Method, apparatus, electronic device, storage medium and computer program for application migration

Abstract

The present disclosure discloses a method and device for application migration, electronic equipment, storage medium and computer program, relates to the technical field of data processing, and realizes double isolation of the trusted execution environment by introducing a random symbiotic trusted execution environment mechanism, thereby protecting the security of the application program instance and increasing the difficulty of external attacks. Meanwhile, a P2P consensus network is introduced as part of the management node, which is used for managing and maintaining the state and consistency of the entire system. By adopting a random selection and redundancy mechanism to select multiple alternative migration nodes, and based on a neural network of an attention mechanism to generate an optimal migration scheme, the migration efficiency and security can be effectively improved, the attack target of the attacker is confused, and the overall security of the system is increased. Finally, by chaining the entire migration process, it is ensured that the data in the data processing process cannot be persistently stored, thereby guaranteeing the security, privacy and traceability of the migration process.

Description

Technical Field

[0001] This disclosure relates to the field of data processing technology, and in particular to an application migration method, apparatus, electronic device, storage medium, and computer program. Background Technology

[0002] In today's computing landscape, especially with the rise of cloud computing and big data applications, data isolation and security have become critical considerations. In demanding business scenarios such as financial services, bioinformatics, and intellectual property-intensive industries, extremely high requirements are placed on the security and privacy protection of data processing. These scenarios typically involve the processing of sensitive data, such as personally identifiable information, medical records, and financial transaction data. To ensure the security and compliance of this data, processing must be conducted within a Trusted Execution Environment (TEE) to guarantee that data is not leaked or tampered with during processing and transmission.

[0003] Trusted Execution Environment (TEE) provides a secure, isolated zone, isolating sensitive data computation and processing from untrusted environments, thereby reducing the risk of data breaches and security threats. TEE technology offers unique advantages in protecting data security and privacy, and is therefore widely used in various computing environments.

[0004] However, with the continuous changes in business needs and computing environments, some business processes may require dynamically migrating applications to another host during execution, such as for load balancing or system maintenance. Additionally, under certain special business requirements, applications need to migrate to another node in the intermediate stage of execution to utilize the resources of a specific host for computation. During this process, it is crucial to ensure that computation occurs only within a controlled TEE environment, while preventing potential security threats such as man-in-the-middle attacks and side-channel attacks during migration. In these situations, designing an effective dynamic trusted application migration method that guarantees data isolation while achieving trusted and efficient application migration becomes a pressing issue. Summary of the Invention

[0005] This disclosure provides a method, apparatus, electronic device, storage medium, and computer program for application migration, with the primary objective of achieving reliable and efficient migration of applications.

[0006] According to a first aspect of this disclosure, a method for application migration is provided, comprising:

[0007] The target symbiotic trusted execution environment node where the target application to be migrated resides is determined. The target symbiotic trusted execution environment node includes a target management node and a target execution node. The target execution node is used to execute the target application, and the target management node is used to manage the migration of the target application.

[0008] The target migration node is determined based on the target management node. The target migration node is connected to the target symbiotic trusted execution environment node based on a consensus network. The consensus network is a blockchain-based network. The target migration node is a symbiotic trusted execution environment node. The target management node is used to receive the target application.

[0009] The target migration node and the target symbiotic trusted execution environment node perform key negotiation and create a secure channel between the target migration node and the target symbiotic trusted execution environment node;

[0010] The encrypted ciphertext corresponding to the target application is loaded into the target migration node based on the secure channel;

[0011] The encrypted ciphertext is decrypted based on the management node in the target migration node to obtain the decryption result, and the integrity of the decryption result is verified.

[0012] If the decryption result is confirmed to be complete and error-free, an execution node identical to the target execution node is created on the target migration node based on the trusted execution environment information included in the decryption result. The trusted execution environment information is the environment information in which the target program runs on the target execution node.

[0013] The target application is run on the execution node based on the execution status information of the target application on the target execution node included in the decryption result.

[0014] Optionally, determining the target symbiotic trusted execution environment node where the target application to be migrated resides includes:

[0015] Determine the resources and configuration information of the trusted execution environment required to run the application, including the platform, hardware and dependencies, as well as the application and data running in the trusted execution environment;

[0016] A symbiotic trusted execution environment node is created based on the resource and configuration information, and the symbiotic trusted execution environment node runs the application.

[0017] If it is determined that the application needs to be migrated, the application is identified as the target application and the symbiotic trusted execution environment node is identified as the target symbiotic trusted execution environment node.

[0018] Optionally, determining the target migration node based on the target management node includes:

[0019] Based on the target management node, the status information of all migration nodes on the consensus network is collected. The status information includes status and resource status. All migration nodes are symbiotic trusted execution environment nodes.

[0020] The attention-based neural network model determines the target migration node based on the state information. The target migration node is a first preset number of symbiotic trusted execution environment nodes. The first preset number of symbiotic trusted execution environment nodes are used to receive the target application. In addition, a second preset number of symbiotic trusted execution environment nodes connected to the consensus network are used to disguise themselves as receiving the target application.

