Task data migration method and device, equipment, storage medium and program product

Abstract

The invention relates to the technical field of computers, and provides a task data migration method and device, equipment, a storage medium and a program product.The task data migration method applied to a first computing power node comprises the steps that in response to a task data migration instruction, the task context of a specified task in the task data migration instruction is determined; the task context comprises at least one of a running state, a data state, external dependence and a task identifier; generating a network watermark according to the global unique identifier of the specified task, the signature information of the first computing power node and the summary information based on the task context; modulating the task context based on the network watermark to obtain modulation data; and transmitting the modulation data to a second computing power node specified in the task data migration instruction. According to the method, while cross-node migration of the task data of the computing power network is completed, migration information tracing can be carried out subsequently through the network watermarks, and the security of task data migration of the computing power network is effectively improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, device, storage medium, and program product for migrating task data. Background Technology

[0002] As Computing Force Networks (CFNs) are gradually deployed as a new type of infrastructure, computing resources are dynamically allocated across regions and nodes. Computing tasks and data frequently migrate between heterogeneous nodes, bringing new challenges to data security and accountability. Traditional data traceability mechanisms rely heavily on log recording, link signatures, or static tags, which are difficult to adapt to the complex and dynamic environment of real-time migration of computing tasks.

[0003] While network watermarking technology can embed identification information into data streams through covert means, enabling stream-level data tracking and tracing, existing watermarking technologies are mainly geared towards fixed network topologies and static flow scenarios. They cannot effectively support the challenges posed by dynamic migration of computing power tasks, node heterogeneity, and resource volatility.

[0004] As a result, traditional data watermarking mechanisms cannot be used to achieve reliable traceability of the entire process of data flow in computing power networks, which in turn leads to low security when migrating task data in computing power networks. Summary of the Invention

[0005] This application aims to address at least one of the technical problems existing in related technologies. To this end, this application proposes a task data migration method, apparatus, device, storage medium, and program product to solve the problem that traditional data watermarking mechanisms cannot be used to achieve reliable traceability of the entire process of data flow in computing power networks, thereby improving the security of task data migration in computing power networks.

[0006] The task data migration method according to the first aspect of this application is applied to a first computing node, the task data migration method comprising: In response to a task data migration instruction, the task context of the task specified in the task data migration instruction is determined; the task context includes at least one of running status, data status, external dependencies, and task identifier. A network watermark is generated based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. Based on the network watermark, the task context is modulated to obtain modulated data; The modulated data is transmitted to the second computing node specified in the task data migration instruction.

[0007] According to one embodiment of this application, generating a network watermark based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context includes: A data identifier is generated based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context; A network watermark is generated based on the data identifier.

[0008] According to one embodiment of this application, transmitting the modulated data to the second computing node specified in the task data migration instruction includes: The modulation data is configured with forward error correction coding, a checksum, a sequence number, and a synchronization beacon to obtain the data to be transmitted. The data to be transferred is transmitted to the second computing node specified in the task data migration instruction.

[0009] According to one embodiment of this application, transmitting the data to be transmitted to the second computing node specified in the task data migration instruction includes: Based on the network watermark, the data packet transmission order of each group of data in the data to be transmitted is determined respectively; Each data packet is transmitted to the second computing node specified in the task data migration instruction according to the corresponding data packet transmission order.

[0010] According to one embodiment of this application, the step of modulating the task context based on the network watermark to obtain modulated data includes: The task context is segmented to obtain at least two task context fragments; The network watermark is segmented into a sequence to obtain a watermark sequence with the same number of task context segments; For each of the task context segments, modulated data is obtained by modulating it using one of the watermark sequences.

[0011] According to one embodiment of this application, the segmentation of the task context to obtain at least two task context fragments includes: The task context is encapsulated as a data container; The data container is segmented to obtain at least two task context fragments.

[0012] The task data migration method according to a second aspect of this application is applied to a second computing node, the task data migration method comprising: Receive modulated data transmitted by the first computing node; Data verification is performed based on the modulation data to obtain verification results; If the verification result is successful, task recovery is performed based on the modulation data; The modulation data is transmitted by the first computing node in the following manner: In response to a task data migration instruction, the task context of the task specified in the task data migration instruction is determined; the task context includes at least one of running status, data status, external dependencies, and task identifier. A network watermark is generated based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. Based on the network watermark, the task context is modulated to obtain modulated data; The modulated data is transmitted to the second computing node specified in the task data migration instruction.

[0013] The task data migration method according to a third aspect of this application is applied to a computing power network control node, the task data migration method comprising: Obtain resource status data of the first computing node; the resource status data includes at least one of the following: CPU idle rate, memory utilization rate, and node load; Based on the resource status data, determine the node availability score of the first computing power node; If the node availability score is lower than a preset score threshold, a task data migration instruction is issued to the first computing power node; the task data migration instruction is used to instruct the first computing power node to transfer the task context to the second computing power node. Upon receiving the task data migration instruction, the first computing node performs the following steps: In response to a task data migration instruction, the task context of the task specified in the task data migration instruction is determined; the task context includes at least one of running status, data status, external dependencies, and task identifier. A network watermark is generated based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. Based on the network watermark, the task context is modulated to obtain modulated data; The modulated data is transmitted to the second computing node specified in the task data migration instruction.

[0014] A task data migration apparatus according to a fourth aspect embodiment of this application includes: The first determining module is configured to, in response to a task data migration instruction, determine the task context of the task specified in the task data migration instruction; the task context includes at least one of running state, data state, external dependencies, and task identifier. The generation module is used to generate a network watermark based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. A modulation module is used to modulate the task context based on the network watermark to obtain modulated data; The transmission module is used to transmit the modulated data to the second computing node specified in the task data migration instruction.

[0015] A task data migration apparatus according to a fifth aspect embodiment of this application includes: The receiving module is used to receive modulated data transmitted by the first computing node; The verification module is used to perform data verification based on the modulation data and obtain the verification result; The task recovery module is used to perform task recovery based on the modulation data if the verification result is successful. The modulation data is transmitted by the first computing node in the following manner: In response to a task data migration instruction, the task context of the task specified in the task data migration instruction is determined; the task context includes at least one of running status, data status, external dependencies, and task identifier. A network watermark is generated based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. Based on the network watermark, the task context is modulated to obtain modulated data; The modulated data is transmitted to the second computing node specified in the task data migration instruction.

