Resource allocation method, device, electronic device, storage medium and program product

Abstract

The present invention discloses a resource allocation method, device, electronic device, storage medium and program product, which are applied to the field of distributed cluster technology and are used to solve the problem that it is difficult to achieve efficient confidential computing resource allocation in a distributed confidential computing cluster. The method is applied to any node in the distributed confidential computing cluster, including: determining a requesting node corresponding to a computing request; obtaining all logical distance groups of the current node, and determining a target logical distance group that is closest to the requesting node; each logical distance group corresponding to the current node includes no more than a preset number of allocatable nodes, and the distance between each allocatable node and the current node does not exceed the distance range specified by the corresponding logical distance group; the current node pre-stores the node information of allocatable nodes; if the requesting node hits the target logical distance group, the computing request is allocated to the requesting node, otherwise the target node is determined according to the target logical distance group, and the computing request is allocated to the target node.

Description

Technical Field

[0001] The present invention relates to the field of distributed cluster technology, and in particular to a resource allocation method, and also to a resource allocation device, an electronic device, a non-volatile storage medium and a computer program product. Background Art

[0002] With the rapid development of distributed computing technology, resource scheduling, as the core technology of distributed computing, has also received more and more attention. The goal of resource scheduling is to select a suitable computing solution for the current computing task, ensure its efficient operation, and effectively utilize limited distributed cluster resources. As users and enterprises have increasingly stringent requirements for data confidentiality, it is necessary for distributed clusters to be able to achieve security protection of runtime data. Therefore, confidential computing technology has emerged.

[0003] Confidential computing is a secure computing mode used to protect the confidentiality and integrity of data and code during the computing process. This mode is based on trusted hardware through a trusted execution environment (TEE, Trusted Execution Environment), so that the code and data in the environment cannot be monitored and tampered by other software (including privileged software) running on the same device during computing. A distributed confidential computing cluster includes many confidential computing nodes. The confidential computing nodes run the data in a trusted execution environment when in use, which can ensure the security of the data when in use. At the same time, before data is transmitted or used between nodes, remote attestation operations need to be performed on the confidential computing nodes to prove that the confidential computing nodes and the responder are indeed running in a trusted execution environment to establish a secure transmission channel. However, the trusted channels established between distributed cluster nodes have a large amount of communication and a complex structure, which makes the process of constructing remote attestation between any two nodes also relatively complicated, making it difficult to apply in practice.

[0004] Therefore, how to build an efficient distributed confidential computing resource allocation method for a distributed confidential computing cluster system is an urgent problem to be solved by technicians in this field. Summary of the invention

[0005] An object of the present invention is to provide a resource allocation method, which realizes efficient distributed confidential computing resource allocation in a distributed confidential computing cluster system; another object of the present invention is to provide a resource allocation device, an electronic device, a non-volatile storage medium and a computer program product, all of which have the above-mentioned beneficial effects.

[0006] In a first aspect, the present invention provides a resource allocation method, which is applied to any node in a distributed confidential computing cluster, and the method comprises:

[0007] When receiving a computing request, determining a requesting node corresponding to the computing request;

[0008] Acquire all logical distance groups of the current node, and determine the target logical distance group closest to the request node among all the logical distance groups; each logical distance group corresponding to the current node includes no more than a preset number of allocatable nodes, and the distance between each allocatable node and the current node does not exceed the distance range specified by the corresponding logical distance group; the current node pre-stores the node information of all the allocatable nodes;

[0009] If the requesting node hits the target logical distance group, the computing request is allocated to the requesting node;

[0010] If the requesting node does not hit the target logical distance group, a target node is determined according to the target logical distance group, and the computing request is allocated to the target node.

[0011] If the requesting node hits the target logical distance group, allocating the computing request to the requesting node includes:

[0012] If the requesting node hits the target logical distance group, obtaining the network status of the requesting node;

[0013] If the network state of the requesting node is offline, selecting a target allocatable node in the target logical distance group, and allocating the computing request to the target allocatable node;

[0014] If the network status of the requesting node is online, the computing request is allocated to the requesting node.

[0015] If the network status of the requesting node is online, allocating the computing request to the requesting node includes:

[0016] If the network status of the requesting node is online, obtaining available resources of the requesting node;

[0017] If the available resources of the requesting node do not reach a preset threshold, selecting a target allocatable node in the target logical distance group, and allocating the computing request to the target allocatable node;

[0018] If the available resources of the requesting node reach the preset threshold, the computing request is allocated to the requesting node.

[0019] The step of selecting a target allocatable node in the target logical distance group and allocating the computing request to the target allocatable node comprises:

[0020] In the target logical distance group, select an allocatable node whose network status is online and whose available resources reach a preset threshold as the target allocatable node;

[0021] The computing request is allocated to the target allocatable node.

[0022] The resource allocation method further includes:

[0023] If the network status of the requesting node is offline, the requesting node is deleted from the target logical distance group.

[0024] The resource allocation method further includes:

[0025] Determine all logical distance groups of the target allocatable node, and determine the closest distance node corresponding to the target allocatable node in all the logical distance groups;

[0026] If the closest distance node hits the target logical distance group, the closest distance node is added to the target logical distance group.

[0027] If the requesting node does not hit the target logical distance group, determining a target node according to the target logical distance group and allocating the computing request to the target node includes:

[0028] If the requesting node does not hit the target logical distance group, determining whether the number of assignable nodes in the target logical distance group reaches the preset number;

[0029] If the preset number is not reached, adding the requesting node to the target logical distance group and serving as the target node, and allocating the computing request to the target node;

[0030] If the preset number is reached, the target node is selected within the target logical distance group, and the computing request is allocated to the target node.

[0031] The step of adding the requesting node to the target logical distance group and using it as the target node, and allocating the computing request to the target node, includes:

[0032] If the network status of the requesting node is online and the available resources reach a preset threshold, the requesting node is added to the target logical distance group and used as the target node, and the computing request is allocated to the target node;

[0033] If the network status of the requesting node is offline, or the available resources do not reach a preset threshold, the target node is selected within the target logical distance group, and the computing request is allocated to the target node.

[0034] Wherein, if the network status of the requesting node is offline, or the available resources do not reach the preset threshold, then after selecting the target node in the target logical distance group and allocating the computing request to the target node, it also includes:

[0035] Determine all logical distance groups of the target node, and determine the closest distance node corresponding to the target node in all the logical distance groups;

[0036] If the closest distance node hits the target logical distance group, the closest distance node is added to the target logical distance group.

[0037] The step of selecting the target node in the target logical distance group and allocating the computing request to the target node comprises:

[0038] In the target logical distance group, select an allocatable node whose network status is online and whose available resources reach a preset threshold as the target node;

[0039] The computing request is distributed to the target node.

[0040] Among them, for each node in the distributed confidential computing cluster, all logical distance groups corresponding to the node are obtained according to the logical topology network corresponding to the node, and the logical topology network is obtained by constructing a binary tree according to the distance between the node and other nodes in the distributed confidential computing cluster;

[0041] In the logical topology network corresponding to the current node, nodes in each subtree that do not exceed the preset number are combined into a logical distance group corresponding to the current node.

[0042] The node information includes remote proof; if the requesting node hits the target logical distance group, the computing request is allocated to the requesting node, including:

[0043] If the requesting node hits the target logical distance group, negotiating a session key with the requesting node according to the remote attestation;

[0044] Encrypting the computing request using the session key to obtain an encrypted computing request;

[0045] The encryption computing request is distributed to the requesting node.

