A cloud-based task scheduling method based on security classification rules

Abstract

This disclosure provides a cloud-based task scheduling method based on security classification rules, applicable to the field of cloud computing task scheduling technology. The method includes: responding to a received task instruction, assigning a corresponding security level identifier to the task instruction based on preset task security classification rules; obtaining currently available execution devices and their corresponding security level identifiers within the cloud task scheduling system, wherein the security level identifiers corresponding to the execution devices are assigned based on preset device security classification rules; and dynamically scheduling the task instruction to a matching execution device to execute the corresponding task based on the matching relationship between the security level identifier of the task instruction and the security level identifier of the execution device. This approach solves the problem that traditional scheduling systems only focus on load / efficiency, neglecting the security matching between tasks and devices, which can lead to highly sensitive tasks being assigned to low-security devices, causing data leakage risks.

Description

Technical Field

[0001] This disclosure relates to the field of cloud computing task scheduling technology, and in particular to a cloud task scheduling method based on security classification rules. Background Technology

[0002] In cloud computing environments, with the increasing complexity of business operations and the growing sensitivity of data, traditional cloud task scheduling methods present numerous security vulnerabilities. For example, failing to adequately consider the differences in security levels between tasks and execution devices may result in sensitive tasks being executed on devices with lower security, leading to security issues such as data leaks and malicious tampering. Furthermore, when handling complex task chains, existing technologies struggle to effectively guarantee the secure transmission of intermediate data and the collaborative operation between devices with different security levels. Additionally, there is a lack of flexible and effective response strategies when task execution fails or security level mismatches occur. Summary of the Invention

[0003] This disclosure provides a cloud-based task scheduling method based on security classification rules, which solves the technical problem that traditional scheduling systems only focus on load / efficiency and ignore the security matching between tasks and devices, resulting in highly sensitive tasks being assigned to low-security devices and causing data leakage risks.

[0004] According to a first aspect of this disclosure, a cloud-based task scheduling method based on security classification rules is provided. The method includes:

[0005] In response to a received task instruction, a corresponding security level identifier is assigned to the task instruction based on a preset task security classification rule;

[0006] Obtain the currently available execution devices and their corresponding security level identifiers within the cloud-based task scheduling system, wherein the security level identifiers corresponding to the execution devices are assigned based on preset device security classification rules;

[0007] Based on the matching relationship between the security level identifier of the task instruction and the security level identifier of the execution device, the task instruction is dynamically scheduled to the matching execution device to execute the corresponding task.

[0008] In addition to the aspects described above and any possible implementation, a further implementation is provided in which the matching relationship between the security level identifiers is that the security level identifier of the execution device is greater than or equal to the security level identifier of the task instruction.

[0009] In addition to the aspects and any possible implementations described above, a further implementation is provided in which, when the task instruction is a task chain, the method further includes:

[0010] If the task instruction is detected to be a task chain, the task instruction is decomposed into multiple sequentially executed related subtasks;

[0011] Based on the preset task security classification rules, a corresponding security level identifier is assigned to each associated subtask, and it is determined whether the security level identifiers of each associated subtask are the same.

[0012] If the security level identifiers of all the associated subtasks are the same, the task instructions will be dynamically scheduled to be executed by a matching single execution device.

[0013] If the security level identifiers of the associated subtasks differ, the execution devices of each associated subtask are matched based on their security level identifiers, and the intermediate data is encrypted and relayed between the execution devices through an encrypted data channel until the task chain is completed.

[0014] In addition to the aspects and any possible implementations described above, a further implementation is provided, wherein if the security level identifiers of the associated subtasks differ, the execution device is matched based on the security level identifiers of the associated subtasks, and intermediate data is encrypted and relayed between the execution devices through an encrypted data channel until the task chain is completed, including:

[0015] If the security level identifiers of the associated subtasks differ, an encrypted data channel is automatically established between the cloud task scheduling system and the execution device that matches each associated subtask, and the first associated subtask is scheduled to be executed on the first matching execution device.

[0016] After the first execution device completes its execution, it generates intermediate data and sends the intermediate data to the cloud task scheduling system through the encrypted data channel.