[0016] A task data migration apparatus according to a sixth aspect embodiment of this application includes: The acquisition module is used to acquire the resource status data of the first computing node; The second determining module is used to determine the node availability score of the first computing power node based on the resource status data. The sending module is used to send a task data migration instruction to the first computing power node when the node availability score is lower than a preset score threshold; the task data migration instruction is used to instruct the first computing power node to transfer the task context to the second computing power node. Upon receiving the task data migration instruction, the first computing node performs the following steps: In response to a task data migration instruction, the task context of the task specified in the task data migration instruction is determined; the task context includes at least one of running status, data status, external dependencies, and task identifier. A network watermark is generated based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. Based on the network watermark, the task context is modulated to obtain modulated data; The modulated data is transmitted to the second computing node specified in the task data migration instruction.

[0017] An electronic device according to a seventh aspect of this application includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the task data migration method as described above.

[0018] According to an eighth aspect embodiment of the present application, the storage medium is a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the task data migration method as described above.

[0019] A computer program product according to a ninth aspect of this application includes a computer program that, when executed by a processor, implements the task data migration method as described above.

[0020] The above-described one or more technical solutions in the embodiments of this application have at least the following technical effects: Upon receiving a task data migration instruction, the first computing node can respond to the instruction and determine the task context of the specified task, including at least one of the following: running status, data status, external dependencies, and task identifier. It then generates a network watermark based on the globally unique identifier of the specified task, the signature information of the first computing node, and a digest of the task context. By modulating the task context using the network watermark, the watermark can be implicitly embedded into the task context without modifying the task context itself. Furthermore, since the formation of the network watermark considers not only the globally unique identifier of the task and the digest information based on the task context but also the signature information of the first computing node, transmitting the modulated data to the second computing node specified in the task data migration instruction allows for the implicit transmission of the network watermark without modifying the migrated data itself. This not only completes the cross-node migration of task data in the computing network but also enables subsequent traceability of migration information through the network watermark, effectively improving the security of task data migration in the computing network.

[0021] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a flowchart illustrating the task data migration method provided in the embodiments of this application.

[0024] Figure 2 This is a schematic diagram of the watermark detection process in the task data migration method provided in this application embodiment.

[0025] Figure 3 This is a schematic diagram of the process of embedding watermarks in the covert channel in the task data migration method provided in the embodiments of this application.

[0026] Figure 4 This is a schematic diagram of the structure of the electronic device provided in this application. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0028] It should be noted that in existing network systems, basic identification is often performed using data packet metadata such as Internet Protocol (IP) headers, identifier fields, and Media Access Control (MAC) addresses. This type of identification typically only contains static source / destination address information and lacks the ability to describe task context and dynamic scheduling behavior.

[0029] Network watermarking is a technique that hides carried information by modifying communication characteristics (such as packet timing, size, protocol fields, etc.), and is widely used in steganography, content copyright protection, and traffic authentication. This technique can embed some tracking information without affecting communication functionality, but traditional methods have not been combined with dynamic information such as task status and computing resources, nor have they been applied in computing power networks.

[0030] Furthermore, in cloud computing and edge computing scenarios, common task scheduling systems (such as Kubernetes (K8s) and Edge Orchestrator) support migrating computing tasks to other nodes based on factors such as resource utilization and task priority. However, task migration information is only managed within the scheduling platform and lacks a way to bind it to specific data streams or transmission behaviors, making it difficult to trace the migration path at the link level.

[0031] In addition, platforms such as Kubernetes and OpenStack (an open-source cloud computing platform) support the migration and scheduling of tasks / containers, but their traceability functions are limited to log recording or platform event replay, and cannot provide external data accessors with structured and verifiable traceability information.

[0032] Furthermore, although various data identification, network watermarking, and task scheduling mechanisms are widely used in existing technologies, the following major defects and shortcomings still exist in the Computing Force Network (CFN) environment when facing scenarios such as frequent task migration, heterogeneous node collaborative computing, and cross-domain data transmission: Data labeling lacks task awareness and fails to reflect computational context information. Most current data identification methods only provide static address identifiers (such as source / destination IP, port, etc.), which cannot carry task-level information such as the corresponding task number (Identifier, ID), priority, computing power requirements, migration status, etc., making it difficult to meet the needs of multi-dimensional data traceability in complex computing networks.

[0033] The identifier is non-transferable and does not support updates and transfers during task migration scenarios. Once a task migrates from one node to another, its associated identification information usually cannot be synchronized, causing the task's execution trajectory to be interrupted. It is impossible to track the task's migration path and status changes through the data itself, resulting in a lack of dynamism.

[0034] The lack of an identifier embedding mechanism that integrates with network devices makes it susceptible to tampering or loss. Existing identification methods mostly rely on scheduling logs, platform control plane, or device identity. Once the data leaves the original environment, it is difficult to extract or verify it, and it is easily tampered with or forged by malicious nodes. There is a lack of stable embedding / extraction mechanisms.

[0035] Network watermarking technology is not integrated with task scheduling or computing power information, and the embedded content is limited. Traditional network watermarking is mostly used for user identity or behavior identification, but it fails to carry information such as task migration chain, scheduling path, and resource tags. Furthermore, the embedded data lacks structure and verifiability, making it unsuitable for data flow traceability in a computing power network environment.

[0036] End-to-end data tracing and authentication cannot be achieved across computing domains or in multi-node environments: Most existing solutions are only applicable to local scheduling or fixed nodes, lacking a unified identification and verification method for cross-domain task migration and multi-hop execution chains, thus limiting the scope of traceability.

[0037] Based on this, this application proposes a task data migration method, apparatus, device, storage medium, and program product, aiming to solve the following key technical problems: How to construct a portable data identifier structure that can fully express the execution context, computing power attributes and migration status of a task, and can be dynamically updated in the computing power network as the task progresses.

