Safe operation processing method and electronic device of edge device of smart grid

Abstract

The present invention discloses a method for processing the safe operation of edge devices of a smart grid and an electronic device. Relating to the field of smart grids, the method comprises: determining a plurality of data processing units included in a target edge device in the smart grid; obtaining container indicators corresponding to the plurality of data processing units, and sending the container indicators corresponding to the plurality of data processing units to a data center in the smart grid; constructing a target micro-application container corresponding to a target micro-application based on an orchestration scheme sent by the data center, and deploying the target micro-application container to a target data processing unit; and running the target micro-application container using a target data processing unit based on a first container indicator. The present invention solves the technical problem that the security protection of target edge devices of a power grid is mainly performed by setting up a security isolation device and a multi-star gateway in the related art, resulting in a large number of devices on the edge side of the power grid, high pressure on operation and maintenance, and poor data security protection effect.

Description

Technical Field

[0001] The present invention relates to the field of smart grids, and in particular to a method for processing safe operation of edge devices of a smart grid and electronic equipment. Background Art

[0002] At present, relevant technologies have paid attention to the security protection of big data and data assets, but there is a relative lack of dynamic security protection mechanisms for circulating data. Data circulation security protection measures in relevant technologies, such as external data gateways and deployment of additional access control software, have some problems, including increased operation and maintenance workload, high computing power overhead and poor compatibility. On the edge side of the smart grid, commonly used security isolation devices and multi-star gateways are used to protect edge devices. Although they can provide certain security guarantees, they belong to external or reinforced modes, increase the number of network devices, increase operation and maintenance pressure, and do not have the ability to elastically expand boundaries and dynamic defense capabilities. In addition, these methods do not have data security protection functions. On the distribution side, large-scale deployment of edge IoT agents also has obvious security risks due to insufficient computing power and lack of security protection capabilities.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present invention provide a safe operation processing method and electronic device for edge devices of a smart grid, so as to at least solve the technical problem that the security protection of target edge devices of the power grid is mainly performed by setting up safety isolation devices and multi-star gateways in the related technology, resulting in a large number of devices on the edge side of the power grid, heavy operation and maintenance pressure, and poor data security protection effect.

[0005] According to one aspect of an embodiment of the present invention, a method for secure operation processing of an edge device of a smart grid is provided, comprising: determining a plurality of data processing units included in a target edge device in the smart grid; obtaining container indicators corresponding to the plurality of data processing units, and sending the container indicators corresponding to the plurality of data processing units to a data center in the smart grid, wherein the container indicators are used to indicate resources allocated to a deployed micro-application container in the corresponding data processing unit; receiving an orchestration scheme of a target micro-application sent by the data center, wherein the orchestration scheme is obtained by the data center based on the container indicators corresponding to the plurality of data processing units, and the security application requirements of the target edge device; the orchestration scheme is at least used to indicate a first container indicator allocated to a target micro-application container corresponding to the target micro-application, and a deployment location of the target micro-application; based on the orchestration scheme, constructing the target micro-application container, and deploying the target micro-application container to a target data processing unit among the plurality of data processing units; based on the first container indicator, using the target data processing unit to run the target micro-application container.

[0006] According to another aspect of an embodiment of the present invention, a safe operation processing device for an edge device of a smart grid is also provided, comprising: a determination module, for determining a plurality of data processing units included in a target edge device in the smart grid; an acquisition module, for acquiring container indicators corresponding to the plurality of data processing units, and sending the container indicators corresponding to the plurality of data processing units to a data center in the smart grid, wherein the container indicators are used to indicate resources allocated to a deployed micro-application container in the corresponding data processing unit; a receiving module, for receiving an orchestration scheme of a target micro-application sent by the data center, wherein the orchestration scheme is obtained by the data center based on the container indicators corresponding to the plurality of data processing units, and the security application requirements of the target edge device; the orchestration scheme is at least used to indicate a first container indicator allocated to a target micro-application container corresponding to the target micro-application, and a deployment location of the target micro-application; a construction module, for constructing the target micro-application container based on the orchestration scheme, and deploying the target micro-application container to a target data processing unit among the plurality of data processing units; and a running module, for running the target micro-application container using the target data processing unit based on the first container indicator.

[0007] According to another aspect of an embodiment of the present invention, a non-volatile storage medium is provided, wherein the non-volatile storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executed by a processor of any one of the methods for safe operation processing of an edge device of a smart grid.

[0008] According to another aspect of an embodiment of the present invention, there is also provided an electronic device, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any one of the methods for safe operation processing of an edge device of a smart grid.

[0009] In an embodiment of the present invention, a plurality of data processing units included in a target edge device in a smart grid is determined; container indicators corresponding to the plurality of data processing units are obtained, and the container indicators corresponding to the plurality of data processing units are sent to a data center in the smart grid, wherein the container indicators are used to indicate resources allocated to a deployed micro-application container in the corresponding data processing unit; an orchestration scheme of a target micro-application sent by the data center is received, wherein the orchestration scheme is obtained by the data center based on the container indicators corresponding to the plurality of data processing units, and the security application requirements of the target edge device; the orchestration scheme is at least used to indicate a first container indicator allocated to a target micro-application container corresponding to the target micro-application, and the target micro-application container; The target micro-application container is constructed based on the orchestration scheme, and the target micro-application container is deployed to the target data processing unit among the multiple data processing units; based on the first container indicator, the target data processing unit is used to run the target micro-application container, so as to achieve the purpose of deploying micro-applications related to security application requirements through container deployment without adding hardware equipment, thereby achieving the technical effect of improving the operating safety of edge devices while reducing the load pressure on the edge side of the smart grid, and further solving the technical problem that the security protection of the target edge devices of the power grid is mainly carried out by setting up safety isolation devices and multi-star gateways in the related technologies, resulting in a large number of devices on the edge side of the power grid, heavy operation and maintenance pressure, and poor data security protection effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0011] Figure 1 is a flow chart of a method for processing safe operation of an edge device of a smart grid according to an embodiment of the present invention;

[0012] Figure 2 is an optional container migration flow chart according to an embodiment of the present invention;

[0013] Figure 3is a flow chart of another method for processing safe operation of an edge device of a smart grid according to an embodiment of the present invention;

[0014] Figure 4 is a flow chart of another method for processing safe operation of an edge device of a smart grid according to an embodiment of the present invention;

[0015] Figure 5 is a schematic diagram of an optional system architecture according to an embodiment of the present invention;

[0016] Figure 6 is a flow chart of an optional method for processing safe operation of an edge device of a smart grid according to an embodiment of the present invention;

[0017] Figure 7 It is a structural schematic diagram of a safe operation processing device of an edge device of a smart grid according to an embodiment of the present invention. DETAILED DESCRIPTION

[0018] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0019] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0020] According to an embodiment of the present invention, an embodiment of a method for secure operation processing of edge devices of a smart grid is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0021] Figure 1is a flow chart of a method for processing safe operation of an edge device of a smart grid according to an embodiment of the present invention. Figure 1 As shown, the method comprises the following steps:

[0022] Step S102, determining a plurality of data processing units included in a target edge device in a smart grid;

[0023] Optionally, the target edge device is any edge device among multiple edge devices on the edge side of the smart grid, which may include but is not limited to smart devices and sensors at the edge of the smart grid, used for real-time monitoring of the smart grid status, data collection, remote control and other functions. The edge device transmits real-time data to the data center for processing and analysis through a connection with the data center. In the smart grid, the edge device plays a bridge between the physical grid and the digital system, helping to achieve real-time monitoring and intelligent control of the grid.