[0021] Optionally, before the attention-based neural network model determines the target migration node based on the state information, the method includes:

[0022] Based on the target management node, a migration task is created according to the status information and migration requirements;

[0023] The migration task information is uploaded to the blockchain and broadcast to all migration nodes on the consensus network, so that each migration node can perform corresponding operations based on the migration task information.

[0024] Based on the target management node, the execution status information and trusted execution environment information of the target application on the target execution node are collected;

[0025] The execution status information and the trusted execution environment information are encrypted to obtain the encrypted ciphertext.

[0026] Optionally, after the attention-based neural network model determines the target migration node based on the state information, the method includes:

[0027] The target application is received by the first preset number of symbiotic trusted execution environment nodes corresponding to the target migration node;

[0028] The target application is executed on the first preset number of symbiotic trusted execution environment nodes respectively, and the execution results of each of the first preset number of symbiotic trusted execution environment nodes are obtained;

[0029] The detection results are obtained by detecting whether there are any anomalies in the process of the second preset number of symbiotic trusted execution environment nodes masquerading as receiving the target application.

[0030] The accuracy and reliability of the execution results are determined based on the execution results and the detection results.

[0031] Optionally, the method includes:

[0032] The target status information of the target application migration process is monitored based on a preset monitoring program.

[0033] The neural network model is trained and updated based on the target state information. According to a second aspect of this disclosure, an apparatus for application transfer is provided, comprising:

[0034] The first determining unit is used to determine the target co-existing trusted execution environment node where the target application to be migrated is located. The target co-existing trusted execution environment node includes a target management node and a target execution node, wherein the target execution node is used to execute the target application, and the target management node is used to manage the migration of the target application.

[0035] The second determining unit is used to determine a target migration node based on the target management node. The target migration node is connected to the target symbiotic trusted execution environment node based on a consensus network. The consensus network is a network built on blockchain. The target migration node is a symbiotic trusted execution environment node. The target management node is used to receive the target application.

[0036] The first creation unit is used to perform key negotiation between the target migration node and the target symbiotic trusted execution environment node, and to create a secure channel between the target migration node and the target symbiotic trusted execution environment node;

[0037] The loading unit is used to load the encrypted ciphertext corresponding to the target application into the target migration node based on the secure channel;

[0038] The decryption unit is used to decrypt the encrypted ciphertext based on the management node in the target migration node, obtain the decryption result, and perform integrity verification on the decryption result;

[0039] The second creation unit is used to create an execution node identical to the target execution node on the target migration node based on the trusted execution environment information included in the decryption result, provided that the decryption result is complete and error-free. The trusted execution environment information is the environment information in which the target program runs on the target execution node.

[0040] The execution unit is configured to run the target application on the execution node based on the execution status information of the target application on the target execution node included in the decryption result.

[0041] Optionally, the first determining unit includes:

[0042] The first determining module is used to determine the resources and configuration information of the trusted execution environment required to run the application. The resources and configuration information include the platform, hardware and dependencies, as well as the application and data running in the trusted execution environment.

[0043] A creation module is used to create a symbiotic trusted execution environment node based on the resource and configuration information, wherein the symbiotic trusted execution environment node runs the application;

[0044] The second determining module is used to determine, when it is determined that the application needs to be migrated, the application as the target application and the symbiotic trusted execution environment node as the target symbiotic trusted execution environment node.

[0045] Optionally, the second determining unit includes:

[0046] The acquisition module is used to acquire the status information of all migration nodes on the consensus network based on the target management node. The status information includes status and resource status, and all migration nodes are symbiotic trusted execution environment nodes.

[0047] The determination module is used by a neural network model based on an attention mechanism to determine the target migration node according to the state information. The target migration node is a first preset number of symbiotic trusted execution environment nodes. The first preset number of symbiotic trusted execution environment nodes are used to receive the target application. In addition, a second preset number of symbiotic trusted execution environment nodes connected to the consensus network are used to impersonate and receive the target application.

[0048] Optionally, the device is also used for:

[0049] Based on the target management node, a migration task is created according to the status information and migration requirements;

[0050] The migration task information is uploaded to the blockchain and broadcast to all migration nodes on the consensus network, so that each migration node can perform corresponding operations based on the migration task information.

[0051] Based on the target management node, the execution status information and trusted execution environment information of the target application on the target execution node are collected;

[0052] The execution status information and the trusted execution environment information are encrypted to obtain the encrypted ciphertext.

[0053] Optionally, the device is also used for:

[0054] The target application is received by the first preset number of symbiotic trusted execution environment nodes corresponding to the target migration node;

[0055] The target application is executed on the first preset number of symbiotic trusted execution environment nodes respectively, and the execution results of each of the first preset number of symbiotic trusted execution environment nodes are obtained;

[0056] The detection results are obtained by detecting whether there are any anomalies in the process of the second preset number of symbiotic trusted execution environment nodes masquerading as receiving the target application.

[0057] The accuracy and reliability of the execution results are determined based on the execution results and the detection results.

[0058] Optionally, the device is also used for:

[0059] The target status information of the target application migration process is monitored based on a preset monitoring program.

[0060] The neural network model is trained and updated based on the target state information.

[0061] According to a third aspect of this disclosure, an electronic device is provided, comprising:

[0062] At least one processor; and

[0063] A memory communicatively connected to the at least one processor; wherein,

[0064] The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method described in the first aspect above.