[0046] The node information further includes a node ID, a node IP, and a node location; allocating the encryption computing request to the requesting node includes:

[0047] The encryption computing request is distributed to the requesting node according to the node ID, the node IP, and the node location.

[0048] The node ID includes the encoding information of the node location and the hash information of the node IP.

[0049] The resource allocation method further includes:

[0050] Initiating a remote attestation challenge to the requesting node, and sending a random number to the requesting node, so that the requesting node responds to the remote attestation challenge to generate a requesting node remote attestation including the random number;

[0051] The remote certificate of the requesting node is obtained for verification, and the remote certificate of the requesting node is saved when the verification passes.

[0052] The resource allocation method further includes:

[0053] Get local available resources in real time;

[0054] If the local available resources are lower than a preset threshold, determining the nearest node in all logical distance groups of the current node;

[0055] Migrate the node load in the current node to the nearest node.

[0056] In a second aspect, the present invention further discloses a resource allocation device, which is applied to any node in a distributed confidential computing cluster, and the device includes:

[0057] A determination module, configured to, when receiving a computing request, determine a requesting node corresponding to the computing request;

[0058] An acquisition module, used for acquiring all logical distance groups of the current node, and determining the target logical distance group closest to the request node among all the logical distance groups; each logical distance group corresponding to the current node includes no more than a preset number of assignable nodes, and the distance between each assignable node and the current node does not exceed the distance range specified by the corresponding logical distance group; the current node pre-stores the node information of all the assignable nodes;

[0059] A first allocation module, configured to allocate the computing request to the requesting node if the requesting node hits the target logical distance group;

[0060] The second allocation module is used to determine a target node according to the target logical distance group and allocate the computing request to the target node if the requesting node does not hit the target logical distance group.

[0061] In a third aspect, the present invention further discloses an electronic device, comprising:

[0062] Memory for storing computer programs;

[0063] A processor is used to implement the steps of any one of the resource allocation methods described above when executing the computer program.

[0064] In a fourth aspect, the present invention further discloses a non-volatile storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of any one of the resource allocation methods described above are implemented.

[0065] In a fifth aspect, the present invention further discloses a computer program product, including a computer program / instruction, which implements the steps of any one of the resource allocation methods described above when executed by a processor.

[0066] The present invention provides a resource allocation method, which is applied to any node in a distributed confidential computing cluster, and the method includes: when a computing request is received, determining the request node corresponding to the computing request; obtaining all logical distance groups of the current node, and determining the target logical distance group that is closest to the request node among all the logical distance groups; each logical distance group corresponding to the current node includes no more than a preset number of allocable nodes, and the distance between each allocable node and the current node does not exceed the distance range specified by the corresponding logical distance group; the current node pre-stores the node information of all the allocable nodes; if the request node hits the target logical distance group, the computing request is allocated to the request node; if the request node does not hit the target logical distance group, the target node is determined according to the target logical distance group, and the computing request is allocated to the target node.

[0067] By applying the technical solution provided by the present invention, for each node in the distributed confidential computing cluster, multiple corresponding logical distance groups are pre-created, and each logical distance group contains no more than a preset number of assignable nodes within a specified distance range relative to the current node, that is, different logical distance groups correspond to different distance ranges. Therefore, when a computing request for a requesting node is received, the target logical distance group closest to the requesting node can be determined in all logical distance groups corresponding to the current node, and the computing request can be assigned to the corresponding node for request processing according to the hit situation of the requesting node in the target logical distance group. It can be seen that each node in the distributed confidential computing cluster only needs to store a small amount of node information of other nodes, and does not need to store the node information of all other nodes, which not only effectively reduces the node storage pressure, but also greatly reduces the remote proof operations between nodes, and realizes efficient distributed confidential computing resource allocation.

[0068] The resource allocation device, electronic device, non-volatile storage medium and computer program product provided by the present invention also have the above technical effects, and the present invention will not elaborate on them here. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] In order to more clearly illustrate the technical solutions in the prior art and the embodiments of the present invention, the following briefly introduces the drawings required for describing the prior art and the embodiments of the present invention. Of course, the drawings related to the embodiments of the present invention described below are only part of the embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without creative work, and the obtained other drawings also belong to the protection scope of the present invention.

[0070] Figure 1 A schematic diagram of a flow chart of a resource allocation method provided by an embodiment of the present invention;

[0071] Figure 2 A node distribution diagram of a distributed confidential computing cluster provided in an embodiment of the present invention;

[0072] Figure 3 A schematic diagram of a node ID structure provided by an embodiment of the present invention;

[0073] Figure 4 A schematic diagram of a distance-based logical topology network structure provided by an embodiment of the present invention;

[0074] Figure 5 A schematic diagram of subtree division within a logical topology network provided by an embodiment of the present invention;

[0075] Figure 6A schematic diagram of a logical distance group list provided by an embodiment of the present invention;

[0076] Figure 7 A schematic diagram of a first resource allocation scenario provided by an embodiment of the present invention;

[0077] Figure 8 A schematic diagram of a second resource allocation scenario provided by an embodiment of the present invention;

[0078] Fig. 9 A schematic diagram of a third resource allocation scenario provided by an embodiment of the present invention;

[0079] Fig.10 A schematic diagram of a fourth resource allocation scenario provided by an embodiment of the present invention;

[0080] Fig.11 A schematic diagram of a fifth resource allocation scenario provided by an embodiment of the present invention;

[0081] Fig.12 A schematic diagram of a sixth resource allocation scenario provided by an embodiment of the present invention;

[0082] Fig.13 A schematic diagram of a seventh resource allocation scenario provided by an embodiment of the present invention;

[0083] Fig.14 A schematic diagram of an eighth resource allocation scenario provided by an embodiment of the present invention;

[0084] Fig.15 A schematic diagram of the structure of a resource allocation device provided by an embodiment of the present invention;

[0085] Fig.16 The present invention is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0086] The core of the present invention is to provide a resource allocation method, which realizes efficient distributed confidential computing resource allocation in a distributed confidential computing cluster system; another core of the present invention is to provide a resource allocation device, an electronic device, a non-volatile storage medium and a computer program product, all of which have the above-mentioned beneficial effects.

[0087] In order to describe the technical solutions in the embodiments of the present invention more clearly and completely, the technical solutions in the embodiments of the present invention will be introduced below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0088] An embodiment of the present invention provides a resource allocation method.

[0089] It should be noted that the resource allocation method provided in the embodiment of the present invention can be applied to any node in a distributed confidential computing cluster. It can be understood that each node in the distributed confidential computing cluster is a confidential computing node.

[0090] On this basis, please refer to Figure 1 , Figure 1 A schematic flow chart of a resource allocation method provided in an embodiment of the present invention, the resource allocation method may include the following S101 to S104.

[0091] S101: When a computing request is received, a requesting node corresponding to the computing request is determined.

[0092] This step aims to determine the requesting node, which is the node that the computing request is to apply for request processing, and can be directly specified in the computing request. For example, a user sends a computing request to a node A on a distributed confidential computing cluster through a user terminal, requesting that the confidential computing load be run on node B. Here, node A is the node that currently receives the computing request, that is, the current node mentioned below, and node B is the requesting node.

[0093] S102: Obtain all logical distance groups of the current node, and determine the target logical distance group that is closest to the request node among all logical distance groups; each logical distance group corresponding to the current node includes no more than a preset number of allocatable nodes, and the distance between each allocatable node and the current node does not exceed the distance range specified by the corresponding logical distance group; the current node pre-stores the node information of all allocatable nodes.