[0038] How can this data identification information be robustly and covertly embedded into the transmitted data so that it can be disseminated along with the data transmission and effectively extracted and verified in the target node or monitoring equipment?

[0039] How to ensure that data identifiers remain synchronized with computing tasks during the migration process, and continuously update the migration path to achieve link-level task traceability across nodes and computing domains?

[0040] How to design a lightweight, robust, and tamper-proof data identifier embedding and extraction mechanism that can operate reliably in highly complex network environments without affecting data transmission performance?

[0041] How to design a collaborative identification embedding mechanism with network components such as computing power scheduling systems and edge gateways to achieve trusted binding and linkage between tasks, data, and networks.

[0042] This enhances the controllability, security, and full lifecycle traceability of data.

[0043] It should be noted that all actions involving the acquisition of signals, information, or data in this application are carried out in compliance with the relevant data protection laws and regulations of the locality and with authorization from the owner of the relevant device.

[0044] Figure 1This is a flowchart illustrating the task data migration method provided in an embodiment of this application, as shown below. Figure 1 As shown, the data migration method for this task includes: Step 110: In response to the task data migration instruction, determine the task context of the task specified in the task data migration instruction; the task context includes at least one of the following: running state, data state, external dependencies, and task identifier.

[0045] Step 120: Generate a network watermark based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context.

[0046] Step 130: Modulate the task context based on the network watermark to obtain modulated data.

[0047] Step 140: Transmit the modulated data to the second computing node specified in the task data migration instruction.

[0048] It should be noted that the execution entity of the task data migration method provided in this application embodiment can be a computing power node in an edge or cloud environment. Specifically, the computing power node can be an edge service, a gateway device, or other computer device. The computer device can be, for example, a mobile phone, tablet computer, laptop computer, handheld computer, in-vehicle electronic device, wearable device, ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), etc.

[0049] It should be further noted that the overall system in this application includes computing network users, computing power nodes, and computing power network control nodes.

[0050] In this context, computing network users are consumers of computing power services, also known as tenants, and can submit computing tasks (such as artificial intelligence model training, big data analysis, scientific computing, etc.) to the computing network control nodes. Computing tasks can include specific task content, resource requirements, and service quality requirements (such as deadlines and budgets).

[0051] The computing network control node is responsible for the unified scheduling, management, and orchestration of all network resources. Specifically, it can monitor the resource status of all connected computing nodes in real time (including but not limited to CPU utilization, memory utilization, node load, network bandwidth, etc.) to form a global resource view. Furthermore, based on the computing network user's task requirements, node resource status, optimization strategies (such as minimum cost, minimum latency), and other computing task-related information, it can make initial scheduling decisions (which computing node to assign the task to) and migration decisions (when to migrate the task from the current computing node to another computing node). Additionally, it can receive and record task migration events from each computing node, maintain a global log of tasks throughout their lifecycle, and provide centralized query support for auditing and traceability.

[0052] Computing nodes can receive computing tasks from the computing network control node, provide computing resources such as CPU, memory, and graphics processing units (GPUs), and create secure runtime environments (such as containers or virtual machines) to execute the relevant computing tasks. Simultaneously, they monitor local resource consumption and task execution status in real time and report to the computing network control node periodically; that is, they must at least report resource status data to the computing network control node. Furthermore, upon receiving a task data migration instruction from the computing network control node, they transfer the task context of the specified task to another specified computing node. In other words, when task data migration is required, the computing nodes in this application can include a first computing node and a second computing node. The first computing node is the original processing node (i.e., the migration-out node) for the specified task, while the second computing node is the receiving node (i.e., the migration-in node) for the specified task.

[0053] Specifically, when a computing power user submits a computing task to the computing power network control node, the computing power network control node automatically generates a globally unique identifier (Data Identifier, DataID) for each computing task. The content of this identifier includes, but is not limited to: Task ID, Tenant ID, Submission Timestamp, Initial Computing Node Location (NodeID / IP), Task Type and Model Summary (Hash), Source Watermark Fingerprint (Watermark).

[0054] The computing power network control node can encapsulate the above information into a globally unique identifier using the following format: ; Where Hash{} represents a hash operation; TaskID1 represents the ID of the first task; TenantID2 represents the information of the second tenant; H dataThis indicates the task type and model summary.

[0055] Secondly, the computing power network control node further signs the DataID: Specifically, the computing power network control node is based on a public-private key system. It uses the private key to sign the DataID (Signature = SM2_Sign(DataID, PrivateKey)). Subsequently, the computing power node can verify the legality of the signature through the corresponding public key to ensure that the identifier has not been tampered with.

[0056] This globally unique identifier is generated through a hash or signature mechanism and can be embedded in the task's runtime context and data blocks, serving as the core basis for subsequent task migration, channel synchronization, and responsibility allocation.

[0057] In other words, this globally unique identifier can be embedded in task logs, model weights, input data fragments, etc., using digital watermarking or structured steganography to ensure that it is not easily detected or tampered with.

[0058] Furthermore, the computing power network control node can periodically collect resource status data of each computing power node through the computing power monitoring agent (ComputeAgent) deployed on each computing power node, forming the following computing power description tuple: ; in, This represents the CPU idle rate of computing node i; This represents the memory usage rate of computing node i; This represents the network bandwidth utilization rate of computing node i; This represents the node load of computing node i.

[0059] Furthermore, the computing power network control node can calculate the node availability score of each computing power node through its control and orchestration management unit. : ; in, , is an adjustable parameter of the strategy.

[0060] In one embodiment, if the node availability score of the computing node where any computing task resides... Below a certain migration threshold (This can be referred to as a preset scoring threshold in this application), which triggers the task migration process, designates the computing power node as the first computing power node, and issues a task data migration instruction to it. Thus, the task data migration instruction instructs the first computing power node to transfer the task context of the specified task running thereto to the specified second computing power node.

[0061] Regarding the determination process of the second computing power node, this application does not impose specific limitations, and the designated second computing power node can be determined in various feasible ways. For example, the computing power node with the highest node availability score can be designated as the designated second computing power node, or the computing power node with a node availability score higher than a preset score threshold and a distance from the first computing power node less than a preset distance threshold can be designated as the designated second computing power node.