[0065] According to a fourth aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions, wherein the computer instructions are configured to cause the computer to perform the method described in the first aspect above.

[0066] According to a fifth aspect of this disclosure, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the method described in the first aspect above.

[0067] The application migration method disclosed herein utilizes a migration method, apparatus, electronic device, storage medium, and computer program to determine a target symbiotic trusted execution environment node where the target application to be migrated resides. The target symbiotic trusted execution environment node includes a target management node and a target execution node. The target execution node is used to execute the target application, and the target management node is used to manage the migration of the target application. Based on the target management node, a target migration node is determined. The target migration node connects to the target symbiotic trusted execution environment node via a consensus network, which is a blockchain-based network. The target migration node is a symbiotic trusted execution environment node, and the target management node is used to receive the target application. The target migration node and the target symbiotic trusted execution environment node are then connected. The process involves key negotiation between the target migration node and the target symbiotic trusted execution environment node, creating a secure channel. Based on this secure channel, the encrypted ciphertext corresponding to the target application is loaded into the target migration node. The encrypted ciphertext is decrypted by a management node within the target migration node, and the decryption result is verified for integrity. If the decryption result is confirmed to be complete and error-free, an execution node identical to the target execution node is created on the target migration node based on the trusted execution environment information included in the decryption result. This trusted execution environment information refers to the environment in which the target program runs on the target execution node. Finally, the target application is run on the execution node based on the execution status information of the target application on the target execution node, as included in the decryption result. Compared to related technologies, this approach achieves dual isolation of the trusted execution environment by designing a random symbiotic trusted execution environment, protecting application security. The introduction of a P2P consensus network management node avoids single points of failure, increases node mutual trust, and ensures that data during the migration process is not persistently stored, guaranteeing data security, privacy, and traceability of the migration process. This results in a trusted and efficient migration of the application. Attached Figure Description

[0068] The accompanying drawings, which form part of this specification, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings:

[0069] Figure 1 This is a schematic flowchart of an application migration method provided in an embodiment of the present disclosure;

[0070] Figure 2 This is a schematic diagram of a trusted application migration node network architecture provided in this embodiment;

[0071] Figure 3A schematic diagram of the structure of an application migration device provided in an embodiment of this disclosure;

[0072] Figure 4 A schematic diagram of the structure of another application migration device provided in an embodiment of this disclosure;

[0073] Figure 5 A schematic block diagram of an example electronic device 300 provided for embodiments of this disclosure. Detailed Implementation

[0074] The present invention will now be described in detail with reference to the accompanying drawings and embodiments. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other.

[0075] The following detailed description is exemplary and intended to provide further detailed explanation of the invention. Unless otherwise specified, all technical terms used in this invention have the same meaning as commonly understood by one of ordinary skill in the art. The terminology used in this invention is for describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention.

[0076] Furthermore, the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein.

[0077] The following description, with reference to the accompanying drawings, outlines an application migration method, apparatus, electronic device, storage medium, and computer program according to embodiments of the present disclosure.

[0078] To at least achieve reliable and efficient application migration, this embodiment provides a method for application migration.

[0079] Figure 1 This is a schematic flowchart illustrating an application migration method provided in an embodiment of this disclosure. Figure 1 As shown, the method includes the following steps:

[0080] Step 101: Determine the target symbiotic trusted execution environment node where the target application to be migrated resides. The target symbiotic trusted execution environment node includes a target management node and a target execution node. The target execution node is used to execute the target application, and the target management node is used to manage the migration of the target application.

[0081] Step 102: Determine the target migration node based on the target management node. The target migration node is connected to the target symbiotic trusted execution environment node based on a consensus network. The consensus network is a blockchain-based network. The target migration node is a symbiotic trusted execution environment node. The target management node is used to receive the target application.

[0082] Step 103: Perform key negotiation between the target migration node and the target symbiotic trusted execution environment node, and create a secure channel between the target migration node and the target symbiotic trusted execution environment node;

[0083] Step 104: Load the encrypted ciphertext corresponding to the target application into the target migration node based on the secure channel;

[0084] Step 105: Decrypt the encrypted ciphertext based on the management node in the target migration node to obtain the decryption result, and perform integrity verification on the decryption result;

[0085] Step 106: If the decryption result is confirmed to be complete and error-free, create an execution node identical to the target execution node on the target migration node based on the trusted execution environment information included in the decryption result. The trusted execution environment information is the environment information in which the target program runs on the target execution node.

[0086] Step 107: Run the target application on the execution node according to the execution status information of the target application on the target execution node included in the decryption result.