[0017] The cloud-based task scheduling system forwards the intermediate data to a second execution device that matches the next associated subtask through the encrypted data channel.

[0018] The above data transfer process is repeated continuously until the final subtask is completed, and the final execution device returns the task execution result to the cloud task scheduling system.

[0019] In addition to the aspects and any possible implementations described above, a further implementation is provided, wherein dynamically scheduling the task instruction to a matching execution device to execute the corresponding task based on the matching relationship between the security level identifier of the task instruction and the security level identifier of the execution device includes:

[0020] Based on the security level identifier of the task instruction, the currently available execution devices in the cloud task scheduling system are filtered to generate a candidate device set;

[0021] Based on a preset dynamic scheduling strategy, a matching execution device is selected from the candidate device set, and the task instruction is scheduled to be executed on the matching execution device; wherein,

[0022] If the candidate device set is empty after filtering, then at least one of the following operations shall be performed:

[0023] Initiate a temporary upgrade request for the security level of the execution device to the user, upgrade the security level identifier of the specific execution device based on the user's operation, generate an extended candidate device set and scan and select it;

[0024] Activate the dormant device resources in the cloud task scheduling system, reallocate security level identifiers to the activated execution devices, generate an extended candidate device set, and scan and select them.

[0025] In addition to the aspects described above and any possible implementations, a further implementation is provided, wherein the dynamic scheduling strategy includes at least one of the following strategies:

[0026] Minimum Security Difference Priority Strategy: Prioritize the execution device with the smallest difference between the security level identifier and the security level identifier of the task instruction;

[0027] Device load balancing strategy: Prioritize the execution device with the lowest current load;

[0028] User-preset device preference strategy: Prioritize user-preset preferred devices.

[0029] In addition to the aspects and any possible implementations described above, a further implementation is provided, wherein the method further includes:

[0030] After the task instruction is dynamically scheduled to a matching execution device for execution, if the task execution fails, at least one of the following operations is performed:

[0031] Re-execute the task instructions on the current execution device;

[0032] The task instruction is scheduled to be executed on another available device with a security level identifier that is not lower than that of the currently executing device.

[0033] In addition to the aspects and any possible implementations described above, a further implementation is provided, wherein the task security classification rules include:

[0034] Task instructions involving sensitive asset operations are classified as high-security levels;

[0035] Task instructions involving identity authentication operations are classified into medium security levels;

[0036] All other task instructions besides the two types mentioned above are classified as low security level.

[0037] In addition to the aspects and any possible implementations described above, a further implementation is provided, wherein the device security classification rules include:

[0038] Physical terminal devices directly controlled by users are classified as high-security level;

[0039] User-configured virtual devices are classified into medium security levels;

[0040] Virtual devices in the system's public resource pool are classified as low security level.

[0041] In addition to the aspects and any possible implementations described above, a further implementation is provided, wherein the method further includes:

[0042] When classifying security levels, a user customization interface is provided. Through the user customization interface, the user's modified configuration of the task security classification rules and / or the device security classification rules is received to redefine the security level classification standards of task instructions and / or execution devices.

[0043] In this disclosure, firstly, in response to a received task instruction, a corresponding security level identifier is assigned to the task instruction based on preset task security classification rules; secondly, the currently available execution devices and their corresponding security level identifiers within the cloud task scheduling system are obtained, wherein the security level identifier corresponding to the execution device is assigned based on preset device security classification rules; finally, based on the matching relationship between the security level identifier of the task instruction and the security level identifier of the execution device, the task instruction is dynamically scheduled to the matching execution device to execute the corresponding task. This addresses the problem of traditional scheduling systems focusing only on load / efficiency and neglecting the security matching between tasks and devices, which can lead to highly sensitive tasks being assigned to low-security devices and causing data leakage risks. It effectively meets the needs of cloud task scheduling in terms of security, resource utilization, task execution flexibility, and user experience, providing strong support for the efficient and secure execution of cloud tasks and reducing security risks such as data leakage and malicious tampering.

[0044] It should be understood that the description in the Summary of the Invention is not intended to limit the key or essential features of the embodiments of this disclosure, nor is it intended to restrict the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0045] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. The drawings are provided for a better understanding of the invention and are not intended to limit the scope of this disclosure. In the drawings, the same or similar reference numerals denote the same or similar elements, wherein:

[0046] Figure 1 A flowchart illustrating a cloud-based task scheduling method based on security classification rules provided by an embodiment of this disclosure is shown.