[0024] Optionally, in the target edge device, a data processing unit (DPU) is a device or component used to process data and perform computing tasks, which can be used to process and analyze data locally on the device, reduce data transmission latency, and improve data security. The data processing unit is mainly responsible for processing the data collected by the device, performing local computing tasks, preprocessing and preliminary analysis of the data, and then transmitting the processed data to the data center in the smart grid for further processing and storage.

[0025] Step S104, obtaining container indicators corresponding to the multiple data processing units respectively, and sending the container indicators corresponding to the multiple data processing units respectively to the data center in the smart grid, wherein the container indicators are used to indicate resources allocated to the deployed micro-application containers in the corresponding data processing units;

[0026] Optionally, the data center plays a role in centralized management and data processing in the smart grid. The data center is responsible for collecting, storing, and analyzing various data in the power system, including grid status, load conditions, energy production and consumption data, etc. The container indicator is used to indicate the resources allocated to the deployed micro-application container in the corresponding data processing unit, which may include but is not limited to memory resources and CPU resources allocated to the corresponding micro-application container, wherein the memory resources may include but are not limited to memory utilization and memory allocation size; the CPU resources may include but are not limited to CPU core occupancy, CPU time, CPU utilization and other computing resources. Among them, the memory utilization is used to indicate the proportion of time that the micro-application in the corresponding micro-application container is using the memory. The CPU utilization indicates the proportion of time that the micro-application in the corresponding micro-application container is using the CPU; the CPU time refers to the time that the micro-application in the corresponding micro-application container executes the corresponding task (such as a computing task) on the CPU; the number of CPU core occupancy indicates the number of CPU cores occupied by the micro-application in the corresponding micro-application container to execute the corresponding task (such as a computing task) on the CPU.

[0027] A micro-application container is an environment for hosting and running micro-applications. A micro-application is a lightweight application that can be composed of multiple independent functional modules and run on different platforms and devices. The micro-application container provides a unified platform for users to easily access and manage various micro-applications, where the micro-application container deployed in each data processing unit can be, but is not limited to, a Docker micro-application container. Through this container indicator, the resource usage of each data processing unit in the target edge device can be presented, so that the target micro-application to be deployed subsequently can be deployed to a more appropriate data processing unit location.

[0028] Step S106, receiving the orchestration scheme of the target micro-application sent by the data center, wherein the orchestration scheme is obtained by the data center based on the container indicators corresponding to the multiple data processing units, and the security application requirements of the target edge device; the orchestration scheme is at least used to indicate the first container indicator allocated to the target micro-application container corresponding to the target micro-application, and the deployment location of the target micro-application;

[0029] Optionally, the security application requirement is the security protection requirement of the corresponding target edge device during operation, so that the target edge device has corresponding security protection capabilities, wherein the security application requirement includes at least one of the following: identity authentication, access control, data encryption, and data transmission.

[0030] Optionally, after receiving the container indicators corresponding to the multiple data processing units sent by the target micro-application, the data center will determine the target micro-application that needs to be allocated to the target edge device and the first container indicator allocated to the target micro-application based on the security application requirements of the target edge device. The first container indicator is used to indicate the container indicator of the target micro-application container allocated to the target micro-application. Further, based on the container indicators corresponding to the multiple data processing units received, the deployment location of the newly added micro-application (such as the target micro-application) in the target edge device is determined, that is, to which data processing unit of the target edge device the target micro-application is deployed, so that the allocated data processing unit can meet the actual operation requirements of the target micro-application.

[0031] Step S108, constructing a target micro-application container based on the orchestration scheme, and deploying the target micro-application container to a target data processing unit among the multiple data processing units;

[0032] Optionally, after receiving the orchestration plan corresponding to the target micro-application returned by the data center, the target micro-application can be containerized based on the orchestration plan, a target micro-application container for executing the target micro-application can be constructed, and the target micro-application can be deployed to the corresponding data processing unit, i.e., the target data processing unit, to realize the deployment and operation of the target micro-application in a containerized form.

[0033] Optionally, the target micro-application is one or more of an identity authentication micro-application, an access control micro-application, a data encryption micro-application, and a data transmission micro-application.

[0034] Step S110: Based on the first container indicator, use the target data processing unit to run the target micro-application container.

[0035] Optionally, when the target micro-application is running, the target micro-application is run through the target data processing unit based on the computing resources such as memory allocated to the target micro-application container indicated in the first container indicator, the number of CPU cores occupied, CPU time, CPU utilization, etc. The above method can achieve the purpose of deploying micro-applications related to security application requirements through container deployment without adding hardware equipment, while reducing the load pressure on the edge side of the smart grid and improving the operating safety of edge devices.

[0036] In an optional embodiment, the method further includes: in the process of running the target micro-application container using the target data processing unit based on the first container indicator, detecting whether the first container indicator matches the workload of the target micro-application container, wherein the workload is used to indicate the amount of resources required to occupy the target micro-application container when executing the corresponding business; in the case where the first container indicator does not match the workload, obtaining a second container indicator based on the difference between the workload and the first container indicator; based on the second container indicator, running the target micro-application container using the target data processing unit.

[0037] Optionally, during the operation of the target micro-application, it is detected in real time whether the first container indicator allocated to the target micro-application container matches the workload of the target micro-application. If the workload does not match the actual workload requirement, for example, the first container indicator allocated to the target micro-application cannot meet the actual workload requirement of the target micro-application container, or the first container indicator allocated to the target micro-application exceeds the actual workload requirement of the target micro-application container to a certain extent, it is necessary to reallocate a new container indicator, i.e., a second container indicator, to the target micro-application container based on the difference between the first container indicator and the workload, so that the reallocated second container indicator can better meet the actual operation needs of the target micro-application container. In the above manner, the resources such as CPU and memory allocated to each micro-application container can be expanded and reduced according to the workload of the micro-application, so as to achieve flexible configuration of the container indicator corresponding to the micro-application container.

[0038] Optionally, the monitoring system collects container metrics of deployed containers (such as target micro-application containers) in the corresponding data processing unit (such as the target data processing unit) by directly interacting with the Docker container's control group (Docker cgroups) file system. Specifically, the resource usage and restrictions of the container can be collected, and the CPU usage can be checked by using the Docker RESTful API of the Docker presentation layer; the current memory size and current memory utilization allocated to each Docker container can be checked by viewing the Docker cgroups file system. Similarly, CPU parameters such as the number of CPU cores occupied and the CPU time can be checked. Due to the nature of the workload, the CPU and memory utilization may sometimes fluctuate rapidly. The monitoring system can measure the CPU and memory utilization every 4 seconds within an interval of 16 seconds, and then use the average value as the current CPU and memory utilization. The monitored parameters and specific values ​​are shown in Table 1. According to the above-obtained detection parameters and specific values, the matching between the container metrics of the deployed containers (such as the target micro-application containers) in the corresponding data processing unit (such as the target data processing unit) and the corresponding workload can be determined.