[0062] In another embodiment, the computing power network control node can use its task scheduling module to dynamically assess whether the current computing task is running stably, taking into account the resources of the current computing power node and the computing power network control node.

[0063] Furthermore, if security risks are a primary concern, the computing power network control node can be further integrated with the security monitoring modules deployed on the computing power nodes. Based on the security detection outputs provided, it can determine whether there are risks such as external intrusion or exposure of covert channels, and determine the level of risk. Weighting node availability score and risk level This determines whether to migrate the current computing task. For example, if the node availability score is lower than a preset score threshold and the risk level is higher than a preset risk threshold, it is determined to enter the migration preparation stage.

[0064] In another embodiment, the computing power network control node can also determine if a computing power node has a resource bottleneck (i.e., node availability score). Below a certain migration threshold When delays exceed limits or an attack risk is encountered, the system is determined to enter the migration preparation phase.

[0065] The watermark embedding parameters are dynamically adjusted based on the real-time resource status of CPU, memory, bandwidth, etc., to achieve a balance between performance and traceability concealment.

[0066] After determining that the migration preparation phase has begun, the computing power network control node can designate the computing power node as the first computing power node and issue a task data migration instruction to it. This task data migration instruction instructs the first computing power node to transfer the task context of a specified task running on it to a specified second computing power node. It should be noted that the task data migration instruction may include not only the specified task and the specified second computing power node, but also the DataID of the specified task.

[0067] Furthermore, the first computing node that receives the task data migration instruction can respond to the task data migration instruction and export the complete status information of the task specified in the task data migration instruction as the task context through the task context export module.

[0068] The task context includes the running state. Data status External dependencies With task identifier One or more of them.

[0069] In one embodiment, the task context includes at least the running state, data state, external dependencies, and task identifier.

[0070] The runtime status includes memory snapshots, program counter (PC), stack, and other information; the data status includes temporary data and intermediate results; external dependencies include file, network connection, channel, peripheral device, and other dependencies; the task identifier is a unique hidden task identifier generated by computation task T, calculated in the following way: ; Where H() represents hash operation; Indicates the submission timestamp of the computation task; The signature data representing the DataID of the computation task.

[0071] It should be noted that, to support security and robustness during migration, the first computing node can be based on a lightweight container or micro virtual machine, build migration units for the task context, and generate intermediate snapshots for interrupt recovery.

[0072] In addition, the first computing node can obtain the globally unique identifier of the specified task, the signature information of the first computing node itself, and the digest information obtained by hashing the task context.

[0073] After obtaining the globally unique identifier of the specified task, the signature information of the first computing node, and the summary information based on the task context, the first computing node can generate a data identifier (TDI) for this migration.

[0074] Furthermore, by processing this data identifier, a web watermark can be obtained.

[0075] Furthermore, the first computing node can divide the network watermark into multiple sets of sequences and the task context into multiple segments of data. Then, different segments of the task context can be modulated using different sets of sequences. In this way, the network watermark can be implicitly embedded into the task context without modifying the task context itself, thus obtaining the modulated data.

[0076] Furthermore, the first computing node can first determine the data packet transmission order of each group of data in the modulated data based on the network watermark, and then transmit each group of data to the second computing node specified in the task data migration instruction according to the corresponding data packet transmission order. Each group of data may include multiple data packets.

[0077] Furthermore, the second computing node can receive modulated data transmitted in packets by the first computing node.

[0078] Furthermore, the second computing node can reconstruct the original task context and network watermark using the modulation data from each group of the demodulation module. After reconstructing the TDI based on the network watermark, it can then reconstruct the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context.

[0079] Then, the second computing node verifies the received modulated data by comparing the node signature and the task context digest information, and obtains the verification result as either successful or unsuccessful.

[0080] In one embodiment, the second computing node can use the public key of the first node to decrypt and verify the restored node signature, thereby determining whether the TDI was indeed issued by the source node claimed by the TDI, and not forged by a malicious node. Furthermore, the second computing node can calculate the hash value of the received complete task context and compare it with the digest information of the restored task context, thereby determining whether the task context has been erroneous or tampered with.

[0081] Furthermore, once it is determined that the node signature and digest information have passed verification, the modulation data has also passed verification. At this point, the task can be restored using the restored task context.

[0082] Specifically, the second computing node can create a runtime environment (such as a container or virtual machine) on the target node that is compatible with the source node, based on information from the task context. The received task context is loaded into the new environment, and the program counter (PC) is restored to the position at the time of the interruption. Thus, the CPU begins execution from the instruction address pointed to by the PC, and the computing task seamlessly resumes execution from the precise breakpoint, without the user being aware of this migration process.

[0083] Specifically, the second computing node can use a demodulation module to unpack and reassemble the received data set one by one through the following process: Watermark detection: The watermark detection module identifies and correctly restores embedded network watermark information from network traffic. The key steps involved are as follows: Session segmentation: First, the detector divides the entire network traffic into multiple independent session flows based on the packet's five-tuple information (source IP address, destination IP address, source port, destination port, and transport layer protocol), denoted as... each It is treated as an independent detection unit, and watermark extraction and analysis are performed separately.

[0084] Detection group traversal: For each session stream The detector uses a sliding window of length n to buffer the identification field of IP packets into n packet groups, extracts the IP ID values ​​of all IP packets in the window, and constructs the original IP ID sequence: .

[0085] Detection set matching After the standardized sequence (seq) is generated, it is matched against a predefined detection set (DS). If the seq is in the DS, it means that the sliding window has successfully detected a valid network watermark segment (i.e., watermark sequence). If no network watermark is detected, the oldest IP ID in the window is removed and the window is cached again.

[0086] Watermark reconstruction and restoration: The detector can progressively identify all embedded watermark segments (i.e., all watermark sequences) within the session stream. The watermark segments are then concatenated sequentially according to the detection order, ultimately restoring the original network watermark. , in W represents the i-th watermark sequence. i .

[0087] Watermark demodulation function: ; Where, p i This represents the i-th group of data in the modulation data. The modulation function is denoted by Dec(); the decompression function is denoted by d. i This represents the demodulated data of the i-th group of data in the modulation data.