[0047] Figure 2 A structural diagram of a cloud-based task scheduling device based on security classification rules, provided by an embodiment of this disclosure, is shown.

[0048] Figure 3 A structural diagram of an exemplary electronic device capable of implementing embodiments of the present disclosure is shown. Detailed Implementation

[0049] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0050] Furthermore, the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0051] In this disclosure, firstly, in response to a received task instruction, a corresponding security level identifier is assigned to the task instruction based on preset task security classification rules; secondly, the currently available execution devices and their corresponding security level identifiers within the cloud task scheduling system are obtained, wherein the security level identifier corresponding to the execution device is assigned based on preset device security classification rules; finally, based on the matching relationship between the security level identifier of the task instruction and the security level identifier of the execution device, the task instruction is dynamically scheduled to the matching execution device to execute the corresponding task. This addresses the problem of traditional scheduling systems focusing only on load / efficiency and neglecting the security matching between tasks and devices, which can lead to highly sensitive tasks being assigned to low-security devices and causing data leakage risks. It effectively meets the needs of cloud task scheduling in terms of security, resource utilization, task execution flexibility, and user experience, providing strong support for the efficient and secure execution of cloud tasks and reducing security risks such as data leakage and malicious tampering.

[0052] Figure 1 The diagram illustrates a flowchart of a cloud-based task scheduling method based on security classification rules, as provided in an embodiment of this disclosure. Figure 1 As shown, a cloud-based task scheduling method 100 based on security classification rules may include the following steps:

[0053] S110, in response to the received task instruction, assign a corresponding security level identifier to the task instruction based on the preset task security classification rules.

[0054] For example, the task security classification rules include:

[0055] Task instructions involving sensitive asset operations are classified as high-security levels;

[0056] Task instructions involving identity authentication operations are classified into medium security levels;

[0057] All other task instructions besides the two types mentioned above are classified as low security level.

[0058] In some embodiments, for task instructions input in natural language form, word segmentation is required first to break down the sentence into individual lexical units; then, the syntactic relationships between the words in the task instruction are determined, and a syntax tree is constructed. For example, when analyzing the instruction "Query transaction records of sensitive assets," syntactic analysis clarifies that "query" is the main verb operation, and "transaction records of sensitive assets" is its object, thus better understanding the operation objects and behaviors involved in the instruction; semantic analysis models, such as word vector models (Word2Vec, GloVe, etc.) or pre-trained language models (such as BERT), are used to perform semantic understanding of the task instructions, mapping the words in the instructions to a semantic vector space, calculating the semantic similarity between words, and thus accurately grasping the core meaning of the task instructions.

[0059] In some embodiments, for structured task instructions, such as instructions generated according to a preset instruction template or format, pattern matching can be used to parse them, and regular expressions can be used to identify and extract key information from the task instructions.

[0060] In some embodiments, unique identifier codes are generated for different security levels, such as codes starting with "H-" for high security levels (H-001, H-002, etc.), codes starting with "M-" for medium security levels, and codes starting with "L-" for low security levels. This coding method facilitates querying, statistics, and management within the system.

[0061] The generated security level identifiers are associated and stored with their corresponding task instructions. This can be done using a database relational table, where one task instruction record corresponds to one security level identifier record, or by adding a security level identifier field to the metadata of the task instructions to ensure that each task instruction has a clear security level identifier.

[0062] S120, obtain the currently available execution devices and their corresponding security level identifiers within the cloud task scheduling system, wherein the security level identifiers corresponding to the execution devices are assigned based on preset device security classification rules.

[0063] For example, the device security classification rules include:

[0064] Physical terminal devices directly controlled by users are classified as high-security level;

[0065] User-configured virtual devices are classified into medium security levels;

[0066] Virtual devices in the system's public resource pool are classified as low security level.