[0087] The application migration method disclosed herein determines the target symbiotic trusted execution environment node where the target application to be migrated resides. The target symbiotic trusted execution environment node includes a target management node and a target execution node. The target execution node is used to execute the target application, and the target management node is used to manage the migration of the target application. Based on the target management node, a target migration node is determined. The target migration node connects to the target symbiotic trusted execution environment node via a consensus network, which is a blockchain-based network. The target migration node is a symbiotic trusted execution environment node, and the target management node is used to receive the target application. Key negotiation is performed between the target migration node and the target symbiotic trusted execution environment node, and a key is created. A secure channel is established between the target migration node and the target co-existing trusted execution environment node. Based on this secure channel, encrypted ciphertext corresponding to the target application is loaded into the target migration node. The encrypted ciphertext is decrypted by a management node within the target migration node to obtain a decryption result, and the integrity of the decryption result is verified. If the decryption result is confirmed to be complete and error-free, an execution node identical to the target execution node is created on the target migration node based on the trusted execution environment information included in the decryption result. The trusted execution environment information refers to the environment in which the target program runs on the target execution node. The target application is then run on the execution node based on the execution status information of the target application on the target execution node included in the decryption result. Compared to related technologies, this approach achieves dual isolation of the trusted execution environment by designing a random co-existing trusted execution environment, protecting application security. The introduction of a P2P consensus network management node avoids single points of failure, increases node mutual trust, and ensures that data during the migration process is not persistently stored, guaranteeing data security, privacy, and traceability of the migration process, thereby achieving trusted and efficient application migration.

[0088] As a refinement of the embodiments of this disclosure, when performing step 101 to determine the target symbiotic trusted execution environment node where the target application to be migrated resides, the following implementation methods may also be adopted, but are not limited to: determining the resources and configuration information of the trusted execution environment required to run the application, wherein the resources and configuration information include the platform, hardware and dependencies, as well as the application and data running in the trusted execution environment; creating a symbiotic trusted execution environment node based on the resources and configuration information, wherein the symbiotic trusted execution environment node runs the application; and, if it is determined that the application needs to be migrated, determining the application as the target application and determining the symbiotic trusted execution environment node as the target symbiotic trusted execution environment node.

[0089] As a refinement of the above embodiments, when performing step 102 of determining the target migration node based on the target management node, the following implementation methods may also be adopted, but are not limited to: collecting the status information of all migration nodes on the consensus network based on the target management node, the status information including status and resource status, the all migration nodes being symbiotic trusted execution environment nodes; determining the target migration node based on the attention mechanism neural network model according to the status information, the target migration node being a first preset number of symbiotic trusted execution environment nodes, the first preset number of symbiotic trusted execution environment nodes being used to receive the target application, and in addition, a second preset number of symbiotic trusted execution environment nodes connected to the consensus network being used to disguise receiving the target application.

[0090] In some embodiments, the target migration node can also be determined based on a random selection mechanism.

[0091] As a refinement of the above embodiments, before the attention-based neural network model determines the target migration node based on the state information, the method may also adopt, but is not limited to, the following implementation methods, for example: creating a migration task based on the state information and migration requirements by the target management node; uploading the information of the migration task to the blockchain and broadcasting it to all migration nodes on the consensus network, so that each migration node performs corresponding operations based on the information of the migration task; collecting the execution state information and the trusted execution environment information of the target application on the target execution node by the target management node; encrypting the execution state information and the trusted execution environment information to obtain the encrypted ciphertext.

[0092] As a refinement of the above embodiments, after the attention-based neural network model determines the target migration node based on the state information, the method may also adopt, but is not limited to, the following implementation methods: receiving the target application based on the first preset number of symbiotic trusted execution environment nodes corresponding to the target migration node; executing the target application based on the first preset number of symbiotic trusted execution environment nodes to obtain the execution results of the first preset number of symbiotic trusted execution environment nodes respectively; detecting whether there is an anomaly in the process of the second preset number of symbiotic trusted execution environment nodes pretending to receive the target application, and obtaining the detection results; determining the accuracy and reliability of the execution results based on the execution results and the detection results.

[0093] In some embodiments, the target state information of the target application migration process can be monitored based on a preset monitoring program; and the neural network model can be trained and updated based on the target state information.

[0094] Figure 2 This is a schematic diagram of a trusted application migration node network architecture provided in this embodiment. To facilitate understanding of the above process, this embodiment combines... Figure 2 An exemplary description is provided, including: Based on the actual needs of dynamic trusted application migration (i.e., application migration), a randomized co-existing trusted execution environment mechanism is introduced to create co-existing trusted execution environment nodes, and a P2P consensus network is formed based on blockchain infrastructure for the overall environment migration of the trusted application; a deep learning model with an attention mechanism neural network as its core is designed, integrating various factors affecting migration efficiency, and combining migration strategies such as random selection of migration nodes and node redundancy to form an optimal migration scheme; a dynamic key is used to establish a peer-to-peer encrypted channel in the P2P consensus network and achieve remote authentication to complete secure migration in encrypted mode. Furthermore, the entire migration process is recorded on the blockchain, and the execution status is collected in real time through a resident program to form a supervision and evaluation mechanism, supporting process traceability and improving migration security.