[0094] This step aims to determine the nearest logical distance group, which is the logical distance group that is closest to the requesting node among all logical distance groups corresponding to the current node, that is, the target logical distance group. Specifically, for each node in the distributed confidential computing cluster, multiple logical distance groups corresponding to it are pre-created, and each logical distance group contains no more than a preset number of allocable nodes within the specified distance range relative to the current node, that is, different logical distance groups correspond to different distance ranges; on this basis, for each node in the distributed confidential computing cluster, it only stores the node information of all the corresponding allocable nodes locally, without storing the node information of other nodes in the distributed confidential computing cluster. Therefore, for the current node, in the subsequent resource allocation process, it only needs to allocate resources in its corresponding allocable node, without considering other nodes other than the allocable node, which effectively reduces the node load pressure. Among them, the node information may include but is not limited to the node ID, node IP, node coordinates, node remote proof, etc. of the corresponding node. In addition, the value of the above preset number does not affect the implementation of the technical solution, and can be set by the technician according to actual needs, and the present invention does not limit this.

[0095] In one embodiment of the present invention, for each node in the distributed confidential computing cluster, all logical distance groups corresponding to the node are obtained according to the logical topology network corresponding to the node, and the logical topology network is obtained by constructing a binary tree according to the distance between the node and other nodes in the distributed confidential computing cluster;

[0096] In the logical topology network corresponding to the current node, nodes in each subtree that do not exceed a preset number are combined into a logical distance group corresponding to the current node.

[0097] This embodiment provides a method for constructing a logical distance group. Specifically, for each node in a distributed confidential computing cluster, a corresponding binary tree can be constructed. For example, a node ID can be constructed according to the node position and the node IP, so that a binary tree can be constructed according to the node ID to generate a distance-based logical topology network, wherein each node is a leaf node of the distance-based logical topology network. Thus, in the logical topology network, a corresponding logical distance group can be formed by selecting a preset number of nodes in each subtree. Obviously, the number of subtrees in the logical topology network is the number of logical distance groups.

[0098] S103: If the requesting node hits the target logical distance group, the computing request is allocated to the requesting node.

[0099] This step aims to realize the allocation and processing of computing requests when the request node hits the target logical distance group. Specifically, when the request node hits the target logical distance group, it means that the current node happens to store the node information of the request node, and the distance between the request node and the current node is relatively close. Therefore, the computing request can be directly allocated to the request node according to the node information of the request node, and the request node performs subsequent processing on the computing request.

[0100] In one embodiment of the present invention, if the requesting node hits the target logical distance group, allocating the computing request to the requesting node may include:

[0101] If the requesting node hits the target logical distance group, the network status of the requesting node is obtained;

[0102] If the network status of the requesting node is offline, a target allocatable node is selected in the target logical distance group, and the computing request is allocated to the target allocatable node;

[0103] If the network status of the requesting node is online, the computing request is allocated to the requesting node.

[0104] Among them, if the network status of the requesting node is online, the computing request is allocated to the requesting node, which may include: if the network status of the requesting node is online, the available resources of the requesting node are obtained; if the available resources of the requesting node do not reach the preset threshold, the target allocatable node is selected in the target logical distance group, and the computing request is allocated to the target allocatable node; if the available resources of the requesting node reach the preset threshold, the computing request is allocated to the requesting node.

[0105] Among them, selecting a target allocatable node within the target logical distance group and allocating the computing request to the target allocatable node may include: within the target logical distance group, selecting an allocatable node whose network status is online and whose available resources reach a preset threshold as the target allocatable node; allocating the computing request to the target allocatable node.

[0106] It is understandable that, in order to ensure the normal processing of the computing request, it is possible to give priority to ensuring that the network status of the node to which the computing request is assigned is online and that the available resources are sufficient. Therefore, when the requesting node hits the target logical distance group, the network status and current available resources of the requesting node can be obtained respectively. As long as the network status of the requesting node is online and the current available resources reach the preset threshold, the computing request can be assigned to the requesting node; otherwise, an assignable node whose network status is online and the current available resources reach the preset threshold can be selected in the target logical distance group as the target assignable node for computing request assignment. Among them, the value of the preset threshold does not affect the implementation of the present technical solution, and the technical personnel can customize the setting according to the actual situation, and the present invention does not limit this.

[0107] Furthermore, the resource allocation method may further include: if the network status of the requesting node is offline, deleting the requesting node in the target logical distance group. That is, for the requesting node that hits the target logical distance group but has an offline network status, it can be deleted in the target logical group to avoid unnecessary resource occupation.

[0108] In a possible implementation, the resource allocation method may further include: determining all logical distance groups of the target allocatable node, and determining the nearest distance node corresponding to the target allocatable node in all logical distance groups; if the nearest distance node hits the target logical distance group, adding the nearest distance node to the target logical distance group.

[0109] In this embodiment, in the case where the number of allocable nodes in the target logical distance group is less than the preset number, or the offline request node is deleted in the target logical distance group, a new cluster node can be searched again as an allocable node to be added to the target logical distance group, so as to effectively ensure that the number of allocable nodes in the target logical distance group is sufficient and provide allocation services for subsequent new computing requests. Specifically, when the network status of the requesting node is offline or the current available resources are not satisfied with the preset threshold, after determining the target allocable node, a new allocable node, that is, the above-mentioned nearest distance node, can be searched based on the target allocable node and added to the target logical distance group. Among them, the nearest distance node can be screened in all logical distance groups corresponding to the target allocable node, which refers to the cluster node that is closest to the target allocable node in all logical distance groups.

[0110] S104: If the requesting node does not hit the target logical distance group, determine the target node according to the target logical distance group, and distribute the computing request to the target node.

[0111] This step is intended to implement the computation request allocation processing when the request node does not hit the target logical distance group. Specifically, when the request node does not hit the target logical distance group, it means that the current node does not store the node information of the request node, and the distance between the request node and the current node is unknown. Therefore, the target node can be determined according to the target logical distance group, and the target node performs subsequent processing on the computation request. Among them, the target node is preferably a node within the target logical distance group.

[0112] In one embodiment of the present invention, if the requesting node does not hit the target logical distance group, determining the target node according to the target logical distance group and allocating the computing request to the target node may include:

[0113] If the requesting node does not hit the target logical distance group, then determine whether the number of assignable nodes in the target logical distance group reaches a preset number;

[0114] If the preset number is not reached, the requesting node is added to the target logical distance group and used as the target node, and the computing request is allocated to the target node;

[0115] If the preset number is reached, a target node is selected within the target logical distance group and the computing request is distributed to the target node.

[0116] This embodiment provides a method for determining a target node according to a target logical distance group to allocate a computing request. When a requesting node does not hit the target logical distance group, if the number of allocatable nodes in the target logical distance group is less than a preset number, the requesting node can be directly added to the target logical distance group and used as the target node to implement computing request processing, so as to effectively avoid unnecessary resource waste; if the number of allocatable nodes in the target logical distance group reaches a preset threshold, an allocatable node in the target logical distance group can be directly selected as the target node to implement computing request processing.

[0117] Among them, adding the requesting node to the target logical distance group and using it as the target node, and allocating the computing request to the target node may include: if the network status of the requesting node is online and the available resources reach a preset threshold, then adding the requesting node to the target logical distance group and using it as the target node, and allocating the computing request to the target node; if the network status of the requesting node is offline, or the available resources do not reach the preset threshold, then selecting a target node in the target logical distance group, and allocating the computing request to the target node.

[0118] Among them, selecting a target node within the target logical distance group and allocating the computing request to the target node may include: within the target logical distance group, selecting an allocatable node whose network status is online and whose available resources reach a preset threshold as the target node; allocating the computing request to the target node.