[0067] In some embodiments, the cloud-based task scheduling system typically provides corresponding API interfaces for other components or services to query information on currently available execution devices. By calling these interfaces, basic information such as the type of execution device (physical terminal or virtual device) and its resource pool (directly managed by the user, user-specific configuration, or system public resource pool) can be obtained, providing a key basis for subsequently determining the security level of the device.

[0068] Employ equipment status monitoring tools or technologies to track equipment availability in real time. For example, by running a status monitoring agent on the equipment, it can periodically send heartbeat signals to the cloud-based task scheduling system, reporting whether the equipment is operating normally (e.g., whether it is online, whether there is a hardware failure, whether system resources are overloaded, etc.), ensuring that the obtained equipment information is up-to-date and valid.

[0069] In some embodiments, for physical terminal devices, it is determined whether they fall under the direct control of the user by checking the device's attribute tags, such as the user information to which the device belongs and the device's unique hardware identifier (such as MAC address).

[0070] For virtual devices, analyze their configuration files and runtime environment information to determine whether they belong to user-specific configurations or devices in the system's public resource pool.

[0071] In the device management database or configuration file of the cloud task scheduling system, a security level identifier is recorded for each execution device, and this identifier is bound to the device's unique identifier (such as device ID). When the security attributes of the device change (such as the physical terminal device being reconfigured by the user, or the virtual device being migrated from one resource pool to another), its security level identifier is updated in a timely manner to ensure the accuracy and timeliness of the identifier.

[0072] S130, based on the matching relationship between the security level identifier of the task instruction and the security level identifier of the execution device, the task instruction is dynamically scheduled to the matching execution device to execute the corresponding task.

[0073] For example, the matching relationship between the security level identifiers is that the security level identifier of the execution device is greater than or equal to the security level identifier of the task instruction.

[0074] For example, the dynamic scheduling strategy includes at least one of the following strategies:

[0075] Minimum Security Difference Priority Strategy: Prioritize the execution device with the smallest difference between the security level identifier and the security level identifier of the task instruction;

[0076] Device load balancing strategy: Prioritize the execution device with the lowest current load;

[0077] User-preset device preference strategy: Prioritize user-preset preferred devices.

[0078] For example, dynamically scheduling the task instruction to a matching execution device to execute the corresponding task based on the matching relationship between the security level identifier of the task instruction and the security level identifier of the execution device includes:

[0079] Based on the security level identifier of the task instruction, the currently available execution devices in the cloud task scheduling system are filtered to generate a candidate device set;

[0080] Based on a preset dynamic scheduling strategy, a matching execution device is selected from the candidate device set, and the task instruction is scheduled to be executed on the matching execution device; wherein,

[0081] If the candidate device set is empty after filtering, then at least one of the following operations shall be performed:

[0082] Initiate a temporary upgrade request for the security level of the execution device to the user, upgrade the security level identifier of the specific execution device based on the user's operation, generate an extended candidate device set and scan and select it;

[0083] Activate the dormant device resources in the cloud task scheduling system, reallocate security level identifiers to the activated execution devices, generate an extended candidate device set, and scan and select them.

[0084] In some embodiments, when the candidate device set is empty, an expanded candidate device set can be generated and scanned by temporarily raising the security level of the execution device or activating the resources of the dormant device, ensuring that the task can be executed smoothly and enhancing the flexibility and availability of the system.

[0085] In some embodiments, after the initial candidate device set is generated, the device status may change dynamically (such as a sudden increase in device load or a change in security level due to temporary upgrade operations), so the candidate device set needs to be updated and maintained in real time.

[0086] In some embodiments, activating dormant device resources within the cloud task scheduling system involves waking up the devices, which can be achieved by sending specific network signals or instructions. After activation, security level identifiers are reassigned to the devices based on their actual situation (such as device type, resource pool to which they belong), and the reassignment rules must be consistent with the preset device security classification rules. Then, these devices are added to an expanded candidate device set and scanned for selection to ensure that tasks can be reasonably scheduled to appropriate devices.

[0087] In some embodiments, using dynamic scheduling strategies can more rationally allocate tasks to execution devices, reduce device load imbalance, and improve the overall system performance and resource utilization.