[0039] Table 1 Monitoring indicators

[0040]

[0041] In an optional embodiment, detecting whether the first container indicator matches the workload of the target micro-application container includes: determining a first indicator threshold based on the first container indicator; calculating the difference between the workload and the first indicator threshold; when the difference is within a preset value range, determining that the first container indicator matches the workload; when the difference is not within the preset value range, determining that the first container indicator does not match the workload.

[0042] Optionally, the first indicator threshold is determined based on the container indicator (i.e., the first container indicator) allocated to the target micro-application container. The first indicator threshold can be understood as a dynamic indicator, that is, when the first container indicator is different, the corresponding first indicator threshold will change according to the size of the first container indicator. An elastic controller can be set, based on which the resources such as CPU and memory allocated to the target micro-application container can be adjusted according to the workload of the target micro-application container, such as container indicators such as memory utilization, CPU time, CPU utilization, and the number of CPU cores occupied. Specifically, the decision to expand or reduce the container indicator corresponding to the target micro-application container can be implemented by directly modifying the Docker cgroups file system of the target micro-application container, wherein cgroups is a resource management mechanism provided by the Linux kernel, which can perform resource restrictions, priority control, and statistics on process groups to achieve effective management and allocation of system resources.

[0043] For example, by directly modifying the Docker cgroups file system, the decision to expand or shrink is implemented. In the Docker container, the cgroups file system is used to assign resource limits to the container, such as limiting the CPU, memory and other resources that the container can use, and monitoring the resource usage of the container. This can effectively manage and protect the container while ensuring that the resources of the host are reasonably allocated and utilized. Specifically, the memory size can be increased or decreased according to the memory usage and threshold. The upper threshold of the memory can be set to 90%, and the lower threshold can be set to 70%. Once the memory utilization exceeds the upper threshold, the memory space will be expanded by 256 megabytes (MB). If the current memory is too much, the memory will be reduced by 128MB. It is worth noting that the memory size needs to be reduced in a small amount during the shrinking process, because the application is more sensitive to memory resources, and the shrinking process may cause the application function to be interrupted. In addition, a specific time can be waited after each expansion decision to give the system a chance to reach a stable state after each expansion decision.

[0044] Optionally, the elastic controller can also control the CPU time by changing the Completely Fair Scheduler (CFS) parameters, i.e. the first parameter and the second parameter , referred to as and For example, if the first parameter Set to 100000, the second parameter If the target microapp container is allocated with two CPU cores and the first parameter is , the second parameter , which means that the target microapp container can fully use both CPU cores. The elasticity controller increases the second parameter quota or CPU usage percentage based on the CPU usage and dynamic threshold of the target microapp container. For example, if the target microapp container uses 10% of the CPU time, the threshold will be 9.5%, 20% of the CPU time, the threshold will be 19%, and so on. Once the target microapp container uses all the CPU time, new CPU cores will be added. The upper threshold for adding CPU cores can be set to 90%, and the lower threshold can be set to 70%. If the CPU usage falls below the lower threshold, the corresponding CPU core will be removed. However, suppose the target microapp container is allocated three CPU cores, and , CPU usage is less than 70%, and container metric reduction decisions can be made based on the following conditions: and and ,in is the amount of CPU allocated to the container. Similar to memory, CPU adjustments also set a wait time. It is important to note that the available resources on the data processing unit and the resources allocated by other containers need to be considered in each scale-up / scale-down decision.

[0045] In an optional embodiment, a second container indicator is obtained based on the difference between the workload and the first container indicator, including: when the difference is greater than the upper limit of a preset value range, determining the indicator increase based on the difference, and obtaining the second container indicator based on the first container indicator and the indicator increase, wherein the upper limit is greater than 0; or when the difference is less than the lower limit of the preset value range, determining the indicator decrease based on the difference, and obtaining the second container indicator based on the first container indicator and the indicator decrease, wherein the lower limit is less than 0.

[0046] Optionally, when the difference between the first container indicator of the target micro-application container and the first indicator threshold is large and greater than the upper limit of the preset value range (such as the difference is positive), it indicates that the first container indicator currently allocated to the target micro-application container cannot meet the workload requirements of the target micro-application. At this time, it is necessary to increase the resources allocated to the target micro-application so that the newly allocated second container indicator can meet the workload operation requirements. Specifically, the indicator increase amount can be determined based on the difference between the workload and the first container indicator. For example, the difference can be multiplied by the corresponding proportional coefficient (such as 1.2) to obtain the indicator increase amount; the second container indicator allocated to the target micro-application container is obtained by summing the indicator increase amount and the first container indicator previously allocated to the target micro-application container, and the target micro-application is run based on the second container indicator to better meet the workload requirements of the target micro-application container, thereby improving the operation security of the target edge device.

[0047] Optionally, when the difference between the first container indicator of the target micro-application container and the first indicator threshold is small and less than the lower limit of the preset value range (such as the difference is negative), it indicates that the first container indicator currently allocated to the target micro-application container exceeds the workload requirements of the target micro-application. At this time, it is necessary to reduce the resources allocated to the target micro-application to maximize the use of resources on each data processing unit. Specifically, the indicator reduction amount can be determined based on the difference between the workload and the first container indicator. For example, the difference can be multiplied by the corresponding proportional coefficient (such as 0.8) to obtain the indicator reduction amount; by calculating the difference between the first container indicator previously allocated to the target micro-application container and the indicator reduction amount, the second container indicator allocated to the target micro-application container is obtained. Running the target micro-application based on the second container indicator can maximize the use of resources on each data processing unit while meeting the workload requirements of the target micro-application and improving the operating security of the target edge device, thereby improving resource utilization.

[0048] In an optional embodiment, a second container indicator is obtained based on the first container indicator and the indicator increase, including: determining a first threshold based on the available resources of the target data processing unit; summing the first container indicator and the indicator increase to obtain a sum result; when the sum result is less than or equal to the first threshold, obtaining the second container indicator based on the first container indicator and the indicator increase.

[0049] Optionally, the first threshold is the upper limit of available resources of the target data processing unit. When the first container indicator currently allocated to the target micro-application container cannot meet the workload requirements of the target micro-application and the resources allocated to the target micro-application need to be increased, it is necessary to determine the first container indicator and the indicator increase to sum up whether the sum result is greater than the upper limit of available resources of the target data processing unit. If it is not greater than the upper limit of available resources of the target data processing unit, it indicates that the target data processing unit currently still has the ability to run the target micro-application container. At this time, based on the first container indicator and the indicator increase, the second container indicator is obtained, and the target micro-application can continue to be run in the target data processing unit based on the second container indicator. In the above manner, the normal operation of the target micro-application container in the target data processing unit can be guaranteed.