[0119] That is to say, whether the requesting node is used as the target node for request processing, or the target node is selected within the target logical distance group for request processing, it is necessary to ensure that the network status of the target node is online and the current available resources meet the preset threshold to effectively ensure the normal processing of the computing request.

[0120] Furthermore, if the network status of the requesting node is offline, or the available resources do not reach the preset threshold, then after selecting the target node within the target logical distance group and allocating the computing request to the target node, it may also include: determining all logical distance groups of the target node, and determining the nearest distance node corresponding to the target node in all logical distance groups; if the nearest distance node hits the target logical distance group, the nearest distance node is added to the target logical distance group.

[0121] Similarly, in the case where the number of allocatable nodes in the target logical distance group is less than the preset number, new cluster nodes can be searched for as allocatable nodes to be added to the target logical distance group, so as to effectively ensure that the number of allocatable nodes in the target logical distance group is sufficient and to provide allocation services for subsequent new computing requests. Specifically, when the network status of the requesting node is offline or the current available resources are not satisfied with the preset threshold, after selecting the target node in the target logical distance group, a new allocatable node, i.e. the above-mentioned nearest distance node, can be searched based on the target node and added to the target logical distance group. Among them, the nearest distance node can be screened in all logical distance groups corresponding to the target node, which refers to the cluster node that is closest to the target node in all logical distance groups.

[0122] It can be seen that the resource allocation method provided by the embodiment of the present invention pre-creates multiple logical distance groups corresponding to each node in the distributed confidential computing cluster, and each logical distance group contains no more than a preset number of allocable nodes within the specified distance range relative to the current node, that is, different logical distance groups correspond to different distance ranges. Therefore, when a computing request for a requesting node is received, the target logical distance group closest to the requesting node can be determined in all logical distance groups corresponding to the current node, and the computing request can be allocated to the corresponding node for request processing according to the hit situation of the requesting node in the target logical distance group. It can be seen that each node in the distributed confidential computing cluster only needs to store a small amount of node information of other nodes, and does not need to store the node information of all other nodes, which not only effectively reduces the node storage pressure, but also greatly reduces the remote proof operations between nodes, and realizes efficient distributed confidential computing resource allocation.

[0123] Based on the above embodiments:

[0124] In one embodiment of the present invention, the node information includes remote proof; if the requesting node hits the target logical distance group, the computing request is allocated to the requesting node, which may include:

[0125] If the requesting node hits the target logical distance group, it negotiates a session key with the requesting node based on the remote proof;

[0126] The computing request is encrypted using the session key to obtain an encrypted computing request;

[0127] Distribute encryption computing requests to requesting nodes.

[0128] As mentioned above, each node in the distributed confidential computing cluster is a confidential computing node, in which a confidential computing environment is deployed. On this basis, when data is communicated between nodes in the distributed confidential computing cluster, remote attestation verification needs to be performed on each other to effectively ensure information security and integrity. Therefore, the node information stored by the current node can include the remote attestation of each assignable node. Similarly, each assignable node will also store the remote attestation of the current node. It should be noted that this process is implemented based on the two-way remote attestation verification between the current node and the assignable node. Then, in the process of assigning the computing request to the requesting node, the current node can first negotiate the session key with the requesting node through each other's remote attestation, and encrypt the computing request and assign it to the requesting node through the session key. It can be imagined that in the process of assigning the computing request to the target assignable node or the target node, the above process can also be referred to for session key negotiation and encryption assignment of the computing request.

[0129] Furthermore, the node information may also include node ID, node IP, and node location; the above-mentioned allocation of encrypted computing requests to requesting nodes may include: allocating encrypted computing requests to requesting nodes according to node ID, node IP, and node location. It can be seen that in order to facilitate the allocation of computing requests, the node information stored on the current node may further include the node ID, node IP, node location, etc. of each assignable node, thereby enabling the encrypted allocation of computing requests to be achieved with reference to these node information.

[0130] The node ID may include the encoding information of the node location and the hash information of the node IP. To effectively ensure the uniqueness of the cluster node, this embodiment provides a node ID setting method: first, the horizontal and vertical coordinates of the node location may be alternately encoded to obtain the first 40 bits of the node ID; then, a 256-bit hash value is calculated for the node IP, and the first 40 bits of the hash value are intercepted as the last 40 bits of the node ID; finally, the first 40 bits and the last 40 bits are concatenated to obtain the node ID.

[0131] In one embodiment of the present invention, the resource allocation method may further include:

[0132] Initiate a remote proof challenge to the requesting node, and send a random number to the requesting node, so that the requesting node responds to the remote proof challenge to generate a requesting node remote proof containing the random number;

[0133] Obtain the request node remote proof for verification, and save the request node remote proof when the verification passes.

[0134] This embodiment provides a method for implementing remote attestation verification of a requesting node by a current node. It can be understood that since remote attestation requires two-way verification, the remote attestation verification of the current node by the requesting node can also be implemented by referring to the above process.

[0135] In one embodiment of the present invention, the resource allocation method may further include:

[0136] Get local available resources in real time;

[0137] If the local available resources are lower than the preset threshold, the nearest node is determined in all logical distance groups of the current node;

[0138] Migrate the node load in the current node to the nearest node.

[0139] It is understandable that resource allocation in a distributed confidential computing cluster can be divided into two situations. One is to allocate the received computing request to the appropriate cluster node for request processing, which corresponds to the above embodiments, and the other is the situation where the load pressure of a node in the cluster is too high and the load pressure needs to be transferred, which corresponds to this embodiment. For each node in the distributed confidential computing cluster, it can monitor the local available resources in real time, and migrate the node load when it determines that the local available resources are lower than the preset threshold, so as to migrate its own node load to the cluster node closest to the current node (that is, the above-mentioned nearest node), so as to effectively avoid the problem of excessive node pressure.

[0140] An embodiment of the present invention provides another resource allocation method.

[0141] Specifically, the distributed confidential computing cluster may be distributed in different computer rooms and consist of small clusters distributed in different geographical areas, that is, different confidential computing nodes can be located in different cities. In addition, confidential computing nodes are distributed in clusters in small geographical areas. Figure 2 As shown, Figure 2A node distribution diagram of a distributed confidential computing cluster provided in an embodiment of the present invention can be divided into different clusters according to the physical distribution positions of the confidential computing nodes, and the confidential computing nodes in the cluster have a relatively short physical distance and communication distance. In a physical sense, all nodes in the confidential computing cluster can be fully connected, but in this case each confidential computing node needs to store information of all nodes in the cluster, including the node's IP, remote certification information, etc. In addition, if the cluster network is fully connected, each confidential computing node needs to perform two-way remote certification with all nodes and store remote certification information, which puts a lot of pressure on the communication and storage of the nodes.

[0142] To this end, on top of the actual distributed confidential computing network topology, the present invention reconstructs a layer of distance-based logical topology network, which is constructed in the form of a binary tree. In the distance-based logical topology network, each confidential computing node and user is assigned a unique ID, and all IDs have the same value space. Figure 3 As shown, Figure 3 A schematic diagram of a node ID construction provided in an embodiment of the present invention, wherein the ID of each confidential computing node and user is calculated from the location information and IP information, and the ID consists of 80 bits, of which the first 40 bits are obtained by alternatingly encoding the horizontal and vertical coordinates of the node location information, and the last 40 bits are obtained by intercepting the first 40 bits of the 256-bit hash value of the node IP information. The first 40 bits and the last 40 bits are concatenated to obtain the final ID, which can effectively ensure that each confidential computing node and user has a unique ID.