[0088] For example, when the task instruction is a task chain, the method further includes:

[0089] If the task instruction is detected to be a task chain, the task instruction is decomposed into multiple sequentially executed related subtasks;

[0090] Based on the preset task security classification rules, a corresponding security level identifier is assigned to each associated subtask, and it is determined whether the security level identifiers of each associated subtask are the same.

[0091] If the security level identifiers of all the associated subtasks are the same, the task instructions will be dynamically scheduled to be executed by a matching single execution device.

[0092] If the security level identifiers of the associated subtasks differ, the execution devices of each associated subtask are matched based on their security level identifiers, and the intermediate data is encrypted and relayed between the execution devices through an encrypted data channel until the task chain is completed.

[0093] For example, if the security level identifiers of the associated sub-tasks differ, then matching the respective execution devices based on the security level identifiers of the associated sub-tasks, and encrypting and relaying intermediate data between the execution devices through an encrypted data channel until the task chain is completed includes:

[0094] If the security level identifiers of the associated subtasks differ, an encrypted data channel is automatically established between the cloud task scheduling system and the execution device that matches each associated subtask, and the first associated subtask is scheduled to be executed on the first matching execution device.

[0095] After the first execution device completes its execution, it generates intermediate data and sends the intermediate data to the cloud task scheduling system through the encrypted data channel.

[0096] The cloud-based task scheduling system forwards the intermediate data to a second execution device that matches the next associated subtask through the encrypted data channel.

[0097] The above data transfer process is repeated continuously until the final subtask is completed, and the final execution device returns the task execution result to the cloud task scheduling system.

[0098] In some embodiments, a specialized task chain parsing algorithm is employed to analyze and decompose task chain instructions. For example, for a complex task chain containing multiple steps, such as a data processing task chain (data acquisition, data cleaning, data computation, data storage, etc.), the parsing algorithm decomposes it into multiple sequentially executed related subtasks, identifies the dependencies and data flow between the steps in the task chain, ensures that the decomposed subtasks are logically and sequentially correct, and defines a unified description language or format for each decomposed subtask, clearly defining key information such as the subtask's input, output, and execution operations.

[0099] In some embodiments, for each associated subtask, its security characteristics are analyzed, and based on the analysis results of the subtask's security characteristics, a corresponding security level identifier is assigned to each subtask according to a preset task security classification rule.

[0100] In some embodiments, for subtasks with different security levels in the task chain, it is ensured that the subtasks run on execution devices that match their security levels, avoiding the execution of sensitive tasks on devices with lower security, reducing security risks such as data leakage and malicious tampering, and transmitting intermediate data between execution devices through encrypted data channels, effectively preventing the intermediate data from being stolen or tampered with during transmission, and ensuring the security of the entire task chain execution process.

[0101] Exemplarily, the method further includes:

[0102] After the task instruction is dynamically scheduled to a matching execution device for execution, if the task execution fails, at least one of the following operations is performed:

[0103] Re-execute the task instructions on the current execution device;

[0104] The task instruction is scheduled to be executed on another available device with a security level identifier that is not lower than that of the currently executing device.

[0105] Exemplarily, the method further includes:

[0106] When classifying security levels, a user customization interface is provided. Through the user customization interface, the user's modified configuration of the task security classification rules and / or the device security classification rules is received to redefine the security level classification standards of task instructions and / or execution devices.

[0107] In some embodiments, a task retry policy is configured in the cloud task scheduling system, including parameters such as the number of retries and the retry interval. For example, a task can be set to retry a maximum of 3 times on the current execution device, with a 5-minute interval between each retry, so that the task may automatically resume execution in the event of a temporary device failure.

[0108] When it is necessary to schedule a task instruction to another available device with a security level no lower than that of the currently executing device, the system selects eligible devices from the cloud-based task scheduling system based on the preset device security classification rules and the current device's security level.

[0109] The following uses the scenario of "helping me buy tickets for Jay Chou's concert this month" as an example to describe in detail a cloud task scheduling method 100 based on security classification rules provided in this embodiment of the disclosure, as follows:

[0110] The cloud-based task scheduling system responds to the user's task instruction, "Help me buy tickets for Jay Chou's concert this month," by analyzing the instruction and identifying it as a task chain containing three sequentially executed related operations: first, querying information about Jay Chou's concert (whether it's happening, the specific time, location, etc.); second, querying the specific ticket price; and finally, confirming the order and making payment. The system assigns a unique ID to this task chain: T123, and clearly defines the subtask dependencies as A→B→C (i.e., subtask A is querying Jay Chou's concert information, subtask B is querying the specific ticket price, and subtask C is confirming the order and making payment). Simultaneously, it stores the detailed operation steps and logical relationships of subtasks A, B, and C in a structured manner.

