereby completing the unified scheduling and management of the resources in the REE and the TEE.

[0162] Figure 7 is a flowchart of a resource allocation method provided by the embodiment of the application. The resource allocation method provided by the embodiment of the application can have Figure 2 The computing node in the embodiment performs. As shown in Figure 7 The resource allocation method provided by the embodiment of the application includes S701 to S702.

[0163] S701, receiving a first instruction sent by a resource management node, the first instruction being used for indicating an identity of a task, an execution environment of a computing resource allocated to the task, and a number of each execution environment required to be allocated to the task.

[0164] Different tasks have different requirements for the running environment. The encrypted task needs to be run in the TEE, so as to ensure the privacy of the task. The resource required for running the task is allocated by the resource management node. For details, see Figure 5 The detailed process in the embodiment. The resource management node will send an instruction to the computing node, so as to inform the computing node of the number of required resources and the execution environment of the required resources. The first instruction can be regarded as a request for applying for resources. The first instruction can be a string of characters. For example, Request-taskID-TEE cores x-REE cores y, which means that the task with the identity of taskID applies for x cores in the TEE and y cores in the REE.

[0165] S702, if the execution environment in which the computing resources allocated to the task reside includes a TEE, the client application of the TEE in the REE and the trusted application in the TEE are run, so that the client application of the TEE sends a second instruction to the trusted application in the TEE, the second instruction including the number of computing resources allocated to the task, and the trusted application in the TEE sends the identity identifier of the computing resources used to execute the task to the client application of the TEE according to the number of computing resources allocated to the task.

[0166] Since the resource management node cannot communicate directly with the TEE, when the execution environment of the task's computing resources includes the TEE, the compute node runs a client application of the TEE within the REE, thereby communicating with the trusted application within the TEE. The TEE client application sends a second instruction to the trusted application, requesting computing resources from the TEE. This second instruction can be viewed as a resource request, carrying the amount of computing resources that the TEE needs to allocate to the task.

[0167] In some embodiments, the second instruction also includes the task's identity identifier, which can be bound to the CPU's identity identifier and the task after the trusted application pulls the CPU.

[0168] For details on S702, please refer to [link / reference]. Figure 4 The detailed description of S408 in the embodiments will not be repeated here.

[0169] In some embodiments, after S702, the computing node can also send the identity identifier of the computing resource used to execute the task to the resource management node, thereby enabling the resource management node to associate the identity identifier of the computing resource with the identity identifier of the task and store it.

[0170] In some embodiments, a compute node can be viewed as a task management node for managing task execution. When a compute node acts as a task management node, it can start a task after requesting compute resources. Here, the compute node acts as a provider of compute resources; when it is able to provide compute resources to the task, it sends a notification to the task management node to indicate that the compute resource request was successful.

[0171] The task management node can send third-party instructions to the computing nodes that provide computing resources. These instructions carry the task's identity identifier. Based on the task's identity identifier, the computing nodes providing computing resources can then use the computing resources bound to the task to execute the task.

[0172] In some embodiments, the task management node, which manages the execution of tasks, needs to complete the following process before requesting computing resources for the tasks.

[0173] (1) receiving task information of a task. The task information includes a task to be executed, an execution environment where a computing resource allocated to the task is located, and a total number of computing resources to be allocated to the task in each execution environment.

[0174] (2) allocating a container for the task.

[0175] (3) registering the task with a resource management node.

[0176] The task management node sends a registration request to the resource management node, so as to determine an identity of the task. In this way, the resource management node can apply for resources for the task based on the identity of the task.

[0177] (4) initiating a resource application request to the resource management node.

[0178] The task management node sends resource allocation information to the resource management node. The resource allocation information indicates the identity of the task, an execution environment where a computing resource allocated to the task is located, and a total number of computing resources to be allocated to the task in each execution environment, so that the resource management node can allocate resources for the task based on the resource allocation information.