[0143] It can be understood that each confidential computing node is a leaf node of the distance-based logical topology network. Figure 4 As shown, Figure 4 A schematic diagram of a distance-based logical topology network structure provided by an embodiment of the present invention, wherein a leaf node that is a solid black circle indicates that the confidential computing node exists and can communicate with the network normally; a leaf node that is a hollow circle indicates that there is no confidential computing node at this location. For further information, please refer to Figure 5 , Figure 5 A schematic diagram of subtree division in a logical topology network provided by an embodiment of the present invention. According to a distance-based logical topology network, each confidential computing node can divide other confidential computing nodes in the distance-based logical topology network into 80 subtrees (taking 80 as an example). The confidential computing node can divide each subtree (such as Figure 5The k (preset number) confidential computing node information within the dashed circle shown is represented as a corresponding logical distance group. Obviously, there is a common prefix between this confidential computing node and each of its corresponding logical distance groups. Taking the confidential computing node 0 as an example, the largest subtree consists of half of the binary tree that does not contain the confidential computing node 0; the next-largest subtree consists of half of the remaining distance-based logical topology network that does not contain the confidential computing node 0. According to this partitioning method, the nodes in each subtree can be regarded as a logical distance group (Distance i, i ∈ [0, 80)). It can be understood that the more the first 40 bits of different confidential computing node IDs have the same prefix, the closer the physical positions of the two nodes are within a local area. The distance between two IDs can be represented by the exclusive-or distance. Given two nodes x and y, their logical distance is: distance(x, y) = x ⊕ y.

[0144] Thus, the resources can be allocated to the appropriate confidential computing nodes based on the logical distance. In order to allocate the requested resources of the users to the appropriate nodes, the confidential computing node needs to store the ID information, IP information, and remote attestation information of other nodes. For example, it can be represented as confidential computing node information = <ID, location, IP, remote attestation>. To reduce the storage pressure of the confidential computing node on the information of other confidential computing nodes, each confidential computing node only stores the k confidential computing node information in each subtree, and the k confidential computing node information is represented as a logical distance group. Specifically, for the i-th (i ∈ [0, 80)) logical distance group, the confidential computing node stores the k confidential computing node information within the distance range of [2 i , 2 i+1 ). Assuming that the preset number K takes the value of 4, the logical distance group list shown in Figure 6 can be obtained. Figure 6 is a schematic diagram of a logical distance group list provided by an embodiment of the present invention. Since there is only 1 confidential computing node within the distance range of [2 0 , 2 1 ), the Distance0 array only contains 1 node; since there are only 2 confidential computing nodes within the distance range of [2 1 , 2 2 ), the Distance1 array only contains 2 nodes; since there are only 2 confidential computing nodes within the distance range of [2 2 , 2 3 ), the Distance2 array only contains 2 nodes; although within the distance range of [2 79 , 2 80) There are multiple confidential computing nodes within the distance range, but each logical distance group contains at most 4 nodes, so the distance79 array contains only 4 nodes. The data stored in the triples in each logical distance group (Distance i, i∈[0,80)) is determined according to the usage of node resources. The node with the most recently used resources is placed at the end of the logical distance group. Figure 6 The left side is the head and the right side is the tail. At this time, the confidential computing node 0 will perform remote attestation operations with these nodes, prove to each other that they and the program code are running in a trusted execution environment, and then store the remote attestation information in the triple list.

[0145] It can be imagined that distributed confidential computing resource scheduling is divided into two situations. One is that the user sends a confidential computing resource request and allocates it to the appropriate node; the other is that the load of a confidential computing node in the confidential computing set is too high and needs to be allocated to other nodes. In both cases, the two confidential computing nodes on the distributed confidential computing cluster need to store each other's remote attestation information, and then verify that each other is running in a trusted execution environment, so that the confidential computing load can be migrated to the other environment. Among them, the process of remote attestation between two confidential computing nodes is as follows: If two confidential computing nodes A and B need to perform remote attestation, first node A initiates a remote attestation challenge to node B and sends a random number to node B. Node B generates a remote attestation report in the trusted execution environment. This remote attestation report contains the random number sent by node A to prevent replay attacks; then node B sends the generated remote attestation report to node A, and node A verifies the reference value and certificate chain in the remote attestation report of node B to determine that node B itself and the program code are running in a trusted execution environment, and node A can store the remote attestation information. Similarly, the method for node B to verify node A is similar. In this way, the two nodes can establish a secure communication channel based on the remote proof information so that the confidential computing load can ensure the security of data transmission during the migration process.

[0146] In addition, nodes on a distributed confidential computing cluster may join or leave the network at any time. Therefore, the confidential computing nodes on the confidential computing cluster can dynamically update their logical distance groups.

[0147] Among them, the implementation methods of the two cases of distributed confidential computing resource scheduling are as follows:

[0148] Case 1: The user sends a request for confidential computing resources and allocates it to the appropriate node:

[0149] The user sends a computing request to confidential computing node A on the distributed confidential computing cluster, requesting that the confidential computing load be run on confidential computing node B. First, confidential computing node A obtains all its logical distance groups and queries to determine the target logical distance group closest to confidential computing node B.

[0150] 1. If confidential computing node B is in the target logical distance group, then send a command to query whether it is online. If confidential computing node B is online, then send a command to check the remaining computing resources. If the remaining computing resources of confidential computing node B are greater than the threshold, then move confidential computing node B to the end of the target logical distance group of confidential computing node A. Further, calculate the negotiation key based on the remote proof information stored between confidential computing node A and confidential computing node B, establish a secure transmission channel, and then confidential computing node A sends the user's computing request to confidential computing node B through the secure transmission channel, and executes it on confidential computing node B. Figure 7 As shown, Figure 7 This is a schematic diagram of the first resource allocation scenario provided by an embodiment of the present invention.

[0151] 2. If confidential computing node B is in the target logical distance group, then send it a command to query whether it is online. If confidential computing node B is online, then send a command to query the remaining computing resources. If the remaining computing resources of confidential computing node B are less than the threshold, then start from the head of the target logical distance group and send online query commands and resource remaining query commands. If it is online and the remaining computing resources are greater than the threshold, then this confidential computing node is called confidential computing node C and moved to the end of the team. At the same time, the negotiated key is calculated based on the remote proof information stored between confidential computing node A and confidential computing node C, and a secure transmission channel is established. Then confidential computing node A sends the user's computing request to confidential computing node C through the secure transmission channel and executes it on confidential computing node C. Figure 8 As shown, Figure 8 This is a schematic diagram of a second resource allocation scenario provided by an embodiment of the present invention.

[0152] 3. If the confidential computing node B is in the logical distance group, send a command to query whether it is online. If the confidential computing node B is not online, first remove the confidential computing node B from the target logical distance group. Then, starting from the head of the target logical distance group, send an online query command and a query command for the remaining resources. If it is online and the remaining computing resources are greater than the threshold, then this confidential computing node is called the confidential computing node C and is moved to the end of the queue. At the same time, calculate the negotiation key based on the remote attestation information stored mutually between the confidential computing node A and the confidential computing node C, establish a secure transmission channel, and then the confidential computing node A sends the user's computing request to the confidential computing node C through the secure transmission channel and executes it on the confidential computing node C.

[0153] Further, the confidential computing node C starts querying from the smallest logical distance group corresponding to itself, and the closest and online confidential computing node queried is the confidential computing node D. If the confidential computing node D belongs to the target logical distance group of the confidential computing node A, then place the confidential computing node D at the head of the target logical distance group. At the same time, perform a two-way remote attestation operation between the confidential computing node A and the confidential computing node D. The confidential computing node A stores the node information of the confidential computing node D = <ID, location, IP, remote attestation>, and the confidential computing node D only stores the remote attestation of A; as Fig. 9 shown, Fig. 9 This is a schematic diagram of the third resource allocation scenario provided by the embodiment of the present invention. If the confidential computing node D does not belong to the target logical distance group, this operation is not performed. As Fig.10 shown, Fig.10 This is a schematic diagram of the fourth resource allocation scenario provided by the embodiment of the present invention.