[0088] In addition, information reorganization of the task context is performed.

[0089] Furthermore, the second computing node can enable error correction mechanisms (such as Reed-Solomon) to deal with packet loss and ensure that the context recovery rate reaches 99.9%.

[0090] At the same time, an anonymous acknowledgment (ACK) channel is introduced to complete channel synchronization acknowledgment and notify the source node (i.e., the first computing power node) of successful migration.

[0091] In other words, once the computing task has been fully rebuilt and verified, the second computing node can automatically send a channel confirmation message to the control and orchestration management unit of the computing network control node, indicating that the migration operation has been completed and the task can continue to run.

[0092] Therefore, by maintaining the inheritance and continuous embedding of the watermark context before and after the migration of computing power tasks, the cross-node traceability chain is ensured to remain uninterrupted.

[0093] Figure 2 This is a flowchart illustrating the watermark detection process in the task data migration method provided in this application embodiment, as shown below. Figure 2 As shown, in one embodiment, after detection begins, initialization can be performed and network packets containing modulated data sent by the first computing node can be received. Further, it can be determined whether the buffer is full; if not, a copy of the current packet's IPID is stored. If so, the IPID in the current window is normalized, and the normalized result is matched against the detection set. If a match is successful, the sliding window buffer is cleared, and watermark information is appended to L. If a match is unsuccessful, the oldest IPID is discarded, and network packets are received again.

[0094] Therefore, by constructing a data identification structure with computing power awareness, task binding, and migration tracking capabilities, and combining network watermarking embedding technology with gateway collaboration mechanisms, end-to-end, full-path, verifiable traceability of data flow in the computing power network can be achieved, enhancing the controllability, security, and full lifecycle traceability of data.

[0095] It should be further noted that if the computing network control node receives a channel acknowledgment response, it automatically updates the task scheduling table in the system and clears the task context of the source node to avoid redundant computation or duplicate resource usage. Simultaneously, the new task identifier and status synchronization information will be stored as event records in the task tracing log for future auditing, arbitration, or backtracking purposes.

[0096] According to the task data migration method of this application embodiment, after receiving a task data migration instruction, the first computing node can respond to the task data migration instruction and determine the task context of the task specified in the task data migration instruction, which includes at least one of the following: running state, data state, external dependencies, and task identifier; and generate a network watermark based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. Thus, by modulating the task context based on the network watermark, the network watermark can be implicitly embedded into the task context without modifying the task context itself. Furthermore, since the formation of the network watermark considers not only the globally unique identifier of the task and the digest information based on the task context, but also the signature information of the first computing node, transmitting the modulated data to the second computing node specified in the task data migration instruction can achieve the transmission of the network watermark through implicit embedding without modifying the migrated data itself. This not only completes the cross-node migration of task data in the computing network, but also enables subsequent traceability of migration information through the network watermark, effectively improving the security of task data migration in the computing network.

[0097] It should be noted that, in order to ensure the verifiability and reliable traceability of the task data migration process, this application generates the following multiple identifiers during task initialization and migration: Data Identifier (DID): Calculate the hash using the data fragment and its associated task: ; in, The data identifier represents the i-th data segment; This represents the i-th data segment; Indicates a unique covert mission identifier; This indicates the initial computing node location.

[0098] Migration Log Chain (MLog): Each migration action generates a chain of records: ; in, This indicates the nth migration; This indicates the (n-1)th migration; Indicates the migration timestamp; This indicates the target computing node for migration.

[0099] All logs are written to a private chain (or consortium chain) and indexed and arbitrated using a Merkle Tree structure.

[0100] When there are complex paths such as multi-hop migrations and hidden link traversals, this mechanism can support accurate data / task location and responsibility attribution.

[0101] In one embodiment, a network watermark is generated based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context, including: Generate a data identifier based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context; Generate network watermarks based on data identifiers.

[0102] Specifically, the first computing node can use the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context as the data identifier TDI for this migration.

[0103] Furthermore, the first computing node can convert the data identifier, thereby obtaining the network watermark.

[0104] Specifically, the first computing node can convert the data identifier into binary data and use the converted data as a network watermark.

[0105] This application generates a network watermark using information such as the globally unique identifier of the specified task, the signature information of the first computing power node, and the digest information based on the task context. This allows the network watermark to be implicitly embedded into the task context without modifying the task context itself. Furthermore, since the formation of the network watermark considers not only the globally unique identifier of the task and the digest information based on the task context, but also the signature information of the first computing power node, transmitting the modulated data to the second computing power node specified in the task data migration instruction allows for the transmission of the network watermark through implicit embedding without modifying the migrated data itself. This not only completes the cross-node migration of task data in the computing power network, but also enables subsequent traceability of migration information through the network watermark, effectively improving the security of task data migration in the computing power network.

[0106] It should be noted that the Data Identifier (TDI) in this application can be extracted and verified multiple times throughout the entire task lifecycle, ensuring that every migration of the task can be traced on the blockchain. All TDIs and related communication records will be written to the task log center, and if necessary, can also be synchronously written to the blockchain system for immutable evidence storage. In the event of malicious tampering, migration failure, or abnormal task loss, the task identifier and communication link can be used to trace back to the last migration point, re-triggering the scheduling and migration process, ensuring the robustness and recoverability of the overall system.

[0107] This application designs a lightweight embedding and synchronization mechanism that balances jitter resistance, packet loss resistance, and adaptability to heterogeneous environments.

[0108] In one embodiment, the task context is modulated based on a network watermark to obtain modulated data, including: The task context is segmented to obtain at least two task context fragments; The network watermark is segmented into a sequence to obtain a watermark sequence with the same number of task context segments; For each task context segment, a watermark sequence is used for modulation to obtain modulated data.

[0109] Furthermore, the task context is segmented to obtain at least two task context fragments, including: Encapsulate the task context as a data container; The data container is segmented to obtain at least two task context fragments.

[0110] Specifically, the first computing node can construct a covert channel and perform data modulation based on a stegwriter through a covert channel construction module.