[0095] The P2P consensus network described is a decentralized network structure. As part of the blockchain infrastructure, it manages and maintains the state and consistency of the entire system. Through the P2P consensus network, symbiotic trusted execution environments can communicate and collaborate, utilizing the blockchain infrastructure to support migration solutions for blockchain-related businesses, including on-chain services during migration and post-migration traceability. The symbiotic trusted execution environment node is abbreviated as a symbiotic TEE node. A symbiotic TEE node is composed of multiple TEE trusted execution environments, including execution nodes and management nodes. Creating a symbiotic TEE node generates multiple random trusted execution environments, with one management node dedicated to management and external interaction, and the other execution nodes executing business applications, achieving dual isolation of the trusted execution environments. The execution node is a TEE trusted execution environment running trusted applications, used to execute specific business applications, including data-sensitive computing or trusted computing services, providing a trusted channel to connect with the management node, and providing support functions related to node migration. The management node is a Trusted Execution Environment (TEE) that runs management functions, providing a secure computing environment and management capabilities. It primarily includes a P2P consensus module, an execution node management module, a migration node management module, a migration strategy module, an execution node environment migration module, a key and permission management module, and a security authentication module. The P2P consensus module is responsible for node consensus and blockchain-related business, including participation in consensus, distributed management, and decentralized decision-making. The execution node management module manages the business operations and execution status monitoring of execution nodes. The migration node management module manages other valid migration nodes in the P2P network locally. The migration strategy module uses an attention-based neural network as its core, comprehensively considering factors such as node ownership, network conditions, computing conditions, data conditions, unique resource conditions, trust conditions, and resource utilization, to formulate the optimal migration plan based on the current node task and system operating status. The execution node environment migration module migrates execution nodes to target execution nodes according to the migration plan. The key and permission management module manages the keys and permissions used during the migration process. The security authentication module is responsible for security authentication during the migration process, including remote authentication of migration nodes, establishing point-to-point secure channels, and security monitoring before and after the migration process. The migration scheme employs a random selection and redundancy mechanism, selecting multiple candidate migration nodes. Some nodes, namely the target migration nodes, are used for the migration of the actual execution nodes, while the other part of the nodes, namely the second preset number of symbiotic trusted execution environment nodes, are used to form application tasks through masquerading computation. This is mainly used to obfuscate the attacker's target and to identify the malice of the target migration nodes and assess the node security.

[0096] To more intuitively illustrate the migration process of the target application, this embodiment provides another exemplary description, including: determining the resource requirements and configuration of the trusted execution environment (TEE) required by the application based on actual business needs, including the required platform, hardware, and dependencies, as well as the programs and data running in the TEE. Based on the resource requirements and configuration, creating symbiotic TEE nodes, including management nodes and execution nodes, wherein the execution nodes check the integrity of the programs and data and verify the digital signature of the programs to ensure program trustworthiness; loading data and programs in the trusted execution environment of the execution nodes and executing the programs; the management nodes utilize blockchain infrastructure to build a consensus network for managing the migration nodes and ensuring network security; the management nodes collect information on all migration nodes, including status and resource conditions, for subsequent task allocation and management. Based on the resource information and migration requirements, the management nodes create migration tasks and upload them to the blockchain infrastructure, notifying all nodes in the consensus network. The management node takes over the execution nodes, sets checkpoints, saves the current execution state, creates keys, and encrypts the execution node environment to form a trusted execution environment ciphertext. Based on an attention-based neural network model, and combining the current task state with the resource and trust status of collected nodes, it constructs the optimal migration strategy and determines the target migration nodes. Some nodes are used for the migration of real execution nodes, while others use spoofed computation to create application tasks. All target migration nodes negotiate keys to create a secure channel. The management node of each target migration node starts a monitoring program and loads the encrypted ciphertext from the source execution node into memory. At the management node, the ciphertext from the source execution node is decrypted and processed. A complete verification process is performed, creating an execution environment identical to the source node according to the migration task requirements and loading checkpoints. After migration, the execution node is awakened, restoring the application's state and data, and continuing to execute the application. The monitoring program monitors the execution process in real time, collects program behavior, and uploads it to the blockchain to ensure the traceability and security of the migration process. After the program finishes running after migration, the execution result is returned to the owner through a trusted channel, and the task output results of multiple real execution nodes are verified to ensure correctness. At the same time, the anomalies of spoofed tasks are verified to determine the credibility of the probe nodes. Based on the feedback information during the migration process, the migration strategy neural network model is updated to continuously optimize the migration method and process.

[0097] In summary, the embodiments disclosed herein achieve the following effects:

[0098] 1. By designing a randomized coexisting trusted execution environment, dual isolation of the trusted execution environment is achieved, protecting the security of the application. A P2P consensus network management node is introduced to avoid single points of failure and increase mutual trust between nodes. The application is migrated through the consensus network, ensuring that the data during the migration process cannot be persistently stored, guaranteeing the security, privacy, and traceability of the migration process, thereby achieving trusted and efficient migration of the application, improving migration efficiency and data privacy and security.

[0099] 2. By generating multiple random trusted execution environments, one of which is dedicated to management and external interaction, and the others are used to execute business applications, dual isolation of trusted execution environments is achieved, thereby protecting the security of application instances. The random creation mechanism also increases the difficulty of external attacks to a certain extent.

[0100] 3. By employing a P2P consensus network to manage nodes in the trusted application environment, the single point of failure and security risks that may exist in traditional centralized management methods are avoided. Utilizing a hierarchical management and attention mechanism neural network dynamic model, the deep connections between factors influencing migration tasks are better uncovered, and the optimal migration scheme is selected, improving the efficiency and security of environment migration.