[0154] 4. If the information of the confidential computing node B is not in the target logical distance group and the number of nodes in the target logical distance group is less than k, then query whether the confidential computing node B is online and whether the remaining resources are greater than the threshold.

[0155] (1) If the confidential computing node B is online and the remaining resources are greater than the threshold, then directly place the confidential computing node B at the end of the target logical distance group. At the same time, perform a two-way remote attestation operation between the confidential computing node A and the confidential computing node B. The confidential computing node A stores the node information of the confidential computing node B = <ID, location, IP, remote attestation>, and the confidential computing node B only stores the remote attestation of the confidential computing node A. The two calculate the negotiation key based on the remote attestation and establish a secure transmission channel. Then, the confidential computing node A sends the user's computing request to the confidential computing node B through the secure transmission channel and executes it on the confidential computing node B.

[0156] (2) If the confidential computing node B is not online or the remaining resources are less than the threshold, then starting from the head of the target logical distance group, send an online query command and a query command for the remaining resources. If it is online and the remaining resources are greater than the threshold, then this confidential computing node is called the confidential computing node C and moved to the tail of the target logical distance group. At the same time, calculate the negotiation key based on the remote attestation information stored mutually between the confidential computing node A and the confidential computing node C, establish a secure transmission channel, and then the confidential computing node A sends the user's computing request to the confidential computing node C through the secure transmission channel and executes it on the confidential computing node C. As Fig.11 shown, Fig.11 is a schematic diagram of the fifth resource allocation scenario provided by the embodiment of the present invention.

[0157] In addition, the confidential computing node C starts querying from the smallest logical distance group corresponding to itself and queries the closest and online confidential computing node D. If the confidential computing node D belongs to the target logical distance group of the confidential computing node A, then place the confidential computing node D at the head of the target logical distance group. The confidential computing node A stores the node information of the confidential computing node D = <ID, location, IP, remote attestation>, and the confidential computing node D only stores the remote attestation of the confidential computing node A; as Fig.12 shown, Fig.12 is a schematic diagram of the sixth resource allocation scenario provided by the embodiment of the present invention. If the confidential computing node D does not belong to the target logical distance group, this operation is not performed, as Fig.13 shown, Fig.13 is a schematic diagram of the seventh resource allocation scenario provided by the embodiment of the present invention.

[0158] 5. If the confidential computing node B is not in the target logical distance group and the number of nodes in the target logical distance group has reached k, then the confidential computing node A queries the head confidential computing node C of the target logical distance group.

[0159] (1) If the confidential computing node C is online and the remaining resources are greater than the threshold, then move the confidential computing node C to the tail of the target logical distance group. At the same time, calculate the negotiation key based on the remote attestation information stored mutually between the confidential computing node A and the confidential computing node C, establish a secure transmission channel, and then the confidential computing node A sends the user's computing request to the confidential computing node C through the secure transmission channel and executes it on the confidential computing node C. As Fig.14 shown, Fig.14 is a schematic diagram of the eighth resource allocation scenario provided by the embodiment of the present invention.

[0160] (2) If the confidential computing node C is not online or the remaining resources are less than the threshold, continue to search in the direction of the tail.

[0161] Case 2: Migrate the load of computing node A, whose load exceeds the resource threshold, to other nodes:

[0162] First, confidential computing node A obtains all its logical distance groups, and then starts querying from the nearest confidential computing node. If a node that is online and has remaining computing resources greater than the threshold is found, this node is called confidential computing node C, and confidential computing node C is moved to the end of the queue of the corresponding logical distance group. At the same time, the negotiation key is calculated based on the remote proof information stored between confidential computing node A and confidential computing node C, and a secure transmission channel is established. Then, confidential computing node A migrates the confidential computing load to confidential computing node C through the secure transmission channel and executes it on confidential computing node C.

[0163] It can be seen that the resource allocation method provided by the embodiment of the present invention has the following advantages:

[0164] (1) Efficient computing load distribution can be achieved in the process of large-scale distributed confidential computing resource allocation;

[0165] (2) Each confidential computing node only needs to store a small amount of information about other nodes, without having to store information about the entire network, thereby reducing the storage pressure on each node;

[0166] (3) It can effectively deal with confidential computing nodes dynamically joining and leaving the network;

[0167] (4) It is not necessary for each node to perform two-way remote attestation operations with all other nodes, which greatly reduces the number of remote attestation operations;

[0168] (5) Confidential computing technology can protect the security of data when it is used, making the data available but invisible;

[0169] (6) Confidential computing technology can be used to establish a secure data transmission channel and achieve data transmission security.

[0170] An embodiment of the present invention provides a resource allocation device.

[0171] Please refer to Fig.15 , Fig.15 This is a schematic diagram of the structure of a resource allocation device provided by the present invention, which is applied to any node in a distributed confidential computing cluster and may include:

[0172] Determining module 1, used for determining a request node corresponding to the computing request when receiving the computing request;

[0173] Acquisition module 2, used to acquire all logical distance groups of the current node, and determine the target logical distance group closest to the request node in all logical distance groups; each logical distance group corresponding to the current node includes no more than a preset number of allocatable nodes, and the distance between each allocatable node and the current node does not exceed the distance range specified by the corresponding logical distance group; the current node pre-stores the node information of all the allocatable nodes;

[0174] A first allocation module 3, configured to allocate the computing request to the requesting node if the requesting node hits the target logical distance group;

[0175] The second allocation module 4 is used to determine the target node according to the target logical distance group if the request node does not hit the target logical distance group, and allocate the calculation request to the target node.

[0176] It can be seen that the resource allocation device provided in the embodiment of the present invention has pre-created multiple corresponding logical distance groups for each node in the distributed confidential computing cluster, and each logical distance group contains no more than a preset number of allocable nodes within the specified distance range relative to the current node, that is, different logical distance groups correspond to different distance ranges. Therefore, when a computing request for a requesting node is received, the target logical distance group closest to the requesting node can be determined in all logical distance groups corresponding to the current node, and the computing request can be allocated to the corresponding node for request processing according to the hit situation of the requesting node in the target logical distance group. It can be seen that each node in the distributed confidential computing cluster only needs to store a small amount of node information of other nodes, and does not need to store the node information of all other nodes, which not only effectively reduces the node storage pressure, but also greatly reduces the remote proof operation between nodes, and realizes efficient distributed confidential computing resource allocation.

[0177] In one embodiment of the present invention, the first allocation module 3 may include:

[0178] an acquisition unit, configured to acquire a network status of a requesting node if the requesting node hits a target logical distance group;

[0179] A first allocation unit, configured to select a target allocatable node in a target logical distance group and allocate the computing request to the target allocatable node if the network status of the requesting node is an offline status;

[0180] The second allocation unit is used to allocate the computing request to the requesting node if the network status of the requesting node is online.

[0181] In one embodiment of the present invention, the above-mentioned second allocation unit can be specifically used to obtain the available resources of the requesting node if the network status of the requesting node is online; if the available resources of the requesting node do not reach the preset threshold, select the target allocatable node in the target logical distance group, and allocate the computing request to the target allocatable node; if the available resources of the requesting node reach the preset threshold, allocate the computing request to the requesting node.