[0050] In an optional embodiment, the method further includes: when the sum result is greater than a first threshold, based on the container indicators corresponding to the multiple data processing units and the sum result, determining the first data processing unit from the other data processing units, wherein the other data processing units are data processing units other than the target data processing unit among the multiple data processing units; migrating the target micro-application container to the first data processing unit, and using the first data processing unit to run the target micro-application container.

[0051] Optionally, if the sum of the first container index and the index increase is greater than the first threshold, it indicates that the workload of the target micro-application is greater than the upper limit of the available resources of the target data processing unit, that is, the target data processing unit does not currently have the ability to run the target micro-application container. At this time, the first data processing unit that is fully capable of running the target micro-application container is determined from the multiple data processing units of the target edge device, that is, the first data processing unit whose available resources are greater than the sum of the first container index and the index increase is determined from the multiple data processing units. Based on the first container index and the index increase, the second container index is obtained. The target micro-application container is migrated to the first data processing unit, and the target micro-application container is run in the first data unit based on the second container index. By timely detecting and migrating the target micro-application container to a data processing unit that is fully capable of running the target micro-application container, the safe and stable operation of the target micro-application container can be guaranteed, thereby improving the operational security of the target micro-application.

[0052] Optionally, one or more micro-application containers may be deployed on the target data processing unit. When the workload of the target micro-application container continues to increase and the target data processing unit cannot meet the operating requirements of the target micro-application container, that is, when the target micro-application container requests more resources but there are no more resources on the target data processing unit, the target micro-application container can be hot migrated from the source data processing unit (i.e., source DPU) to the destination data processing unit (i.e., destination DPU, such as the first data processing unit). Figure 2 is an optional container migration flow chart according to an embodiment of the present invention, such as Figure 2 As shown in the figure, first, there are many directories of image layers corresponding to the target micro-application container in the predetermined storage path, such as the advanced union file system aufs / diff / path, so these image layers need to be packaged and differentially transmitted to the destination DPU. Secondly, the container process will be pre-dumped. After the pre-dump, the container is still running, and the goal is to minimize the migration downtime. The pre-dumped image layer can be stored in a compressed file (such as a TAR file) using LZ4 compression and sent to the destination DPU. Multiple pre-dump iterations are performed during the hot migration process, and each iteration generates a set of pre-dump images, which contain the memory changes after the previous pre-dump and the amount of data dumped during the dump stage. Third, continue to dump the container state. This process only obtains the memory that has changed since the last pre-dump. On the target host, the target micro-application container is restored to the same memory state on the source host based on the checkpoint / restore in userspace (CRIU).

[0053] Among them, in Docker, the advanced union file system aufs is used to stack multiple image layers together to achieve lightweight and fast startup of containers. In aufs, each image layer is represented as a directory, which stores the files and file system information of the corresponding image layer. The "aufs / diff / " directory represents the difference (diff) part of the image layer in the aufs file system. In this directory, the difference files between the target micro-application container and its base image are stored. These files record the modifications and additions made to the container based on the base image. In the above way, Docker can efficiently manage the image layers of the container and realize the sharing and reuse of images, thereby saving storage space and speeding up the startup of the container.

[0054] In the data processing unit (DPU), CRIU is a tool and library for process snapshot and recovery in user space. The role of the CRIU component is to allow the state of a process (including memory, file descriptors, network connections, etc.) to be saved to disk and restored to the same or another host when needed. This technology makes it possible to migrate the target micro-application container without interrupting the process, or to quickly recover when the process fails.

[0055] The execution subject of the above steps S102 to S110 is the target edge device. Through the above steps S102 to S110, the purpose of deploying micro-applications related to security application requirements through container deployment can be achieved without adding hardware equipment, thereby achieving the technical effect of improving the operating safety of edge devices while reducing the load pressure on the edge side of the smart grid, and thus solving the technical problem that the security protection of the target edge devices of the power grid is mainly carried out by setting up safety isolation devices and multi-star gateways in the related technologies, resulting in a large number of devices on the edge side of the power grid, high operation and maintenance pressure, and poor data security protection effect.

[0056] According to an embodiment of the present invention, another method embodiment of a secure operation processing method for an edge device of a smart grid is also provided. Figure 3 is a flow chart of another method for processing safe operation of an edge device of a smart grid according to an embodiment of the present invention. Figure 3 As shown, the method comprises the following steps:

[0057] Step S202, obtaining security application requirements for target edge devices in the smart grid;

[0058] Optionally, the security application requirements include at least one of the following: identity authentication, access control, data encryption, and data transmission.

[0059] Step S204, obtaining container indicators corresponding to multiple data processing units included in the target edge device;

[0060] Optionally, the container indicator is an operating indicator of the micro-application container deployed in the corresponding data processing unit.

[0061] Step S206, based on the container indicators corresponding to the multiple data processing units and the security application requirements, determine the target micro-application assigned to the target edge device and the orchestration scheme of the target micro-application, wherein the orchestration scheme is at least used to indicate the first container indicator assigned to the target micro-application container corresponding to the target micro-application and the deployment location of the target micro-application;

[0062] In an optional embodiment, based on the container indicators corresponding to the multiple data processing units respectively and the security application requirements, the target micro-application assigned to the target edge device and the orchestration scheme of the target micro-application are determined, including: determining the target microservice application corresponding to the security application requirements and the first container indicator assigned to the target microservice application; based on the container indicators corresponding to the multiple data processing units respectively and the preset maximum resource amounts corresponding to the multiple data processing units respectively, determining the available resource amounts corresponding to the multiple data processing units respectively; based on the first container indicator and the available resource amounts corresponding to the multiple data processing units respectively, determining the deployment location of the target micro-application; based on the target micro-application, the first container indicator, and the deployment location of the target micro-application, generating an orchestration scheme.

[0063] Optionally, after receiving the container indicators corresponding to the multiple data processing units sent by the target micro-application, the data center will determine the target micro-application that needs to be allocated to the target edge device, and the first container indicator allocated to the target micro-application according to the security application requirements of the target edge device. The first container indicator is used to indicate the container indicator of the target micro-application container allocated to the target micro-application. Further, based on the container indicators corresponding to the multiple received data processing units, the deployment location of the newly added micro-application (such as the target micro-application) in the target edge device is determined, that is, it is determined to which data processing unit of the target edge device the target micro-application is deployed, and the orchestration scheme of the target micro-application is obtained. The orchestration scheme obtained in the above manner can not only reflect the container indicator allocation of the micro-application container corresponding to the target micro-application, but also enable the allocated data processing unit to meet the actual operation requirements of the target micro-application.

[0064] In an optional embodiment, when there are multiple target micro-applications, the deployment location of the target micro-application is determined based on the first container indicator and the available resource amounts corresponding to the multiple data processing units, including: determining the container allocation strategy as follows: preferentially allocating multiple target micro-application containers to the same data processing unit; based on the first container indicator and the available resource amounts corresponding to the multiple data processing units, determining the deployment locations corresponding to the multiple target micro-applications according to the container allocation strategy.