[0101] 4. The management node takes over the execution node and encrypts and encapsulates it. Multiple alternative migration nodes are selected using random selection and redundancy mechanisms. Secure pipelines and dynamic keys are created for each node. One part is used for real computation execution, and the other part is used for disguised computation. This increases the difficulty for attackers in the migration process and also helps to identify the maliciousness of the nodes and assess their security.

[0102] 5. After the migration is complete, the target instance can be quickly woken up and take over the service, ensuring service continuity during the migration process.

[0103] 6. The entire migration process is pushed to the task initiator, enabling the migration process to be recorded on the blockchain and ensuring traceability. Simultaneously, data is not persisted to disk during execution, and data processing data is not permanently stored, ensuring data security and privacy.

[0104] 7. Introduce an evaluation mechanism to collect execution status through resident programs and evaluate the service quality of the migration process to further improve migration efficiency and security, and ensure that the system maintains a high level of security and stability in the ever-evolving network environment.

[0105] Corresponding to the application migration method described above, this invention also proposes an application migration apparatus. Since the apparatus embodiments of this invention correspond to the method embodiments described above, details not disclosed in the apparatus embodiments can be referred to in the method embodiments described above, and will not be repeated here.

[0106] Figure 3 This is a schematic diagram of the structure of an application migration device provided in an embodiment of this disclosure, as shown below. Figure 3 As shown, it includes:

[0107] The first determining unit 21 is used to determine the target co-existing trusted execution environment node where the target application to be migrated is located. The target co-existing trusted execution environment node includes a target management node and a target execution node. The target execution node is used to execute the target application, and the target management node is used to manage the migration of the target application.

[0108] The second determining unit 22 is used to determine a target migration node based on the target management node. The target migration node is connected to the target symbiotic trusted execution environment node based on a consensus network. The consensus network is a network built on blockchain. The target migration node is a symbiotic trusted execution environment node. The target management node is used to receive the target application.

[0109] The first creation unit 23 is used to perform key negotiation between the target migration node and the target symbiotic trusted execution environment node, and to create a secure channel between the target migration node and the target symbiotic trusted execution environment node;

[0110] Loading unit 24 is used to load the encrypted ciphertext corresponding to the target application into the target migration node based on the secure channel;

[0111] The decryption unit 25 is used to decrypt the encrypted ciphertext based on the management node in the target migration node, obtain the decryption result, and perform integrity verification on the decryption result;

[0112] The second creation unit 26 is used to create an execution node identical to the target execution node on the target migration node based on the trusted execution environment information included in the decryption result, provided that the decryption result is complete and error-free. The trusted execution environment information is the environment information in which the target program runs on the target execution node.

[0113] The running unit 27 is used to run the target application on the execution node according to the execution status information of the target application on the target execution node included in the decryption result.

[0114] The application migration apparatus provided in this disclosure determines a target symbiotic trusted execution environment node where the target application to be migrated resides. The target symbiotic trusted execution environment node includes a target management node and a target execution node. The target execution node is used to execute the target application, and the target management node is used to manage the migration of the target application. Based on the target management node, a target migration node is determined. The target migration node connects to the target symbiotic trusted execution environment node via a consensus network, which is a blockchain-based network. The target migration node is a symbiotic trusted execution environment node, and the target management node is used to receive the target application. Key negotiation is performed between the target migration node and the target symbiotic trusted execution environment node, and a key is created. A secure channel is established between the target migration node and the target co-existing trusted execution environment node. Based on this secure channel, encrypted ciphertext corresponding to the target application is loaded into the target migration node. The encrypted ciphertext is decrypted by a management node within the target migration node to obtain a decryption result, and the integrity of the decryption result is verified. If the decryption result is confirmed to be complete and error-free, an execution node identical to the target execution node is created on the target migration node based on the trusted execution environment information included in the decryption result. The trusted execution environment information refers to the environment in which the target program runs on the target execution node. The target application is then run on the execution node based on the execution status information of the target application on the target execution node included in the decryption result. Compared to related technologies, this approach achieves dual isolation of the trusted execution environment by designing a random co-existing trusted execution environment, protecting application security. The introduction of a P2P consensus network management node avoids single points of failure, increases node mutual trust, and ensures that data during the migration process is not persistently stored, guaranteeing data security, privacy, and traceability of the migration process, thereby achieving trusted and efficient application migration.

[0115] Figure 4 This is a schematic diagram of the structure of another application migration device provided in an embodiment of this disclosure, as shown below. Figure 4 As shown, the first determining unit 21 includes:

[0116] The first determining module 211 is used to determine the resources and configuration information of the trusted execution environment required to run the application. The resources and configuration information include the platform, hardware and dependencies, as well as the application and data running in the trusted execution environment.

[0117] Module 212 is used to create a symbiotic trusted execution environment node based on the resource and configuration information, wherein the symbiotic trusted execution environment node runs the application.

[0118] The second determining module 213 is used to determine, when it is determined that the application needs to be migrated, the application as the target application and the symbiotic trusted execution environment node as the target symbiotic trusted execution environment node.