[0179] According to an embodiment of the present application, a client application of a TEE is deployed in a REE, so as to communicate with a trusted application in the TEE. In this way, the resource management node can communicate with the TEE through the REE, so as to complete unified management and scheduling of resources.

[0180] Figure 8 is a structural schematic diagram of a resource management device provided by an embodiment of the present application. The resource management device provided by the embodiment of the present application is applied to a resource management node in a distributed system, and the resource management node stores resource management information, which is used to indicate resource usage in all computing nodes in the distributed system. As shown in the figure, the resource management device provided by the embodiment of the present application includes a first determination module 801, a second determination module 802, and a sending module 803. Figure 8

[0181] The first determination module 801 is configured to determine resource allocation information, the resource allocation information carrying an identity of a task, an execution environment where a computing resource allocated to the task is located, and a total number of computing resources to be allocated to the task in each execution environment, the task management node being a computing node used to manage running of the task.

[0182] ​The second determining module 802 is configured to determine at least one computing node for executing the task and the number of computing resources required to be allocated to the task in each execution environment of each computing node in the at least one computing node according to the identity of the task, the execution environment where the computing resources allocated to the task is located, and the total number of computing resources required to be allocated to the task in each execution environment and the resource management information.

[0183] The sending module 803 is configured to send a first instruction to each computing node, where the first instruction is used to indicate the identity of the task, the execution environment where the computing resources allocated to the task is located, and the number of computing resources required to be allocated to the task in each execution environment, so that the computing node runs the client application of the TEE in the REE and the trusted application in the TEE in the case where the execution environment where the computing resources allocated to the task is located includes the TEE, so that the client application of the TEE sends a second instruction to the trusted application in the TEE, where the second instruction includes the number of computing resources allocated to the task, and the trusted application in the TEE sends the identity of the computing resource used for executing the task to the client application of the TEE according to the number of computing resources allocated to the task.

[0184] According to the embodiments of the present application, the client application of the TEE is deployed in the REE, so as to communicate with the trusted application in the TEE. In this way, the resource management node can communicate with the TEE through the REE, thereby completing the unified management and scheduling of resources.

[0185] In a possible implementation, the apparatus further includes:

[0186] The receiving module is configured to receive task information sent by a client, where the task information includes a task to be executed, an execution environment where computing resources allocated to the task is located, and a total number of computing resources required to be allocated to the task in each execution environment.

[0187] The sending module is further configured to send the task information to a task management node, so that the task management node stores the task and allocates a container for managing the running of the task.

[0188] In a possible implementation, the apparatus further includes:

[0189] The receiving module is configured to receive a registration request sent by a task management node, where the task management node is a computing node for managing the running of the task.

[0190] The sending module is further configured to send, in response to the registration request, an identity of the task to the task management node, so that the task management node stores the task in association with the identity of the task.

[0191] In a possible implementation, the apparatus further includes:

[0192] The third determining module is configured to determine an identity of a computing resource used to execute the task.

[0193] The storing module is configured to store the identity of the computing resource used to execute the task in association with the identity of the task in resource management information.

[0194] Figure 9 FIG. 1 is a structural schematic diagram of a resource allocation apparatus provided by an embodiment of the present application. The resource allocation apparatus provided by the embodiment of the present application is applied to a computing node in a distributed system, and the computing node runs a development execution environment (REE) and a trusted execution environment (TEE). A client application program of the TEE runs in the REE, a trusted application program runs in the TEE, and the client application program and the trusted application program communicate through an interface. Figure 9 As shown in FIG. 1, the resource allocation apparatus provided by the embodiment of the present application includes a receiving module 901 and a running module 902.

[0195] The receiving module 901 is configured to receive a first instruction sent by a resource management node, where the first instruction is used to indicate an identity of a task, an execution environment in which a computing resource allocated to the task is located, and a quantity of the computing resource of each execution environment that needs to be allocated to the task.