[0065] Optionally, when there are multiple target micro-application containers, that is, when multiple target micro-applications need to be deployed to the target edge device in a containerized manner, multiple target micro-application containers can be deployed to the corresponding data processing units according to the principle of preferentially allocating multiple target micro-application containers to the same data processing unit. The above method can improve the resource utilization of each data processing unit.

[0066] Step S208, sending the orchestration plan to the target edge device, so that the target edge device builds a target micro-application container based on the orchestration plan, and installs the target micro-application container to a target data processing unit among the multiple data processing units.

[0067] Optionally, after obtaining the orchestration plan corresponding to the target micro-application, the orchestration plan is sent to the target edge device, which can deploy the micro-application in a containerized form to the corresponding target data processing unit based on the orchestration plan, thereby achieving deployment of micro-applications related to security application requirements through container deployment without adding hardware equipment, and further achieving safe operation detection of the target edge device without adding hardware equipment.

[0068] The execution entity of the above steps S202 to S208 is the data center. Through the above steps S202 to S208, the purpose of deploying micro-applications related to security application requirements through container deployment can be achieved without adding hardware equipment, thereby achieving the technical effect of reducing the load pressure on the edge side of the smart grid while improving the operating safety of edge devices, thereby solving the technical problem in the related technology that the security protection of the target edge devices of the power grid is mainly carried out by setting up safety isolation devices and multi-star gateways, resulting in a large number of devices on the edge side of the power grid, high operation and maintenance pressure, and poor data security protection effect.

[0069] According to an embodiment of the present invention, another method embodiment of a secure operation processing method for an edge device of a smart grid is also provided. Figure 4 is a flow chart of another method for processing safe operation of an edge device of a smart grid according to an embodiment of the present invention. Figure 4 As shown, the method comprises the following steps:

[0070] Step S302, the target edge device in the smart grid determines a plurality of data processing units included therein, and obtains container indicators corresponding to the plurality of data processing units respectively;

[0071] Step S304, the target edge device sends the container indicators corresponding to the multiple data processing units to the data center in the smart grid, wherein the container indicator is the operation indicator of the micro-application container included in the corresponding data processing unit;

[0072] Step S306: The data center determines the target micro-application assigned to the target edge device and the orchestration scheme of the target micro-application based on the container indicators corresponding to the multiple data processing units and the security application requirements of the target edge device, and sends the orchestration scheme to the target edge device, wherein the orchestration scheme is at least used to indicate the first container indicator assigned to the target micro-application container corresponding to the target micro-application and the deployment location of the target micro-application;

[0073] Step S308: The target edge device builds a target micro-application container based on the orchestration solution, and deploys the target micro-application container to a target data processing unit among the multiple data processing units;

[0074] Step S310: The target edge device uses the target data processing unit to run the target micro-application container based on the first container indicator.

[0075] The execution entities of the above steps S302 to S310 are the data center and the target edge device. Through the above steps S302 to S310, the purpose of deploying micro-applications related to security application requirements through container deployment can be achieved without adding hardware equipment, thereby achieving the technical effect of reducing the load pressure on the edge side of the smart grid while improving the operating safety of the edge device, thereby solving the technical problem that the security protection of the target edge devices of the power grid is mainly carried out by setting up safety isolation devices and multi-star gateways in the related technologies, resulting in a large number of devices on the edge side of the power grid, high operation and maintenance pressure, and poor data security protection effect.

[0076] Based on the above embodiments and optional embodiments, the present invention proposes an optional implementation mode: Figure 5 is a schematic diagram of an optional system architecture according to an embodiment of the present invention, such as Figure 5 As shown, the entire system consists of a monitoring system and an elastic controller. The elastic controller can adjust the memory, number of CPU cores, and CPU usage allocated to the target micro-application container according to workload requirements. This embodiment is mainly composed of four stages: monitoring, analysis, planning, execution, and cognition. First, in the monitoring stage, the container indicators of the target micro-application container are continuously detected, where the container indicators may include but are not limited to memory, CPU occupancy, and other resources allocated to the target micro-application container; in the analysis stage, thresholds are calculated based on the monitored container indicators, and then decisions and plans are made to expand or reduce the container indicators allocated to the target micro-application container; finally, these decisions are implemented to adjust container resources according to demand. Among them,

[0077] The monitoring system directly interacts with the Docker cgroups subsystem to collect container metrics of deployed containers (such as target micro-application containers) in the corresponding data processing unit (such as the target data processing unit). Specifically, it can collect resource usage and limitations of the container, and use the Docker RESTful API of the Docker presentation layer to check CPU usage at the same time; by viewing the memory subsystem in cgroups, it can check the current memory size and current memory utilization allocated to each Docker container.

[0078] The elastic controller adjusts memory utilization, CPU time, CPU utilization, and number of CPU cores occupied based on the workload. It implements the scaling decisions by directly modifying the Docker cgroups file system.

[0079] Figure 6 is a flow chart of an optional method for processing safe operation of edge devices of a smart grid according to an embodiment of the present invention. Figure 6 As shown, the method includes:

[0080] First, in each DPU of the edge device, the memory, CPU and other resource usage and limitations of each micro-application container are collected through Docker cgroups file system interaction and calling Docker RESTful API, and this information is aggregated in the data center. The data center builds microservice applications and designs orchestration solutions based on the security application requirements of each edge device and the DPU limitations therein, and finally sends the above results to the corresponding edge devices.

[0081] After the edge device receives the corresponding micro-application, different micro-application containers are deployed in each DPU according to the orchestration scheme. When the edge device 2 receives three micro-applications such as protocol parsing, identity authentication, and access control, according to the orchestration scheme, the protocol parsing micro-application is first constructed as container A and deployed in DPU-1 to perform the protocol parsing function in a containerized form. After that, the identity authentication micro-application is packaged into container B in the same way and also deployed in DPU-1. At this time, if the protocol parsing container faces more business and needs to request more resources, but since container B is deployed in DPU-1, there are no extra resources at this time. Therefore, container A in DPU-1 needs to be migrated to DPU-n to ensure the normal execution of container A. After dumping the container image and memory page, the CRIU component in DPU-n needs to be called to restore the container to the same memory state as on DPU-1.

[0082] After the container migration, DPU-1 now has more free resources. If container B faces a large number of business requests, it is necessary to modify the cgroups file system of the container and expand the resources of container B according to the parameters in Table 1 above. After the expansion, it is necessary to wait for a corresponding time to ensure the stability of the container. Continue to deploy access control container C in DPU-n according to the orchestration plan. The access control container requires fewer resources, so there is no need to adjust the resource requirements of container A, and it can be directly deployed to the device. At this time, edge device 2 has three functions: protocol parsing, identity authentication, and access control.