[0111] The covert channel construction module constructs a data channel suitable for watermark / steganography transmission based on network topology and available paths.

[0112] Therefore, multipath perturbation modulation can be applied to the task context. Specifically, the task context can be encapsulated into a portable data container as follows: ; in, Indicates the running status; Indicates data status; Indicates external dependency; Indicates the task identifier.

[0113] Data containers can be created based on lightweight sandboxes, virtual machine images, or system-level thread encapsulation structures.

[0114] Furthermore, by employing unequal-length packets and random path distribution, the data container is divided into at least two task context segments, thus forming a set composed of each task context segment. .

[0115] Furthermore, the network watermark is sequenced to obtain a set of watermark sequences that is the same number as the task context fragments. This completes the network watermark encoding, ensuring recognizability and robustness.

[0116] Furthermore, for each task context segment, modulated data is obtained by using a watermark sequence. Specifically, this can be accomplished as follows: ; in, This represents a compression encryption function, such as the common AES function plus Huffman coding; This is the context fragment for the i-th task; Represents the i-th watermark sequence; This represents the modulation function.

[0117] In other words, this application embeds a steganographic transmission path into a regular service link by constructing network watermarks, synchronization beacons, and network IP packet modulation. Specific methods include using key technologies such as session packet IPID reordering, multi-packet IP packet encoding mapping, and robust collision detection set (DS). A robustly identifiable channel is constructed in the actual data packet stream, and the task context and data identifiers are modulated into a stealth stream format using a flow encoder. To enhance anti-interference and anti-packet loss capabilities, redundant coding and error correction mechanisms are employed, embedding recovery reference points and synchronization control watermarks while distributing data along multiple paths.

[0118] This application modulates the task context through network watermarking, so that the network watermark only applies to transmission behavior characteristics (such as timing, interval, and load) and does not modify the business data content itself, thus ensuring data integrity.

[0119] In one embodiment, transmitting modulated data to the second computing node specified in the task data migration instruction includes: The modulation data is configured with forward error correction coding, checksum, sequence number, and embedded synchronization beacon to obtain the data to be transmitted. The data to be transferred is transmitted to the second computing node specified in the task data migration instruction.

[0120] And, transmitting the data to be transferred to the second computing node specified in the task data migration instruction, including: Based on network watermarking, the data packet transmission order of each group of data in the data to be transmitted is determined respectively; Each data packet is transmitted to the second computing node specified in the task data migration instruction according to the corresponding data packet transmission order.

[0121] Specifically, the first computing node can generate additional error correction code packets for each group of data in the modulation data and add them to the corresponding group of data as forward error correction codes. Thus, even if some data packets are lost during transmission, the receiver can use the received error correction code packets and the remaining data packets to restore all the original data through the decoding algorithm.

[0122] Furthermore, a lightweight hash checksum can be calculated for each group of data in the modulated data and added as a checksum to the corresponding group of data. This allows the receiver to immediately verify whether the received data segment is complete and error-free.

[0123] Furthermore, an incremental sequence number can be assigned to each group of data in the modulated data to achieve anti-out-of-order and anti-replay; and special, known synchronization bit patterns can be periodically inserted at the beginning of the modulated data stream and during transmission, thereby embedding synchronization beacons to help the receiver accurately determine the start and end of a data block.

[0124] Based on this, the data to be transmitted can be obtained.

[0125] Furthermore, the first computing node can determine the data packet transmission order of the corresponding group of modulated data based on each watermark sequence in the network watermark. Specifically, the data packet transmission order of each group of data can be determined by each watermark sequence in conjunction with Table 1 below: Table 1 ; The identification information can be determined by the watermark sequence, and the numbers in the modulation code table indicate the transmission order of the data packets. For example, (1,2,6,5,4,3) means that six data packets in a set of data are transmitted in the order of the first, second, sixth, fifth, fourth and third.

[0126] Thus, the construction of the covert channel is completed.

[0127] Furthermore, for each group of data in the modulated data, the data packets within that group are transmitted to the second computing node specified in the task data migration instruction according to their corresponding transmission order. This allows the receiver to intercept the data transmission communication IP packet stream of the first computing node at the network layer. And extract the 16-bit IP identification field -- IP ID -- from each message.

[0128] Figure 3 This is a schematic diagram of the watermark embedding process in the covert channel of the task data migration method provided in this application embodiment, as shown below. Figure 3 As shown, in one embodiment, after initializing the parameters, network packets are received. Upon receiving a packet, it is determined whether M (the initial value of M is the same as the number of modulation data packets) is equal to 0. If yes, the watermark embedding is considered complete, and the process terminates. If no, it is determined whether watermark embedding should be performed. If yes, n packets (the specific value can be preset according to requirements) are continuously buffered, their order is adjusted according to the mapping relationship, and they are sent. Then, M is decremented by one. If no, the packet is forwarded, and network packets are received again.

[0129] Therefore, the task context, data identifiers, and other content are watermarked and encoded into a steganographic format according to actual needs, and then transmitted step by step through this covert channel.

[0130] This application ensures that the covert channel can not only transmit secrets, but also transmit reliably in complex and unreliable real network environments, and transmit undetected in adversarial environments.

[0131] In one embodiment, the task data migration method further includes: Receive modulated data transmitted by the first computing node; Data verification is performed based on the modulation data to obtain verification results; If the verification result is successful, task recovery is performed based on the modulation data. The modulation data is transmitted by the first computing node in the following manner: In response to a task data migration instruction, determine the task context of the task specified in the task data migration instruction; the task context includes at least one of runtime state, data state, external dependencies, and task identifier. A network watermark is generated based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. Modulated data is obtained by modulating the task context based on network watermarking; Transmit the modulated data to the second computing node specified in the task data migration instruction.

[0132] It should be noted that the execution entity of the task data migration method provided in this application embodiment can be a computing power node in an edge or cloud environment. Specifically, the computing power node can be an edge service, a gateway device, or other computer device. The computer device can be, for example, a mobile phone, tablet computer, laptop computer, handheld computer, in-vehicle electronic device, wearable device, ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), etc.

[0133] It should be further noted that the overall system in this application includes computing network users, computing power nodes, and computing power network control nodes.