[0196] The running module 902 is configured to, in a case where the execution environment in which the computing resource allocated to the task is located includes the TEE, run the client application program of the TEE in the REE and the trusted application program in the TEE, so that the client application program of the TEE sends a second instruction to the trusted application program in the TEE, where the second instruction includes the quantity of the computing resource allocated to the task, and the trusted application program in the TEE sends, to the client application program of the TEE, an identity of the computing resource used to execute the task according to the quantity of the computing resource allocated to the task.

[0197] According to the embodiment of the present application, the client application program of the TEE is deployed in the REE, so as to communicate with the trusted application program in the TEE. In this way, the resource management node can communicate with the TEE through the REE, thereby completing unified management and scheduling of resources.

[0198] In a possible implementation, the second instruction further includes an identity of the task, so as for the trusted application in the TEE to bind the task with the computing resource for executing the task.

[0199] In a possible implementation, the receiving module is further configured to receive a third instruction for starting the task, the third instruction including an identity of the task, the third instruction being an instruction generated in a case where the allocation of the computing resource for the task is completed;

[0200] The determining module is configured to determine, according to the identity of the task, the computing resource to which the task is bound.

[0201] The executing module is configured to execute the task by using the computing resource.

[0202] In a possible implementation, in a case where the computing node is a task management node for managing task running, the apparatus further includes:

[0203] The determining module is configured to determine a third instruction for starting the task, the third instruction including an identity of the task, the third instruction being an instruction generated in a case where the allocation of the computing resource for the task is completed;

[0204] The determining module is further configured to determine, according to the identity of the task, the computing resource to which the task is bound.

[0205] The executing module is configured to execute the task by using the computing resource.

[0206] In a possible implementation, the apparatus further includes:

[0207] The receiving module is configured to receive task information sent by the resource management node, the task information including a task that needs to be executed, an execution environment in which a computing resource allocated to the task is located, and a total number of computing resources that need to be allocated to the task in each execution environment.

[0208] The storage module is configured to store the task.

[0209] In a possible implementation, the apparatus further includes:

[0210] The sending module is configured to send, to the resource management node, a registration request for requesting the identity of the task from the resource management node.

[0211] The receiving module is configured to receive the identity sent by the resource management node.

[0212] The storage module is configured to store the task in association with the identity of the task.

[0213] In a possible implementation, the apparatus further includes:

[0214] The sending module is configured to send, to the resource management node, resource allocation information carrying an identity of a task, an execution environment to which computing resources allocated to the task belong, and a total number of computing resources required to be allocated to the task in each execution environment.

[0215] In a possible implementation, the apparatus further includes:

[0216] The sending module is configured to send, to the resource management node, an identity of a computing resource used to execute the task, so that the resource management node stores the identity of the computing resource used to execute the task in association with the identity of the task in the resource management information.

[0217] Figure 10 is a structural schematic diagram of a computing device provided by an embodiment of the present application.

[0218] As shown in Figure 10 The computing device 1000 includes a processor 1001, a memory 1002, and a network interface 1003. The computing device can serve as one computing node, or as multiple computing nodes. Alternatively, multiple computing devices are clustered as one or more computing nodes.

[0219] The processor 1001 can be a central processing unit (CPU), and can also be another general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic, a discrete hardware component, or the like. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor.

[0220] The non-volatile memory can be a read-only memory (ROM), a programmable ROM (PROM), an erasable PROM (EPROM), an electrically EPROM (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM) used as an external cache. By way of example, and not limitation, many forms of RAM can be used, such as a static RAM (SRAM), a dynamic RAM (DRAM), a synchronous dynamic RAM (SDRAM), a double data rate SDRAM (DDR SDRAM), an enhanced SDRAM (ESDRAM), a synchlink DRAM (SLDRAM), and a direct rambus RAM (DR RAM).