[0083] It can be understood that in the embodiment of the present invention, the CPU and memory resources allocated to each micro-application container can be expanded and reduced according to the workload of the micro-application; since vertical elasticity is limited by the capacity of the DPU, when one of the DPU resources is insufficient, the container will be hot migrated based on the CRIU function in the Linux system. The embodiment of the present invention can rely on the data processor to adaptively package the data security capabilities of the edge devices of the smart grid in the form of containers and distribute them to the corresponding DPU, realizing the integration of software and hardware for data and network security.

[0084] It should be noted that in the embodiment of the present invention, the data center can flexibly deploy the endogenous security micro-applications in the form of containers to the DPU of the edge device, realize the distribution of security applications, and make the best use of the resources in each DPU. The scalability of edge devices is enhanced, and the requirements of the new power system for network, performance, and security are better met. The problems of insufficient computing power and lack of security protection capabilities of edge IoT agents on the distribution side are solved, and the potential safety hazards of equipment are eliminated.

[0085] In this embodiment, a safe operation processing device for the edge device of a smart grid is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and will not be repeated here. As used below, the terms "module" and "device" can implement a combination of software and / or hardware for predetermined functions. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0086] According to an embodiment of the present invention, there is also provided an apparatus embodiment for implementing the safe operation processing method of the edge device of the smart grid. Figure 7 is a structural diagram of a safe operation processing device for an edge device of a smart grid according to an embodiment of the present invention. Figure 7 As shown, the safe operation processing device of the edge device of the smart grid includes: a determination module 700, an acquisition module 702, a receiving module 704, a construction module 706, and an operation module 708, wherein:

[0087] A determination module 700 is used to determine a plurality of data processing units included in a target edge device in a smart grid;

[0088] An acquisition module 702, connected to the determination module 700, is used to acquire container indicators corresponding to the multiple data processing units, and send the container indicators corresponding to the multiple data processing units to a data center in the smart grid, wherein the container indicators are used to indicate resources allocated to the deployed micro-application containers in the corresponding data processing units;

[0089] The receiving module 704 is connected to the obtaining module 702 and is used to receive the orchestration scheme of the target micro-application sent by the data center, wherein the orchestration scheme is obtained by the data center based on the container indicators corresponding to the multiple data processing units and the security application requirements of the target edge device; the orchestration scheme is at least used to indicate the first container indicator allocated to the target micro-application container corresponding to the target micro-application and the deployment location of the target micro-application;

[0090] A construction module 706, connected to the receiving module 704, is used to construct a target micro-application container based on the orchestration scheme, and deploy the target micro-application container to a target data processing unit among the multiple data processing units;

[0091] The running module 708 is connected to the building module 706 and is used to run the target micro-application container using the target data processing unit based on the first container indicator.

[0092] In an embodiment of the present invention, by setting a determination module 700, an acquisition module 702, a receiving module 704, a construction module 706, and an operation module 708, the purpose of deploying micro-applications related to security application requirements through container deployment is achieved without adding hardware equipment, thereby achieving the technical effect of reducing the load pressure on the edge side of the smart grid while improving the operating safety of edge devices, and further solving the technical problem that the security protection of the target edge devices of the power grid is mainly carried out by setting up safety isolation devices and multi-star gateways in the related technologies, resulting in a large number of devices on the edge side of the power grid, heavy operation and maintenance pressure, and poor data security protection effect.

[0093] It should be noted that the above modules can be implemented by software or hardware. For example, for the latter, it can be implemented in the following ways: the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0094] It should be noted that the above-mentioned determination module 700, acquisition module 702, receiving module 704, construction module 706, and operation module 708 correspond to steps S102 to S110 in the embodiment, and the examples and application scenarios implemented by the above-mentioned modules and corresponding steps are the same, but are not limited to the contents disclosed in the above-mentioned embodiment. It should be noted that the above-mentioned modules can be run in a computer terminal as part of the device.

[0095] It should be noted that the optional or preferred implementation of this embodiment can refer to the relevant description in the embodiment, which will not be repeated here.

[0096] The above-mentioned safe operation processing device of the edge device of the smart grid may also include a processor and a memory. The above-mentioned determination module 700, acquisition module 702, receiving module 704, construction module 706, operation module 708, etc. are all stored in the memory as program modules, and the processor executes the above-mentioned program modules stored in the memory to realize the corresponding functions.

[0097] The processor includes a kernel, which retrieves the corresponding program module from the memory. The kernel may be one or more. The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. The memory includes at least one memory chip.

[0098] According to an embodiment of the present application, an embodiment of a non-volatile storage medium is also provided. Optionally, in this embodiment, the non-volatile storage medium includes a stored program, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute any of the above-mentioned methods for processing the safe operation of the edge device of the smart grid.

[0099] Optionally, in this embodiment, the non-volatile storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group, and the non-volatile storage medium includes a stored program.

[0100] Optionally, when the program is running, the device where the non-volatile storage medium is located is controlled to perform the following functions: determine multiple data processing units included in the target edge device in the smart grid; obtain container indicators corresponding to the multiple data processing units, and send the container indicators corresponding to the multiple data processing units to the data center in the smart grid, wherein the container indicators are used to indicate the resources allocated to the deployed micro-application containers in the corresponding data processing units; receive the orchestration plan of the target micro-application sent by the data center, wherein the orchestration plan is obtained by the data center based on the container indicators corresponding to the multiple data processing units, and the security application requirements of the target edge device; the orchestration plan is at least used to indicate the first container indicator allocated to the target micro-application container corresponding to the target micro-application, and the deployment location of the target micro-application; based on the orchestration plan, build a target micro-application container, and deploy the target micro-application container to the target data processing unit among the multiple data processing units; based on the first container indicator, use the target data processing unit to run the target micro-application container.

[0101] According to an embodiment of the present application, an embodiment of a processor is also provided. Optionally, in this embodiment, the processor is used to run a program, wherein when the program is run, any of the above-mentioned methods for processing safe operation of edge devices of a smart grid is executed.

[0102] According to an embodiment of the present application, an embodiment of a computer program product is also provided. When executed on a data processing device, the program is suitable for executing the steps of the safe operation processing method for initializing an edge device of a smart grid having any of the above-mentioned methods.

[0103] Optionally, the above-mentioned computer program product, when executed on a data processing device, is suitable for executing a program that initializes the following method steps: determining multiple data processing units included in a target edge device in a smart grid; obtaining container indicators corresponding to the multiple data processing units, and sending the container indicators corresponding to the multiple data processing units to a data center in the smart grid, wherein the container indicators are used to indicate the resources allocated to the micro-application containers deployed in the corresponding data processing units; receiving an orchestration scheme for a target micro-application sent by the data center, wherein the orchestration scheme is obtained by the data center based on the container indicators corresponding to the multiple data processing units, and the security application requirements of the target edge device; the orchestration scheme is at least used to indicate a first container indicator allocated to a target micro-application container corresponding to the target micro-application, and the deployment location of the target micro-application; based on the orchestration scheme, constructing a target micro-application container, and deploying the target micro-application container to a target data processing unit among multiple data processing units; based on the first container indicator, using the target data processing unit to run the target micro-application container.