[0111] The system automatically classifies the task instruction according to preset task security classification rules; among which...

[0112] Subtask A, "Querying Jay Chou's concert information," involves only publicly available information and carries extremely low risk; therefore, it is classified as low security. Subtask B, "Querying specific ticket prices," involves price information but not asset operations; therefore, it is classified as low security. Subtask C, "Confirming the order and making payment," involves the high-risk operation of fund transfer; therefore, it is classified as high security. The system records the security level identifiers of subtasks A, B, and C and stores them in association with the task chain ID to ensure accurate matching of appropriate devices during subsequent scheduling.

[0113] The system utilizes device registration information and real-time status information from the device management database to scan the available device pool, obtaining currently available devices and their security levels and load conditions. The scan results include: user mobile phone (physical terminal, high security level, 30% load), dedicated virtual machine (virtual device, medium security level, 60% load), shared virtual machine 1 in the public resource pool (low security level, 10% load), and shared virtual machine 2 in the public resource pool (low security level, 20% load). Simultaneously, the system updates the status of these devices in real time to ensure that subsequent scheduling decisions are based on the latest device information.

[0114] Based on the security level identifiers of subtasks A, B, and C, the system performs device matching. Subtasks A and B have low security levels, and the schedulable devices include user mobile phones, dedicated virtual machines, shared virtual machines 1 and 2 in the public resource pool. Subtask C has a high security level, and only user mobile phones (high security level) meet the requirements. The system generates a list of schedulable devices for subtasks A, B, and C to provide a basis for subsequent scheduling decisions.

[0115] The system employs a dynamic scheduling strategy. In this scheduling process, based on load balancing and minimum level difference priority strategies, the system compares the schedulable device load of subtasks A and B. Specifically, based on the minimum level difference priority strategy, it selects either shared virtual machine 1 or shared virtual machine 2 in the public resource pool to execute subtasks A and B. Since shared virtual machine 1 (load 10%) and shared virtual machine 2 (load 20%) in the public resource pool have lower loads from a load balancing perspective, subtasks A and B are scheduled to be executed on shared virtual machine 1. Because subtask C can only be executed by the user's mobile phone, the system schedules subtask C to be executed on the user's mobile phone.

[0116] After receiving the task instruction, shared virtual machine 1 decrypts and parses the instruction content, performs a query operation for concert information and ticket prices, and generates intermediate data (concert information and ticket prices) after the query is completed. It then associates and stores the intermediate data with the task ID: T123. Subsequently, it sends completion signals for subtask A and subtask B to the cloud task scheduling system.

[0117] After receiving the completion signals of subtasks A and B, the cloud-based task scheduling system verifies the integrity and correctness of the intermediate data. Upon successful verification, it sends the subtask C instruction and its intermediate data to the user's mobile phone via an encrypted data channel. During the transmission process, the system employs a high-strength encryption algorithm to encrypt the data, ensuring its confidentiality and integrity during transmission. The user's mobile phone receives and decrypts the task instruction and intermediate data, preparing to execute the payment operation.

[0118] According to the instructions of subtask C, the user's mobile phone performs a payment operation through Alipay. During the payment process, the system calls Alipay's secure payment interface to perform a series of operations such as identity verification, fund deduction, and transfer confirmation. After the transfer is completed, task execution result information is generated, including information on whether the payment was successful or failed, and the Alipay balance update. The task execution result is associated with and stored with the task ID: T123, and then encrypted before being returned to the cloud task scheduling system.