[0119] Furthermore, in one possible implementation of the embodiments of this disclosure, such as Figure 4 As shown, the second determining unit 22 includes:

[0120] The acquisition module 221 is used to acquire the status information of all migration nodes on the consensus network based on the target management node. The status information includes status and resource status, and all migration nodes are symbiotic trusted execution environment nodes.

[0121] The determination module 222 is used to determine the target migration node based on the state information by a neural network model based on the attention mechanism. The target migration node is a first preset number of symbiotic trusted execution environment nodes. The first preset number of symbiotic trusted execution environment nodes are used to receive the target application. In addition, a second preset number of symbiotic trusted execution environment nodes connected to the consensus network are used to disguise themselves as receiving the target application.

[0122] Furthermore, in one possible implementation of the embodiments of this disclosure, such as Figure 4 As shown, the device is also used for:

[0123] Based on the target management node, a migration task is created according to the status information and migration requirements;

[0124] The migration task information is uploaded to the blockchain and broadcast to all migration nodes on the consensus network, so that each migration node can perform corresponding operations based on the migration task information.

[0125] Based on the target management node, the execution status information and trusted execution environment information of the target application on the target execution node are collected;

[0126] The execution status information and the trusted execution environment information are encrypted to obtain the encrypted ciphertext.

[0127] Furthermore, in one possible implementation of the embodiments of this disclosure, such as Figure 4 As shown, the device is also used for:

[0128] The target application is received by the first preset number of symbiotic trusted execution environment nodes corresponding to the target migration node;

[0129] The target application is executed on the first preset number of symbiotic trusted execution environment nodes respectively, and the execution results of each of the first preset number of symbiotic trusted execution environment nodes are obtained;

[0130] The detection results are obtained by detecting whether there are any anomalies in the process of the second preset number of symbiotic trusted execution environment nodes masquerading as receiving the target application.

[0131] The accuracy and reliability of the execution results are determined based on the execution results and the detection results.

[0132] Furthermore, in one possible implementation of the embodiments of this disclosure, such as Figure 4 As shown, the device is also used for:

[0133] The target status information of the target application migration process is monitored based on a preset monitoring program.

[0134] The neural network model is trained and updated based on the target state information.

[0135] It should be noted that the foregoing explanation of the method embodiments also applies to the apparatus of this embodiment, and the principle is the same, so it is not limited in this embodiment.

[0136] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0137] Figure 5 A schematic block diagram of an example electronic device 300 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0138] like Figure 5As shown, device 300 includes a computing unit 301, which can perform various appropriate actions and processes based on a computer program stored in ROM (Read-Only Memory) 302 or a computer program loaded from storage unit 308 into RAM (Random Access Memory) 303. RAM 303 may also store various programs and data required for the operation of device 300. The computing unit 301, ROM 302, and RAM 303 are interconnected via bus 304. I / O (Input / Output) interface 305 is also connected to bus 304.

[0139] Multiple components in device 300 are connected to I / O interface 305, including: input unit 306, such as keyboard, mouse, etc.; output unit 307, such as various types of monitors, speakers, etc.; storage unit 308, such as disk, optical disk, etc.; and communication unit 309, such as network card, modem, wireless transceiver, etc. Communication unit 309 allows device 300 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0140] The computing unit 301 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 301 include, but are not limited to, CPUs (Central Processing Units), GPUs (Graphics Processing Units), various special-purpose AI (Artificial Intelligence) computing chips, various computing units running machine learning model algorithms, DSPs (Digital Signal Processors), and any suitable processor, controller, microcontroller, etc. The computing unit 301 performs the various methods and processes described above, such as the application migration method. For example, in some embodiments, the application migration method may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 308. In some embodiments, part or all of the computer program may be loaded and / or installed on device 300 via ROM 302 and / or communication unit 309. When the computer program is loaded into RAM 303 and executed by the computing unit 301, one or more steps of the methods described above may be performed. Alternatively, in other embodiments, computing unit 301 may be configured to perform the aforementioned application migration method by any other suitable means (e.g., by means of firmware).

[0141] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, FPGAs (Field Programmable Gate Arrays), ASICs (Application-Specific Integrated Circuits), ASSPs (Application-Specific Standard Products), SOCs (System-on-Chips), CPLDs (Complex Programmable Logic Devices), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0142] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0143] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, RAM, ROM, EPROM (Electrically Programmable Read-Only Memory) or flash memory, optical fiber, CD-ROM (Compact Disc Read-Only Memory), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0144] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (Cathode-Ray Tube) or LCD (Liquid Crystal Display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0145] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include LANs (Local Area Networks), WANs (Wide Area Networks), the Internet, and blockchain networks.

[0146] Computer systems can include clients and servers. Clients and servers are generally geographically separated and typically interact via communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. A server can be a cloud server, also known as a cloud computing server or cloud host, a hosting product within the cloud computing service system that addresses the shortcomings of traditional physical hosts and VPS (Virtual Private Server) services, such as high management difficulty and weak business scalability. Servers can also be servers for distributed systems or servers incorporating blockchain technology.

[0147] It's important to note that artificial intelligence (AI) is the study of enabling computers to simulate certain human thought processes and intelligent behaviors (such as learning, reasoning, thinking, and planning). It encompasses both hardware and software technologies. AI hardware technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, and big data processing. AI software technologies primarily include computer vision, speech recognition, natural language processing, machine learning / deep learning, big data processing, and knowledge graph technologies.