[0104] An embodiment of the present invention provides an electronic device, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, the following steps are implemented: determining multiple data processing units included in a target edge device in a smart grid; obtaining container indicators corresponding to the multiple data processing units, and sending the container indicators corresponding to the multiple data processing units to a data center in the smart grid, wherein the container indicators are used to indicate resources allocated to a micro-application container deployed in the corresponding data processing unit; receiving an orchestration scheme of a target micro-application sent by the data center, wherein the orchestration scheme is obtained by the data center based on the container indicators corresponding to the multiple data processing units, and the security application requirements of the target edge device; the orchestration scheme is at least used to indicate a first container indicator allocated to a target micro-application container corresponding to the target micro-application, and the deployment location of the target micro-application; based on the orchestration scheme, constructing a target micro-application container, and deploying the target micro-application container to a target data processing unit among multiple data processing units; based on the first container indicator, using the target data processing unit to run the target micro-application container.

[0105] The above sequence of the embodiments of the present invention is for description only and does not represent the superiority or inferiority of the embodiments.

[0106] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0107] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the above modules can be a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, modules or indirect coupling or communication connection of modules, which can be electrical or other forms.

[0108] The modules described above as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment.

[0109] In addition, each functional module in each embodiment of the present invention may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of software functional modules.

[0110] If the above-mentioned integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable non-volatile storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the whole or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a non-volatile storage medium, including several instructions to enable a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the various embodiments of the present invention. The aforementioned non-volatile storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0111] The above are only preferred embodiments of the present invention. It should be pointed out that, for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for processing safe operation of edge devices of a smart grid, characterized in that: include: Determine a plurality of data processing units included in a target edge device in a smart grid; Obtain container indicators corresponding to the multiple data processing units respectively, and send the container indicators corresponding to the multiple data processing units respectively to the data center in the smart grid, wherein the container indicators are used to indicate resources allocated to the deployed micro-application containers in the corresponding data processing units; Receive an orchestration scheme of a target micro-application sent by the data center, wherein the orchestration scheme is obtained by the data center based on container indicators corresponding to the multiple data processing units, respectively, and security application requirements of the target edge device; the orchestration scheme is at least used to indicate a first container indicator allocated to a target micro-application container corresponding to the target micro-application, and a deployment location of the target micro-application; Based on the orchestration scheme, construct the target micro-application container, and deploy the target micro-application container to a target data processing unit among the multiple data processing units; Based on the first container indicator, using the target data processing unit to run the target micro-application container; The method further includes: in the process of running the target micro-application container using the target data processing unit based on the first container indicator, detecting whether the first container indicator matches the workload of the target micro-application container, wherein the workload is used to indicate the amount of resources required to be occupied by the target micro-application container when executing the corresponding business; in the case where the first container indicator does not match the workload, obtaining a second container indicator based on the difference between the workload and the first container indicator; based on the second container indicator, running the target micro-application container using the target data processing unit; The detecting whether the first container indicator matches the workload of the target micro-application container includes: determining a first indicator threshold based on the first container indicator; calculating the difference between the workload and the first indicator threshold; if the difference is within a preset value range, determining that the first container indicator matches the workload; if the difference is not within the preset value range, determining that the first container indicator does not match the workload; The obtaining of the second container index based on the difference between the workload and the first container index includes: when the difference is greater than an upper limit of the preset value range, determining an index increase based on the difference, and obtaining the second container index based on the first container index and the index increase, wherein the upper limit is greater than 0; or when the difference is less than a lower limit of the preset value range, determining an index decrease based on the difference, and obtaining the second container index based on the first container index and the index decrease, wherein the lower limit is less than 0; The obtaining of the second container index based on the first container index and the index increase includes: determining a first threshold based on the available resource amount of the target data processing unit; performing a sum operation on the first container index and the index increase to obtain a sum result; and obtaining the second container index based on the first container index and the index increase when the sum result is less than or equal to the first threshold; The method also includes: when the sum result is greater than the first threshold, based on the container indicators corresponding to the multiple data processing units respectively and the sum result, determining a first data processing unit from other data processing units, wherein the other data processing units are data processing units other than the target data processing unit among the multiple data processing units; migrating the target micro-application container to the first data processing unit, and using the first data processing unit to run the target micro-application container.

2. A method for processing safe operation of edge devices of a smart grid, characterized in that: include: Obtain security application requirements for target edge devices in smart grids; Obtain container indicators corresponding to the multiple data processing units included in the target edge device, wherein the container indicator is an operation indicator of the micro-application container deployed in the corresponding data processing unit; Based on the container indicators respectively corresponding to the multiple data processing units and the security application requirements, determine the target micro-application assigned to the target edge device and the orchestration scheme of the target micro-application, wherein the orchestration scheme is at least used to indicate the first container indicator assigned to the target micro-application container corresponding to the target micro-application and the deployment location of the target micro-application; Sending the orchestration scheme to the target edge device, so that the target edge device builds the target micro-application container based on the orchestration scheme, and installs the target micro-application container to the target data processing unit among the multiple data processing units, The target edge device is used to perform the following operations: in the process of running the target micro-application container based on the first container indicator and using the target data processing unit, detect whether the first container indicator matches the workload of the target micro-application container, wherein the workload is used to indicate the amount of resources required to be occupied by the target micro-application container when executing the corresponding business; in the case where the first container indicator does not match the workload, obtain a second container indicator based on the difference between the workload and the first container indicator; based on the second container indicator, use the target data processing unit to run the target micro-application container; The target edge device is further configured to perform the following operations: determine a first indicator threshold based on the first container indicator; calculate a difference between the workload and the first indicator threshold; determine that the first container indicator matches the workload if the difference is within a preset value range; and determine that the first container indicator does not match the workload if the difference is not within a preset value range. The target edge device is further configured to perform the following operations: when the difference is greater than an upper limit of the preset value range, determine an increase in the indicator based on the difference, and obtain the second container indicator based on the first container indicator and the increase in the indicator, wherein the upper limit is greater than 0; or when the difference is less than a lower limit of the preset value range, determine an decrease in the indicator based on the difference, and obtain the second container indicator based on the first container indicator and the decrease in the indicator, wherein the lower limit is less than 0; The target edge device is further configured to perform the following operations: determine a first threshold value based on the available resource amount of the target data processing unit; perform a sum operation on the first container index and the index increase to obtain a sum result; and obtain the second container index based on the first container index and the index increase when the sum result is less than or equal to the first threshold value; The target edge device is also used to perform the following operations: when the sum result is greater than the first threshold, based on the container indicators corresponding to the multiple data processing units respectively and the sum result, determine the first data processing unit from other data processing units, wherein the other data processing units are data processing units other than the target data processing unit among the multiple data processing units; migrate the target micro-application container to the first data processing unit, and use the first data processing unit to run the target micro-application container.