[0119] During the execution of sub-tasks A, B, and C on the user's mobile phone, the system monitors the task execution status in real time. If an anomaly such as a network interruption causes a sub-task to fail, the system immediately performs a failure detection. For example, when the payment operation in sub-task C fails to complete successfully due to network issues, the user's mobile phone sends a failure message to the cloud-based task scheduling system, containing information such as the task ID and the reason for failure. Upon receiving the failure message, the system initiates the task execution failure handling process:

[0120] For subtask C, the system re-initiates the payment operation on the user's mobile phone according to the preset retry strategy. During the retry process, the system will check whether the network connection has been restored and whether the account balance is sufficient. If the payment operation still fails after 3 retries, the system will record the retry failure information and proceed to the next step.

[0121] After a retry fails, the system uses a secure wake-up mechanism to wake up a tablet device with the same high security level from its sleep state, performs a device status check to ensure it has the ability to execute tasks, and adds it to the pool of available devices. Then, the task instructions (including subtasks A, B, and C, as well as intermediate data) are scheduled to be executed on the tablet device until the task is completed. During the scheduling process, the system re-encrypts the task instructions and intermediate data and sends them to the tablet device through a secure communication link.

[0122] In summary, this disclosure effectively meets the needs of cloud task scheduling in terms of security, resource utilization, task execution flexibility, and user experience, providing strong support for the efficient and secure execution of cloud tasks.

[0123] The above is an introduction to the method embodiments. The following describes the solution described in this disclosure further through device embodiments.

[0124] Figure 2 The diagram illustrates a structure of a cloud-based task scheduling device based on security classification rules, as provided in an embodiment of this disclosure. Figure 2 As shown, a cloud-based task scheduling device 200 based on security classification rules may include:

[0125] Task identifier allocation module 210 is used to respond to a received task instruction and assign a corresponding security level identifier to the task instruction based on a preset task security classification rule;

[0126] The device resource management module 220 is used to obtain the currently available execution devices and their corresponding security level identifiers within the cloud task scheduling system, wherein the security level identifiers corresponding to the execution devices are assigned based on preset device security classification rules;

[0127] The dynamic scheduling execution module 230 is used to dynamically schedule the task instruction to a matching execution device to execute the corresponding task based on the matching relationship between the security level identifier of the task instruction and the security level identifier of the execution device.

[0128] It should be noted that, for the sake of simplicity, the aforementioned method embodiments are described as a series of actions. However, those skilled in the art should understand that this disclosure is not limited to the described order of actions, because according to this disclosure, some steps may be performed in other orders or simultaneously.

[0129] Secondly, those skilled in the art should also know that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by this disclosure.

[0130] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the described module can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0131] The acquisition, storage, and application of user personal information involved in the technical solution disclosed herein comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0132] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0133] Figure 3 A structural diagram of an exemplary electronic device capable of implementing embodiments of the present disclosure is shown. Electronic device 300 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic device 300 may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0134] like Figure 3As shown, the electronic device 300 may include a computing unit 301, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 302 or a computer program loaded from a storage unit 308 into a random access memory (RAM) 303. The RAM 303 may also store various programs and data required for the operation of the electronic device 300. The computing unit 301, ROM 302, and RAM 303 are interconnected via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0135] Multiple components in electronic device 300 are connected to I / O interface 305, including: input unit 306, such as keyboard, mouse, etc.; output unit 307, such as various types of displays, speakers, etc.; storage unit 308, such as disk, optical disk, etc.; and communication unit 309, such as network card, modem, wireless transceiver, etc. Communication unit 309 allows electronic device 300 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0136] The computing unit 301 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 301 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 301 performs the various methods and processes described above, such as method 100. For example, in some embodiments, method 100 may be implemented as a computer program product, including a computer program tangibly contained in a computer-readable medium, such as storage unit 308. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 300 via ROM 302 and / or communication unit 309. When the computer program is loaded into RAM 303 and executed by the computing unit 301, one or more steps of method 100 described above may be performed. Alternatively, in other embodiments, the computing unit 301 may be configured to perform method 100 by any other suitable means (e.g., by means of firmware).

[0137] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0138] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0139] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0140] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including voice input, speech input, or tactile input).

[0141] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with embodiments of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0142] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0143] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this disclosure can be achieved, and this is not limited herein.