[0148] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

Claims

1. A method for application migration, characterized in that, include: The target symbiotic trusted execution environment node where the target application to be migrated resides is determined. The target symbiotic trusted execution environment node includes a target management node and a target execution node. The target execution node is used to execute the target application, and the target management node is used to manage the migration of the target application. The target migration node is determined based on the target management node. The target migration node is connected to the target symbiotic trusted execution environment node based on a consensus network. The consensus network is a blockchain-based network. The target migration node is a symbiotic trusted execution environment node. The target management node is used to receive the target application. The target migration node and the target symbiotic trusted execution environment node perform key negotiation and create a secure channel between the target migration node and the target symbiotic trusted execution environment node; The encrypted ciphertext corresponding to the target application is loaded into the target migration node based on the secure channel; The encrypted ciphertext is decrypted based on the management node in the target migration node to obtain the decryption result, and the integrity of the decryption result is verified. If the decryption result is confirmed to be complete and error-free, an execution node identical to the target execution node is created on the target migration node based on the trusted execution environment information included in the decryption result. The trusted execution environment information is the environment information in which the target program runs on the target execution node. The target application is run on the execution node based on the execution status information of the target application on the target execution node included in the decryption result.

2. The method according to claim 1, characterized in that, The node in the target symbiotic trusted execution environment where the target application to be migrated resides includes: Determine the resources and configuration information of the trusted execution environment required to run the application, including the platform, hardware and dependencies, as well as the application and data running in the trusted execution environment; A symbiotic trusted execution environment node is created based on the resource and configuration information, and the symbiotic trusted execution environment node runs the application. If it is determined that the application needs to be migrated, the application is identified as the target application and the symbiotic trusted execution environment node is identified as the target symbiotic trusted execution environment node.

3. The method according to claim 2, characterized in that, The step of determining the target migration node based on the target management node includes: Based on the target management node, the status information of all migration nodes on the consensus network is collected. The status information includes status and resource status. All migration nodes are symbiotic trusted execution environment nodes. The attention-based neural network model determines the target migration node based on the state information. The target migration node is a first preset number of symbiotic trusted execution environment nodes. The first preset number of symbiotic trusted execution environment nodes are used to receive the target application. In addition, a second preset number of symbiotic trusted execution environment nodes connected to the consensus network are used to disguise themselves as receiving the target application.

4. The method according to claim 3, characterized in that, Before the attention-based neural network model determines the target migration node based on the state information, the method includes: Based on the target management node, a migration task is created according to the status information and migration requirements; The migration task information is uploaded to the blockchain and broadcast to all migration nodes on the consensus network, so that each migration node can perform corresponding operations based on the migration task information. Based on the target management node, the execution status information and trusted execution environment information of the target application on the target execution node are collected; The execution status information and the trusted execution environment information are encrypted to obtain the encrypted ciphertext.

5. The method according to claim 4, characterized in that, After the attention-based neural network model determines the target migration node based on the state information, the method includes: The target application is received by the first preset number of symbiotic trusted execution environment nodes corresponding to the target migration node; The target application is executed on the first preset number of symbiotic trusted execution environment nodes respectively, and the execution results of each of the first preset number of symbiotic trusted execution environment nodes are obtained; The detection results are obtained by detecting whether there are any anomalies in the process of the second preset number of symbiotic trusted execution environment nodes masquerading as receiving the target application. The accuracy and reliability of the execution results are determined based on the execution results and the detection results.

6. The method according to claim 1, characterized in that, The method includes: The target status information of the target application migration process is monitored based on a preset monitoring program. The neural network model is trained and updated based on the target state information.

7. An apparatus for application migration, characterized in that, include: The first determining unit is used to determine the target co-existing trusted execution environment node where the target application to be migrated is located. The target co-existing trusted execution environment node includes a target management node and a target execution node, wherein the target execution node is used to execute the target application, and the target management node is used to manage the migration of the target application. The second determining unit is used to determine a target migration node based on the target management node. The target migration node is connected to the target symbiotic trusted execution environment node based on a consensus network. The consensus network is a network built on blockchain. The target migration node is a symbiotic trusted execution environment node. The target management node is used to receive the target application. The first creation unit is used to perform key negotiation between the target migration node and the target symbiotic trusted execution environment node, and to create a secure channel between the target migration node and the target symbiotic trusted execution environment node; The loading unit is used to load the encrypted ciphertext corresponding to the target application into the target migration node based on the secure channel; The decryption unit is used to decrypt the encrypted ciphertext based on the management node in the target migration node, obtain the decryption result, and perform integrity verification on the decryption result; The second creation unit is used to create an execution node identical to the target execution node on the target migration node based on the trusted execution environment information included in the decryption result, provided that the decryption result is complete and error-free. The trusted execution environment information is the environment information in which the target program runs on the target execution node. The execution unit is configured to run the target application on the execution node based on the execution status information of the target application on the target execution node included in the decryption result.

8. An electronic device, characterized in that, include: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-6.

9. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-6.

10. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method according to any one of claims 1-6.

Images