[0221] For example, the memory 1002 can store computer programs, and the processor 1001 executes the computer programs to implement the steps in the method embodiments of performing the multiparty multiplication calculation.

[0222] The network interface 1003 is configured to transceive data, for example, sending the data processed by the processor 1001 to other computing devices, or receiving the data sent by other computing devices, etc.

[0223] Of course, in order to simplify, Figure 10 Only some of the components in the computing device 1000 related to the present application are shown in FIG. 10, and the components such as buses, input / output interfaces, etc. are omitted. In addition, according to specific application conditions, the computing device 1000 can also include any other appropriate components. In addition, the computing device can be a desktop computer, a notebook computer, a palm computer, a cloud server, and the like. Those skilled in the art can understand that Figure 10The example of the computing device 1000 is merely illustrative and does not limit the computing device, which can include more or fewer components, or combine some components, or have different components, for example, the computing device can also include input devices, output devices, network access devices, buses, etc. For example, the input device can be a microphone array, and can also include, for example, a keyboard, a mouse, and the like. For example, the output device can output various information to the outside, and can include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto, and the like.

[0224] In addition to the above method, device and computing device, the embodiments of the present application can also provide a computer program product comprising computer program instructions, which, when executed by a processor, cause the processor to perform the steps of the methods of various embodiments of the present application described in the above "Method" section of the present specification. Wherein the computer program product can be written in any combination of one or more programming languages for executing the operations of the embodiments of the present application, the programming languages include object-oriented programming languages such as Java, C++, and the like, and conventional procedural programming languages such as "C" language or similar programming languages. Wherein the computer program code can be in the form of source code, object code, executable file or some intermediate form, etc. The computer program code can be executed entirely on a user computing device, partially on a user device, as an independent software package, partially on a user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0225] Furthermore, the embodiments of the present application can also provide a computer readable storage medium, having stored thereon computer program instructions, which, when executed by a processor, cause the processor to perform the steps of the display control method according to various embodiments of the present application described in the above "Method" section of the specification. The computer readable storage medium can take any combination of one or more of the following readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium may, for example, include but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or apparatus, or any suitable combination of the above. More specific examples (a non-exhaustive list) of the readable storage medium include an electrical connection having one or more wires, a portable disc, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. It should be noted that the computer readable medium contained in the present application can be appropriately added or reduced according to the requirements of legislation and patent practice in the jurisdiction, for example, in some jurisdictions, according to legislation and patent practice, the computer readable medium does not include electrical carrier signals and telecommunication signals.

[0226] The method steps in the embodiments of the present application can be realized by means of hardware or by means of a processor executing software instructions. The software instructions can be composed of corresponding software modules, which can be stored in a random access memory (RAM), a flash memory, a read-only memory (ROM), a programmable read-only memory (PROM), an erasable PROM (EPROM), an electrically EPROM (EEPROM), a register, a hard disk, a mobile hard disk, a CD-ROM, or any other form of storage medium well known in the art. An exemplary storage medium is coupled to the processor, such that the processor can read information from, and write information to, the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an ASIC.

[0227] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in or transmitted by a computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through a wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) manner. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available media can be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)) and the like.

[0228] In the above embodiments, the description of each embodiment has its own focus, and the parts not described or recorded in detail in a certain embodiment can be referred to the related description of other embodiments.

[0229] It should be understood that the size of the serial number of each step in the above embodiments does not mean the order of execution, and the execution order of each process should be determined by its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0230] The basic principles of the present application are described above in combination with specific embodiments, but it should be pointed out that the advantages, advantages, effects and the like mentioned in the present application are only examples and not limitations, and these advantages, advantages, effects and the like cannot be considered as the must-have of each embodiment of the present application. In addition, the above disclosed specific details are only for the purpose of example and understanding, and are not limited to the above specific details. The above specific details do not limit the present application to be necessarily implemented with the above specific details.