[0134] In this context, computing network users are consumers of computing power services, also known as tenants, and can submit computing tasks (such as artificial intelligence model training, big data analysis, scientific computing, etc.) to the computing network control nodes. Computing tasks can include specific task content, resource requirements, and service quality requirements (such as deadlines and budgets).

[0135] The computing network control node is responsible for the unified scheduling, management, and orchestration of all network resources. Specifically, it can monitor the resource status of all connected computing nodes in real time (including but not limited to CPU utilization, memory utilization, node load, network bandwidth, etc.) to form a global resource view. Furthermore, based on the computing network user's task requirements, node resource status, optimization strategies (such as minimum cost, minimum latency), and other computing task-related information, it can make initial scheduling decisions (which computing node to assign the task to) and migration decisions (when to migrate the task from the current computing node to another computing node). Additionally, it can receive and record task migration events from each computing node, maintain a global log of tasks throughout their lifecycle, and provide centralized query support for auditing and traceability.

[0136] Computing nodes can receive computing tasks from the computing network control node, provide computing resources such as CPU, memory, and graphics processing units (GPUs), and create secure runtime environments (such as containers or virtual machines) to execute the relevant computing tasks. Simultaneously, they monitor local resource consumption and task execution status in real time and report to the computing network control node periodically; that is, they must at least report resource status data to the computing network control node. Furthermore, upon receiving a task data migration instruction from the computing network control node, they transfer the task context of the specified task to another specified computing node. In other words, when task data migration is required, the computing nodes in this application can include a first computing node and a second computing node. The first computing node is the original processing node (i.e., the migration-out node) for the specified task, while the second computing node is the receiving node (i.e., the migration-in node) for the specified task.

[0137] Specifically, when a computing power user submits a computing task to the computing power network control node, the computing power network control node automatically generates a globally unique identifier (Data Identifier, DataID) for each computing task. The content of this identifier includes, but is not limited to: Task ID, Tenant ID, Submission Timestamp, Initial Computing Node Location (NodeID / IP), Task Type and Model Summary (Hash), Source Watermark Fingerprint (Watermark).

[0138] The computing power network control node can encapsulate the above information into a globally unique identifier using the following format: ; Where Hash{} represents a hash operation; TaskID1 represents the ID of the first task; TenantID2 represents the information of the second tenant; H dataThis indicates the task type and model summary.

[0139] Secondly, the computing power network control node further signs the DataID: Specifically, the computing power network control node is based on a public-private key system. It uses the private key to sign the DataID (Signature = SM2_Sign(DataID, PrivateKey)). Subsequently, the computing power node can verify the legality of the signature through the corresponding public key to ensure that the identifier has not been tampered with.

[0140] This globally unique identifier is generated through a hash or signature mechanism and can be embedded in the task's runtime context and data blocks, serving as the core basis for subsequent task migration, channel synchronization, and responsibility allocation.

[0141] In other words, this globally unique identifier can be embedded in task logs, model weights, input data fragments, etc., using digital watermarking or structured steganography to ensure that it is not easily detected or tampered with.

[0142] Furthermore, the computing power network control node can periodically collect resource status data of each computing power node through the computing power monitoring agent (ComputeAgent) deployed on each computing power node, forming the following computing power description tuple: ; in, This represents the CPU idle rate of computing node i; This represents the memory usage rate of computing node i; This represents the network bandwidth utilization rate of computing node i; This represents the node load of computing node i.

[0143] Furthermore, the computing power network control node can calculate the node availability score of each computing power node through its control and orchestration management unit. : ; in, , is an adjustable parameter of the strategy.

[0144] In one embodiment, if the node availability score of the computing node where any computing task resides... Below a certain migration threshold (This can be referred to as a preset scoring threshold in this application), which triggers the task migration process, designates the computing power node as the first computing power node, and issues a task data migration instruction to it. Thus, the task data migration instruction instructs the first computing power node to transfer the task context of the specified task running thereto to the specified second computing power node.

[0145] Regarding the determination process of the second computing power node, this application does not impose specific limitations, and the designated second computing power node can be determined in various feasible ways. For example, the computing power node with the highest node availability score can be designated as the designated second computing power node, or the computing power node with a node availability score higher than a preset score threshold and a distance from the first computing power node less than a preset distance threshold can be designated as the designated second computing power node.

[0146] In another embodiment, the computing power network control node can use its task scheduling module to dynamically assess whether the current computing task is running stably, taking into account the resources of the current computing power node and the computing power network control node.

[0147] Furthermore, if security risks are a primary concern, the computing power network control node can be further integrated with the security monitoring modules deployed on the computing power nodes. Based on the security detection outputs provided, it can determine whether there are risks such as external intrusion or exposure of covert channels, and determine the level of risk. Weighting node availability score and risk level This determines whether to migrate the current computing task. For example, if the node availability score is lower than a preset score threshold and the risk level is higher than a preset risk threshold, it is determined to enter the migration preparation stage.

[0148] In another embodiment, the computing power network control node can also determine if a computing power node has a resource bottleneck (i.e., node availability score). Below a certain migration threshold When delays exceed limits or an attack risk is encountered, the system is determined to enter the migration preparation phase.

[0149] The watermark embedding parameters are dynamically adjusted based on the real-time resource status of CPU, memory, bandwidth, etc., to achieve a balance between performance and traceability concealment.

[0150] After determining that the migration preparation phase has begun, the computing power network control node can designate the computing power node as the first computing power node and issue a task data migration instruction to it. This task data migration instruction instructs the first computing power node to transfer the task context of a specified task running on it to a specified second computing power node. It should be noted that the task data migration instruction may include not only the specified task and the specified second computing power node, but also the DataID of the specified task.

[0151] Furthermore, the first computing node that receives the task data migration instruction can respond to the task data migration instruction and export the complete status information of the task specified in the task data migration instruction as the task context through the task context export module.

[0152] The task context includes the running state. Data status External dependencies With task identifier One or more of them.

[0153] In one embodiment, the task context includes at least the running state, data state, external dependencies, and task identifier.