3. The method according to claim 2, characterized in that The determining, based on the container indicators respectively corresponding to the multiple data processing units and the security application requirements, the target micro-application allocated to the target edge device and the orchestration scheme of the target micro-application includes: Determine a target microservice application corresponding to the security application requirement and a first container indicator allocated to the target microservice application; Determine the available resource amounts corresponding to the multiple data processing units respectively based on the container indicators corresponding to the multiple data processing units respectively and the preset maximum resource amounts corresponding to the multiple data processing units respectively; Determine a deployment location of the target micro-application based on the first container indicator and the available resource amounts corresponding to the multiple data processing units respectively; The orchestration solution is generated based on the target micro-application, the first container indicator, and the deployment location of the target micro-application.

4. The method according to claim 3, characterized in that In the case where there are multiple target micro-applications, determining the deployment location of the target micro-applications based on the first container indicator and the available resource amounts respectively corresponding to the multiple data processing units includes: Determine the container allocation strategy as follows: preferentially allocate multiple target micro-application containers to the same data processing unit; Based on the first container indicator and the available resource amounts respectively corresponding to the multiple data processing units, the deployment locations respectively corresponding to the multiple target micro-applications are determined according to the container allocation strategy.

5. A method for processing safe operation of edge devices of a smart grid, characterized in that: include: The target edge device in the smart grid determines a plurality of data processing units included therein, and obtains container indicators respectively corresponding to the plurality of data processing units; The target edge device sends the container indicators corresponding to the multiple data processing units to the data center in the smart grid, wherein the container indicators are operation indicators of the micro-application containers included in the corresponding data processing units; The data center determines the target micro-application assigned to the target edge device and the orchestration scheme of the target micro-application based on the container indicators respectively corresponding to the multiple data processing units and the security application requirements of the target edge device, and sends the orchestration scheme to the target edge device, wherein the orchestration scheme is at least used to indicate the first container indicator assigned to the target micro-application container corresponding to the target micro-application and the deployment location of the target micro-application; The target edge device constructs the target micro-application container based on the orchestration scheme, and deploys the target micro-application container to a target data processing unit among the multiple data processing units; The target edge device uses the target data processing unit to run the target micro-application container based on the first container indicator; The method further includes: the target edge device detects whether the first container indicator matches the workload of the target micro-application container in the process of using the target data processing unit to run the target micro-application container based on the first container indicator, wherein the workload is used to indicate the amount of resources required to be occupied by the target micro-application container when executing the corresponding business; in the case where the first container indicator does not match the workload, the target edge device obtains a second container indicator based on the difference between the workload and the first container indicator; the target edge device uses the target data processing unit to run the target micro-application container based on the second container indicator; The detecting whether the first container indicator matches the workload of the target micro-application container includes: the target edge device determines a first indicator threshold based on the first container indicator; the target edge device calculates the difference between the workload and the first indicator threshold; when the difference is within a preset value range, the target edge device determines that the first container indicator matches the workload; when the difference is not within the preset value range, the target edge device determines that the first container indicator does not match the workload; The target edge device obtains the second container indicator based on the difference between the workload and the first container indicator, including: when the difference is greater than the upper limit of the preset value range, the target edge device determines the indicator increase based on the difference, and obtains the second container indicator based on the first container indicator and the indicator increase, wherein the upper limit is greater than 0; or when the difference is less than the lower limit of the preset value range, the target edge device determines the indicator decrease based on the difference, and obtains the second container indicator based on the first container indicator and the indicator decrease, wherein the lower limit is less than 0; The target edge device obtains the second container index based on the first container index and the index increase, including: the target edge device determines a first threshold based on the available resource amount of the target data processing unit; the target edge device performs a sum operation on the first container index and the index increase to obtain a sum result; when the sum result is less than or equal to the first threshold, the target edge device obtains the second container index based on the first container index and the index increase; The method also includes: when the sum result is greater than the first threshold, the target edge device determines a first data processing unit from other data processing units based on the container indicators corresponding to the multiple data processing units respectively and the sum result, wherein the other data processing units are data processing units other than the target data processing unit among the multiple data processing units; the target edge device migrates the target micro-application container to the first data processing unit, and uses the first data processing unit to run the target micro-application container.

6. A safe operation processing device for edge devices of a smart grid, characterized in that: include: A determination module, used to determine a plurality of data processing units included in a target edge device in a smart grid; An acquisition module, used to acquire container indicators corresponding to the multiple data processing units respectively, and send the container indicators corresponding to the multiple data processing units respectively to the data center in the smart grid, wherein the container indicators are used to indicate resources allocated to the deployed micro-application containers in the corresponding data processing units; A receiving module, configured to receive an orchestration scheme of a target micro-application sent by the data center, wherein the orchestration scheme is obtained by the data center based on the container indicators respectively corresponding to the multiple data processing units and the security application requirements of the target edge device; the orchestration scheme is at least used to indicate a first container indicator allocated to a target micro-application container corresponding to the target micro-application and a deployment location of the target micro-application; A construction module, configured to construct the target micro-application container based on the orchestration scheme, and deploy the target micro-application container to a target data processing unit among the multiple data processing units; An operation module, configured to operate the target micro-application container using the target data processing unit based on the first container indicator; The device is further used for: in the process of running the target micro-application container based on the first container indicator and using the target data processing unit, detecting whether the first container indicator matches the workload of the target micro-application container, wherein the workload is used to indicate the amount of resources required to be occupied by the target micro-application container when executing the corresponding business; in the case where the first container indicator does not match the workload, obtaining a second container indicator based on the difference between the workload and the first container indicator; based on the second container indicator, running the target micro-application container using the target data processing unit; The device is also used to: determine a first indicator threshold based on the first container indicator; calculate the difference between the workload and the first indicator threshold; if the difference is within a preset value range, determine that the first container indicator matches the workload; if the difference is not within the preset value range, determine that the first container indicator does not match the workload; The device is further used to: when the difference is greater than the upper limit of the preset value range, determine the index increase based on the difference, and obtain the second container index based on the first container index and the index increase, wherein the upper limit is greater than 0; or when the difference is less than the lower limit of the preset value range, determine the index decrease based on the difference, and obtain the second container index based on the first container index and the index decrease, wherein the lower limit is less than 0; The device is further configured to: determine a first threshold value based on the available resource amount of the target data processing unit; perform a sum operation on the first container index and the index increase to obtain a sum result; and obtain the second container index based on the first container index and the index increase when the sum result is less than or equal to the first threshold value; The device is also used to: when the sum result is greater than the first threshold, determine a first data processing unit from other data processing units based on the container indicators corresponding to the multiple data processing units respectively and the sum result, wherein the other data processing units are data processing units other than the target data processing unit among the multiple data processing units; migrate the target micro-application container to the first data processing unit, and use the first data processing unit to run the target micro-application container.

7. A non-volatile storage medium, characterized in that: The non-volatile storage medium stores a plurality of instructions, which are suitable for being loaded by a processor and executed by the safe operation processing method for an edge device of a smart grid as described in any one of claims 1 to 5.

8. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the safe operation processing method of the edge device of the smart grid as described in any one of claims 1 to 5.

Images