Claims

1. A resource management method characterized by, A resource management node applied to a distributed system, the resource management node storing resource management information, the resource management information being used to indicate resource usage of all computing nodes in the distributed system, the method comprising: determining resource allocation information, the resource allocation information carrying an identity of a task, an execution environment where computing resources allocated to the task are located, and a total number of computing resources needed to be allocated to the task in each execution environment, the task management node being a computing node used to manage the task running; determining at least one computing node used to execute the task and a number of computing resources needed to be allocated to the task in each execution environment in each computing node of the at least one computing node according to the identity of the task, the execution environment where the computing resources allocated to the task are located, the total number of computing resources needed to be allocated to the task in each execution environment, and the resource management information; sending a first instruction to each computing node, the first instruction being used to indicate the identity of the task, the execution environment where the computing resources allocated to the task are located, and the number of computing resources needed to be allocated to the task in each execution environment, so that the computing node runs a client application of a TEE in a REE and a trusted application in the TEE in a case where the execution environment where the computing resources allocated to the task are located comprises the TEE, the client application of the TEE sends a second instruction to the trusted application in the TEE, the second instruction comprising the number of computing resources allocated to the task, and the trusted application in the TEE sends an identity of a computing resource used to execute the task to the client application of the TEE according to the number of computing resources allocated to the task.

2. The method of claim 1, wherein, The method further comprises: receiving task information sent by a client, the task information comprising a task needed to be executed, an execution environment where computing resources allocated to the task are located, and a total number of computing resources needed to be allocated to the task in each execution environment; sending the task information to a task management node for the task management node to store the task and allocate a container used to manage the task running to the task.

3. The method of claim 1, wherein, The method further comprises: receiving a registration request sent by a task management node, the task management node being a computing node used to manage the task running; in response to the registration request, sending an identity to the task management node for the task management node to store the task in association with the identity of the task.

4. The method according to any one of claims 1 to 3, characterized in that, The method further comprises: determining an identity of a computing resource used to execute the task; storing the identity of the computing resource used to execute the task in association with the identity of the task in the resource management information.

5. A resource allocation method characterized by, A computing node applied to a distributed system, the computing node running a development execution environment (REE) and a trusted execution environment (TEE), a client application of the TEE running in the REE, a trusted application running in the TEE, the client application and the trusted application communicating through an interface, the method comprising: receiving a first instruction sent by the resource management node, the first instruction being used to indicate an identity of a task, an execution environment where a computing resource allocated to the task is located, and a quantity of the computing resource in each execution environment that needs to be allocated to the task; in a case where the execution environment where the computing resource allocated to the task is located comprises a TEE, running a client application of the TEE in the REE and a trusted application in the TEE, so that the client application of the TEE sends a second instruction to the trusted application in the TEE, the second instruction comprising the quantity of the computing resource allocated to the task, and the trusted application in the TEE sends an identity of the computing resource used to execute the task to the client application of the TEE according to the quantity of the computing resource allocated to the task.

6. The method of claim 5, wherein, The second instruction further comprises the identity of the task, so as to be used by the trusted application in the TEE to bind the task with the computing resource used to execute the task.

7. The method of claim 5, wherein, The method further comprises: receiving a third instruction for starting a task, the third instruction comprising an identity of the task, the third instruction being an instruction generated in a case where allocation of a computing resource of the task is completed; determining the computing resource bound by the task according to the identity of the task; executing the task by using the computing resource.

8. The method of claim 5, wherein, In a case where the computing node is a task management node used to manage running of a task, the method further comprises: determining a third instruction for starting a task, the third instruction comprising an identity of the task, the third instruction being an instruction generated in a case where allocation of a computing resource of the task is completed; determining the computing resource bound by the task according to the identity of the task; executing the task by using the computing resource.

9. The method of claim 8, wherein, The method further comprises: receiving task information sent by the resource management node, the task information comprising a task that needs to be executed, an execution environment where a computing resource allocated to the task is located, and a total quantity of the computing resource in each execution environment that needs to be allocated to the task; storing the task.