[0144] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A cloud-based task scheduling method based on security classification rules, applied to a cloud-based task scheduling system, characterized in that, include: In response to the received task instruction, a corresponding security level identifier is assigned to the task instruction based on a preset task security classification rule; wherein, the task security classification rule includes: classifying task instructions involving sensitive asset operations as high security level, classifying task instructions involving identity authentication operations as medium security level, and classifying other task instructions other than the above two types of instructions as low security level. Obtain the currently available execution devices and their corresponding security level identifiers within the cloud-based task scheduling system. The security level identifiers of the execution devices are assigned based on preset device security classification rules. The device security classification rules include: classifying physical terminal devices directly controlled by users as high security level, classifying virtual devices configured exclusively by users as medium security level, and classifying virtual devices in the system's public resource pool as low security level. Based on the matching relationship between the security level identifier of the task instruction and the security level identifier of the execution device, the task instruction is dynamically scheduled to the matching execution device to execute the corresponding task; wherein, the matching relationship between the security level identifiers is that the security level identifier of the execution device is greater than or equal to the security level identifier of the task instruction; the step of dynamically scheduling the task instruction to the matching execution device includes: Based on the security level identifier of the task instruction, the currently available execution devices in the cloud task scheduling system are filtered to generate a candidate device set; Based on a preset dynamic scheduling strategy, a matching execution device is selected from the candidate device set, and the task instruction is scheduled to be executed on the matching execution device; wherein, If the candidate device set is empty after filtering, then at least one of the following operations shall be performed: Initiate a temporary upgrade request for the security level of the execution device to the user, upgrade the security level identifier of the specific execution device based on the user's operation, generate an extended candidate device set and scan and select it; Activate the dormant device resources in the cloud task scheduling system, reallocate security level identifiers to the activated execution devices, generate an extended candidate device set, and scan and select them.

2. The method according to claim 1, characterized in that, When the task instruction is a task chain, the method further includes: If the task instruction is detected to be a task chain, the task instruction is decomposed into multiple sequentially executed related subtasks; Based on the preset task security classification rules, a corresponding security level identifier is assigned to each associated subtask, and it is determined whether the security level identifiers of each associated subtask are the same. If the security level identifiers of all the associated subtasks are the same, the task instructions will be dynamically scheduled to be executed by a matching single execution device. If the security level identifiers of the associated subtasks differ, the execution devices of each associated subtask are matched based on their security level identifiers, and the intermediate data is encrypted and relayed between the execution devices through an encrypted data channel until the task chain is completed.

3. The method according to claim 2, characterized in that, If the security level identifiers of the associated sub-tasks differ, then the execution devices are matched based on the security level identifiers of the associated sub-tasks, and intermediate data is encrypted and relayed between the execution devices through an encrypted data channel until the task chain is completed, including: If the security level identifiers of the associated subtasks differ, an encrypted data channel is automatically established between the cloud task scheduling system and the execution device that matches each associated subtask, and the first associated subtask is scheduled to be executed on the first matching execution device. After the first execution device completes its execution, it generates intermediate data and sends the intermediate data to the cloud task scheduling system through the encrypted data channel. The cloud-based task scheduling system forwards the intermediate data to a second execution device that matches the next associated subtask through the encrypted data channel. The above data transfer process is repeated continuously until the final subtask is completed, and the final execution device returns the task execution result to the cloud task scheduling system.

4. The method according to claim 1, characterized in that, The dynamic scheduling strategy includes at least one of the following strategies: Minimum Security Difference Priority Strategy: Prioritize the execution device with the smallest difference between the security level identifier and the security level identifier of the task instruction; Device load balancing strategy: Prioritize the execution device with the lowest current load; User-preset device preference strategy: Prioritize user-preset preferred devices.

5. The method according to claim 4, characterized in that, The method further includes: After the task instruction is dynamically scheduled to a matching execution device for execution, if the task execution fails, at least one of the following operations is performed: Re-execute the task instructions on the current execution device; The task instruction is scheduled to be executed on another available device with a security level identifier that is not lower than that of the currently executing device.

6. The method according to claim 1, characterized in that, The method further includes: When classifying security levels, a user customization interface is provided. Through the user customization interface, the user's modified configuration of the task security classification rules and / or the device security classification rules is received to redefine the security level classification standards of task instructions and / or execution devices.

Images