[0182] In one embodiment of the present invention, the first allocation unit may be specifically configured to select an allocatable node whose network status is online and whose available resources reach a preset threshold as a target allocatable node within the target logical distance group; and allocate the computing request to the target allocatable node.

[0183] In one embodiment of the present invention, the first allocation module 3 may further include a deleting unit, which is used to delete the requesting node in the target logical distance group if the network status of the requesting node is offline.

[0184] In one embodiment of the present invention, the above-mentioned first allocation module 3 may also include an adding unit, which is used to determine all logical distance groups of the target allocatable node, and determine the nearest distance node corresponding to the target allocatable node in all logical distance groups; if the nearest distance node hits the target logical distance group, the nearest distance node is added to the target logical distance group.

[0185] In one embodiment of the present invention, the second allocation module 4 may include:

[0186] A determination unit, configured to determine whether the number of assignable nodes in the target logical distance group reaches a preset number if the requesting node does not hit the target logical distance group;

[0187] A third allocation unit is used to add the requesting node to the target logical distance group and use it as a target node if the preset number is not reached, and allocate the computing request to the target node;

[0188] The fourth allocation unit is used to select a target node in the target logical distance group and allocate the computing request to the target node if the preset number is reached.

[0189] In one embodiment of the present invention, the above-mentioned third allocation unit can be specifically used to add the requesting node to the target logical distance group and serve as the target node if the network status of the requesting node is online and the available resources reach a preset threshold, and allocate the computing request to the target node; if the network status of the requesting node is offline, or the available resources do not reach the preset threshold, select the target node in the target logical distance group and allocate the computing request to the target node.

[0190] In one embodiment of the present invention, the third allocation unit may also be used to select a target node in the target logical distance group if the network status of the requesting node is offline, or the available resources do not reach a preset threshold, and allocate the calculation request to the target node, determine all logical distance groups of the target node, and determine the nearest distance node corresponding to the target node in all logical distance groups; if the nearest distance node hits the target logical distance group, the nearest distance node is added to the target logical distance group.

[0191] In one embodiment of the present invention, the fourth allocation unit may be specifically configured to select an allocatable node whose network status is online and whose available resources reach a preset threshold as a target node within the target logical distance group; and allocate the computing request to the target node.

[0192] In one embodiment of the present invention, for each node in the distributed confidential computing cluster, all logical distance groups corresponding to the node are obtained according to the logical topology network corresponding to the node, and the logical topology network is obtained by constructing a binary tree according to the distance between the node and other nodes in the distributed confidential computing cluster;

[0193] In the logical topology network corresponding to the current node, nodes in each subtree that do not exceed a preset number are combined into a logical distance group corresponding to the current node.

[0194] In one embodiment of the present invention, the node information includes remote proof; the first allocation module 3 may include:

[0195] a negotiation unit, configured to negotiate a session key with the requesting node according to the remote proof if the requesting node hits the target logical distance group;

[0196] The encryption unit is used to encrypt the computing request using the session key to obtain the encrypted computing request;

[0197] The allocation unit is used to allocate encryption computing requests to requesting nodes.

[0198] In one embodiment of the present invention, the node information also includes node ID, node IP, and node location; the above-mentioned allocation unit can be specifically used to allocate the encryption calculation request to the requesting node according to the node ID, node IP, and node location.

[0199] In one embodiment of the present invention, the node ID includes encoding information of the node location and hash information of the node IP.

[0200] In one embodiment of the present invention, the resource allocation device may also include a remote proof module, which is used to initiate a remote proof challenge to the requesting node and send a random number to the requesting node so that the requesting node responds to the remote proof challenge to generate a requesting node remote proof containing a random number; obtain the requesting node remote proof for verification, and save the requesting node remote proof when the verification passes.

[0201] In one embodiment of the present invention, the resource allocation device may also include a migration module for acquiring local available resources in real time; if the local available resources are lower than a preset threshold, determining the nearest node in all logical distance groups of the current node; and migrating the node load in the current node to the nearest node.

[0202] For an introduction to the device provided in the embodiment of the present invention, please refer to the above method embodiment, and the present invention will not be elaborated here.

[0203] An embodiment of the present invention provides an electronic device.

[0204] Please refer to Fig.16 , Fig.16 This is a schematic diagram of the structure of an electronic device provided by the present invention, and the electronic device may include:

[0205] A memory 11, used for storing computer programs;

[0206] The processor 10 can implement the steps of any one of the above resource allocation methods when being used to execute a computer program.

[0207] like Fig.16 , which is a schematic diagram of the composition structure of an electronic device, the electronic device may include: a processor 10, a memory 11, a communication interface 12 and a communication bus 13. The processor 10, the memory 11 and the communication interface 12 all communicate with each other through the communication bus 13.

[0208] In the embodiment of the present invention, the processor 10 may be a central processing unit (CPU), an application specific integrated circuit, a digital signal processor, a field programmable gate array or other programmable logic devices.

[0209] The processor 10 may call a program stored in the memory 11. Specifically, the processor 10 may execute operations in the embodiment of the resource allocation method.

[0210] The memory 11 is used to store one or more programs, which may include program codes, and the program codes include computer operation instructions. In the embodiment of the present invention, the memory 11 at least stores programs for implementing the following functions:

[0211] When receiving a computing request, determining a requesting node corresponding to the computing request;

[0212] Obtain all logical distance groups of the current node, and determine the target logical distance group closest to the request node among all logical distance groups; each logical distance group corresponding to the current node includes no more than a preset number of allocatable nodes, and the distance between each allocatable node and the current node does not exceed the distance range specified by the corresponding logical distance group; the current node pre-stores the node information of all the allocatable nodes;

[0213] If the requesting node hits the target logical distance group, the computing request is assigned to the requesting node;

[0214] If the requesting node does not hit the target logical distance group, the target node is determined according to the target logical distance group, and the computing request is allocated to the target node.

[0215] In a possible implementation, the memory 11 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function, etc.; the data storage area may store data created during use.

[0216] In addition, the memory 11 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device or other volatile solid-state storage device.

[0217] The communication interface 12 may be an interface of a communication module, and is used to connect to other devices or systems.

[0218] Of course, it should be noted that Fig.16 The structure shown does not constitute a limitation on the electronic device in the embodiment of the present invention. In actual applications, the electronic device may include Fig.16 More or fewer components than shown, or combinations of certain components.

[0219] An embodiment of the present invention provides a non-volatile storage medium.

[0220] The non-volatile storage medium provided in the embodiment of the present invention stores a computer program, and when the computer program is executed by a processor, the steps of any one of the above-mentioned resource allocation methods can be implemented.

[0221] Among them, the non-volatile storage medium can be any available medium that can be stored by a computer or a data storage device such as a server or data center that includes one or more available media integrated. For example, it can be a magnetic medium (such as a floppy disk, hard disk, magnetic tape, etc.), an optical medium (such as a DVD) or a semiconductor medium (such as a solid-state hard disk) and other media that can store computer program codes.

[0222] For an introduction to the non-volatile storage medium provided in the embodiment of the present invention, please refer to the above method embodiment, and the present invention will not be elaborated here.

[0223] An embodiment of the present invention provides a computer program product.

[0224] The computer program product provided by the embodiment of the present invention includes a computer program / instruction. When the computer program / instruction is executed by a processor, the steps of any one of the above-mentioned resource allocation methods can be implemented.

[0225] Specifically, in the above embodiments, all or part of them can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of them can be implemented in the form of a computer program product.