10. The method of claim 8, wherein, The method further comprises: sending a registration request to the resource management node, so as to request the identity of the task from the resource management node; receiving the identity sent by the resource management node; storing the task in association with the identity of the task.

11. The method of claim 8, wherein, The method further comprises: sending resource allocation information to the resource management node, the resource allocation information carrying the identity of the task, the execution environment where the computing resource allocated to the task is located, and the total quantity of the computing resource in each execution environment that needs to be allocated to the task.

12. The method according to any one of claims 5-11, characterized in that, The method further comprises: sending the identity of the computing resource used to execute the task to the resource management node, so that the resource management node stores the identity of the computing resource used to execute the task in association with the identity of the task in resource management information.

13. A resource management apparatus characterized by comprising: A resource management node applied to a distributed system, the resource management node storing resource management information, the resource management information being used to indicate resource usage of all computing nodes in the distributed system, the apparatus comprising: A first determining module configured to determine resource allocation information, the resource allocation information carrying an identity of a task, an execution environment where computing resources allocated to the task are located, and a total number of computing resources of each execution environment that need to be allocated to the task, the task management node being used to manage computing nodes where the task runs; A second determining module configured to determine at least one computing node used to execute the task and a number of computing resources of each execution environment in each computing node of the at least one computing node that need to be allocated to the task according to the identity of the task, the execution environment where the computing resources allocated to the task are located, the total number of computing resources of each execution environment that need to be allocated to the task, and the resource management information; A sending module configured to send a first instruction to each computing node, the first instruction being used to indicate the identity of the task, the execution environment where the computing resources allocated to the task are located, and the number of computing resources of each execution environment that need to be allocated to the task, so that, in a case where the execution environment where the computing resources allocated to the task are located includes a trusted execution environment (TEE), a client application of the TEE in a rich execution environment (REE) and a trusted application in the TEE are run, the client application of the TEE sends a second instruction to the trusted application in the TEE, the second instruction including the number of computing resources allocated to the task, and the trusted application in the TEE sends an identity of a computing resource used to execute the task to the client application of the TEE according to the number of computing resources allocated to the task.

14. A resource allocation apparatus, characterized by comprising: A computing node applied to a distributed system, the computing node running a rich execution environment (REE) and a trusted execution environment (TEE), a client application of the TEE running in the REE, a trusted application running in the TEE, the client application and the trusted application communicating through an interface, the apparatus comprising: A receiving module configured to receive a first instruction sent by a resource management node, the first instruction being used to indicate an identity of a task, an execution environment where computing resources allocated to the task are located, and a number of computing resources of each execution environment that need to be allocated to the task; A running module configured to, in a case where the execution environment where the computing resources allocated to the task are located includes a TEE, run a client application of the TEE in a REE and a trusted application in the TEE, so that the client application of the TEE sends a second instruction to the trusted application in the TEE, the second instruction including the number of computing resources allocated to the task, and the trusted application in the TEE sends an identity of a computing resource used to execute the task to the client application of the TEE according to the number of computing resources allocated to the task.

15. A resource management system, characterized by Comprising: a resource management node configured to perform the method of any of claims 1-4; a compute node configured to perform the method of any of claims 5-12.

16. A computing device, comprising: comprising: at least one memory configured to store a program; at least one processor configured to execute the program stored in the memory, the processor being configured to perform the method of any of claims 1-4, or to perform the method of any of claims 5-12, when the program stored in the memory is executed.

17. A computer storage medium having stored therein instructions, which when executed on a computer, cause the computer to perform the method of any of claims 1-4, or to perform the method of any of claims 5-12.

18. A computer program product comprising instructions which, when executed on a computer, cause the computer to perform the method of any of claims 1-4, or to perform the method of any of claims 5-12.

Images