[0226] Among them, the computer program product may include one or more computer programs / instructions, and when the computer program / instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention may be generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions may be stored in a non-volatile storage medium, or transmitted from one non-volatile storage medium to another non-volatile storage medium. For example, computer instructions may be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line, etc.) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0227] For an introduction to the computer program product provided by the embodiment of the present invention, please refer to the above method embodiment, and the present invention will not be elaborated here.

[0228] The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0229] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0230] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0231] The technical solution provided by the present invention is described in detail above. Specific examples are used herein to illustrate the principle and implementation of the present invention, and the description of the above embodiments is only used to help understand the method of the present invention and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principle of the present invention, the present invention can also be improved and modified, and these improvements and modifications also fall within the scope of protection of the present invention.

Claims

1. A resource allocation method, characterized in that: Applied to any node in a distributed confidential computing cluster, the method includes: When receiving a computing request, determining a requesting node corresponding to the computing request; Acquire all logical distance groups of the current node, and determine the target logical distance group closest to the request node among all the logical distance groups; each logical distance group corresponding to the current node includes no more than a preset number of allocatable nodes, and the distance between each allocatable node and the current node does not exceed the distance range specified by the corresponding logical distance group; the current node pre-stores the node information of all the allocatable nodes; If the requesting node hits the target logical distance group, the computing request is allocated to the requesting node; If the requesting node does not hit the target logical distance group, determining a target node according to the target logical distance group, and allocating the computing request to the target node; Among them, if the request node does not hit the target logical distance group, the target node is determined according to the target logical distance group, and the computing request is allocated to the target node, including: if the request node does not hit the target logical distance group, it is determined whether the number of allocatable nodes in the target logical distance group reaches the preset number; if the preset number is not reached, the request node is added to the target logical distance group and used as the target node, and the computing request is allocated to the target node; if the preset number is reached, the target node is selected in the target logical distance group, and the computing request is allocated to the target node.

2. The resource allocation method according to claim 1, characterized in that: If the requesting node hits the target logical distance group, allocating the computing request to the requesting node includes: If the requesting node hits the target logical distance group, obtaining the network status of the requesting node; If the network state of the requesting node is offline, selecting a target allocatable node in the target logical distance group, and allocating the computing request to the target allocatable node; If the network status of the requesting node is online, the computing request is allocated to the requesting node.

3. The resource allocation method according to claim 2, characterized in that: If the network state of the requesting node is online, allocating the computing request to the requesting node includes: If the network status of the requesting node is online, obtaining available resources of the requesting node; If the available resources of the requesting node do not reach a preset threshold, selecting a target allocatable node in the target logical distance group, and allocating the computing request to the target allocatable node; If the available resources of the requesting node reach the preset threshold, the computing request is allocated to the requesting node.

4. The resource allocation method according to claim 2, characterized in that: Selecting a target allocatable node in the target logical distance group and allocating the computing request to the target allocatable node comprises: In the target logical distance group, select an allocatable node whose network status is online and whose available resources reach a preset threshold as the target allocatable node; The computing request is allocated to the target allocatable node.

5. The resource allocation method according to claim 2, characterized in that: Also includes: If the network status of the requesting node is offline, the requesting node is deleted from the target logical distance group.

6. The resource allocation method according to claim 5, characterized in that: Also includes: Determine all logical distance groups of the target allocatable node, and determine the closest distance node corresponding to the target allocatable node in all the logical distance groups; If the closest distance node hits the target logical distance group, the closest distance node is added to the target logical distance group.

7. The resource allocation method according to claim 1, characterized in that: Adding the requesting node to the target logical distance group as the target node, and allocating the computing request to the target node, comprises: If the network status of the requesting node is online and the available resources reach a preset threshold, the requesting node is added to the target logical distance group and used as the target node, and the computing request is allocated to the target node; If the network status of the requesting node is offline, or the available resources do not reach a preset threshold, the target node is selected within the target logical distance group, and the computing request is allocated to the target node.

8. The resource allocation method according to claim 7, characterized in that: If the network state of the requesting node is offline, or the available resources do not reach a preset threshold, then after selecting the target node in the target logical distance group and allocating the computing request to the target node, the method further includes: Determine all logical distance groups of the target node, and determine the closest distance node corresponding to the target node in all the logical distance groups; If the closest distance node hits the target logical distance group, the closest distance node is added to the target logical distance group.

9. The resource allocation method according to claim 1, characterized in that: Selecting the target node in the target logical distance group and allocating the computing request to the target node comprises: In the target logical distance group, select an allocatable node whose network status is online and whose available resources reach a preset threshold as the target node; The computing request is distributed to the target node.

10. The resource allocation method according to claim 1, characterized in that: For each node in the distributed confidential computing cluster, all logical distance groups corresponding to the node are obtained according to the logical topology network corresponding to the node, and the logical topology network is obtained by constructing a binary tree according to the distance between the node and other nodes in the distributed confidential computing cluster; In the logical topology network corresponding to the current node, nodes in each subtree that do not exceed the preset number are combined into a logical distance group corresponding to the current node.

11. The resource allocation method according to any one of claims 1 to 10, characterized in that: The node information includes remote proof; if the requesting node hits the target logical distance group, the computing request is allocated to the requesting node, including: If the requesting node hits the target logical distance group, negotiating a session key with the requesting node according to the remote attestation; Encrypting the computing request using the session key to obtain an encrypted computing request; The encryption computing request is distributed to the requesting node.

12. The resource allocation method according to claim 11, characterized in that: The node information also includes node ID, node IP, and node location; Allocating the encryption computing request to the requesting node includes: The encryption computing request is distributed to the requesting node according to the node ID, the node IP, and the node location.

13. The resource allocation method according to claim 12, characterized in that: The node ID includes the encoding information of the node location and the hash information of the node IP.

14. The resource allocation method according to claim 11, characterized in that: Also includes: Initiating a remote attestation challenge to the requesting node, and sending a random number to the requesting node, so that the requesting node responds to the remote attestation challenge to generate a requesting node remote attestation including the random number; The remote certificate of the requesting node is obtained for verification, and the remote certificate of the requesting node is saved when the verification passes.

15. The resource allocation method according to claim 1, characterized in that: Also includes: Get local available resources in real time; If the local available resources are lower than a preset threshold, determining the nearest node in all logical distance groups of the current node; Migrate the node load in the current node to the nearest node.

16. A resource allocation device, characterized in that: Applied to any node in a distributed confidential computing cluster, the device comprises: A determination module, configured to, when receiving a computing request, determine a requesting node corresponding to the computing request; An acquisition module, used for acquiring all logical distance groups of the current node, and determining the target logical distance group closest to the request node among all the logical distance groups; each logical distance group corresponding to the current node includes no more than a preset number of assignable nodes, and the distance between each assignable node and the current node does not exceed the distance range specified by the corresponding logical distance group; the current node pre-stores the node information of all the assignable nodes; A first allocation module, configured to allocate the computing request to the requesting node if the requesting node hits the target logical distance group; A second allocation module, configured to determine a target node according to the target logical distance group and allocate the computing request to the target node if the requesting node does not hit the target logical distance group; Among them, the second allocation module is specifically used to determine whether the number of allocatable nodes in the target logical distance group reaches the preset number if the request node does not hit the target logical distance group; if it does not reach the preset number, the request node is added to the target logical distance group and used as the target node, and the computing request is allocated to the target node; if it reaches the preset number, the target node is selected in the target logical distance group, and the computing request is allocated to the target node.

17. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the resource allocation method according to any one of claims 1 to 15 when executing the computer program.

18. A non-volatile storage medium, characterized in that: The non-volatile storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the resource allocation method according to any one of claims 1 to 15 are implemented.

19. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the resource allocation method according to any one of claims 1 to 15 are implemented.

Images