[0154] The runtime status includes memory snapshots, program counter (PC), stack, and other information; the data status includes temporary data and intermediate results; external dependencies include file, network connection, channel, peripheral device, and other dependencies; the task identifier is a unique hidden task identifier generated by computation task T, calculated in the following way: ; Where H() represents hash operation; Indicates the submission timestamp of the computation task; The signature data representing the DataID of the computation task.

[0155] It should be noted that, to support security and robustness during migration, the first computing node can be based on a lightweight container or micro virtual machine, build migration units for the task context, and generate intermediate snapshots for interrupt recovery.

[0156] In addition, the first computing node can obtain the globally unique identifier of the specified task, the signature information of the first computing node itself, and the digest information obtained by hashing the task context.

[0157] After obtaining the globally unique identifier of the specified task, the signature information of the first computing node, and the summary information based on the task context, the first computing node can generate a data identifier (TDI) for this migration.

[0158] Furthermore, by processing this data identifier, a web watermark can be obtained.

[0159] Furthermore, the first computing node can divide the network watermark into multiple sets of sequences and the task context into multiple segments of data. Then, different segments of the task context can be modulated using different sets of sequences. In this way, the network watermark can be implicitly embedded into the task context without modifying the task context itself, thus obtaining the modulated data.

[0160] Furthermore, the first computing node can first determine the data packet transmission order of each group of data in the modulated data based on the network watermark, and then transmit each group of data to the second computing node specified in the task data migration instruction according to the corresponding data packet transmission order. Each group of data may include multiple data packets.

[0161] Furthermore, the second computing node can receive modulated data transmitted in packets by the first computing node.

[0162] Furthermore, the second computing node can reconstruct the original task context and network watermark using the modulation data from each group of the demodulation module. After reconstructing the TDI based on the network watermark, it can then reconstruct the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context.

[0163] Then, the second computing node verifies the received modulated data by comparing the node signature and the task context digest information, and obtains the verification result as either successful or unsuccessful.

[0164] In one embodiment, the second computing node can use the public key of the first node to decrypt and verify the restored node signature, thereby determining whether the TDI was indeed issued by the source node claimed by the TDI, and not forged by a malicious node. Furthermore, the second computing node can calculate the hash value of the received complete task context and compare it with the digest information of the restored task context, thereby determining whether the task context has been erroneous or tampered with.

[0165] Furthermore, once it is determined that the node signature and digest information have passed verification, the modulation data has also passed verification. At this point, the task can be restored using the restored task context.

[0166] Specifically, the second computing node can create a runtime environment (such as a container or virtual machine) on the target node that is compatible with the source node, based on information from the task context. The received task context is loaded into the new environment, and the program counter (PC) is restored to the position at the time of the interruption. Thus, the CPU begins execution from the instruction address pointed to by the PC, and the computing task seamlessly resumes execution from the precise breakpoint, without the user being aware of this migration process.

[0167] Specifically, the second computing node can use a demodulation module to unpack and reassemble the received data set one by one through the following process: Watermark detection: The watermark detection module identifies and correctly restores embedded network watermark information from network traffic. The key steps involved are as follows: Session segmentation: First, the detector divides the entire network traffic into multiple independent session flows based on the packet's five-tuple information (source IP address, destination IP address, source port, destination port, and transport layer protocol), denoted as... each It is treated as an independent detection unit, and watermark extraction and analysis are performed separately.

[0168] Detection group traversal: For each session stream The detector uses a sliding window of length n to buffer the identification field of IP packets into n packet groups, extracts the IP ID values ​​of all IP packets in the window, and constructs the original IP ID sequence: .

[0169] Detection set matching After the standardized sequence (seq) is generated, it is matched against a predefined detection set (DS). If the seq is in the DS, it means that the sliding window has successfully detected a valid network watermark segment (i.e., watermark sequence). If no network watermark is detected, the oldest IP ID in the window is removed and the window is cached again.

[0170] Watermark reconstruction and restoration: The detector can progressively identify all embedded watermark segments (i.e., all watermark sequences) within the session stream. The watermark segments are then concatenated sequentially according to the detection order, ultimately restoring the original network watermark. , in W represents the i-th watermark sequence. i .

[0171] Watermark demodulation function: ; Where, p i This represents the i-th group of data in the modulation data. The modulation function is denoted by Dec(); the decompression function is denoted by d. i This represents the demodulated data of the i-th group of data in the modulation data.

[0172] In addition, information reorganization of the task context is performed.

[0173] Furthermore, the second computing node can enable error correction mechanisms (such as Reed-Solomon) to deal with packet loss and ensure that the context recovery rate reaches 99.9%.

[0174] At the same time, an anonymous acknowledgment (ACK) channel is introduced to complete channel synchronization acknowledgment and notify the source node (i.e., the first computing power node) of successful migration.

[0175] In other words, once the computing task has been fully rebuilt and verified, the second computing node can automatically send a channel confirmation message to the control and orchestration management unit of the computing network control node, indicating that the migration operation has been completed and the task can continue to run.

[0176] Therefore, by maintaining the inheritance and continuous embedding of the watermark context before and after the migration of computing power tasks, the cross-node traceability chain is ensured to remain uninterrupted.

[0177] Figure 2 This is a flowchart illustrating the watermark detection process in the task data migration method provided in this application embodiment, as shown below. Figure 2 As shown, in one embodiment, after detection begins, initialization can be performed and network packets containing modulated data sent by the first computing node can be received. Further, it can be determined whether the buffer is full; if not, a copy of the current packet's IPID is stored. If so, the IPID in the current window is normalized, and the normalized result is matched against the detection set. If a match is successful, the sliding window buffer is cleared, and watermark information is appended to L. If a match is unsuccessful, the oldest IPID is discarded, and network packets are received again.

[0178] Therefore, by constructing a data identification structure with computing power awareness, task binding, and migration tracking capabilities, and combining network watermarking embedding technology with gateway collaboration mechanisms, end-to-end, full-path, verifiable traceability of data flow in the computing power network can be achieved, enhancing the controllability, security, and full lifecycle traceability of data.

[0179] It should be further noted that if the computing network control node receives a channel acknowledgment response, it automatically updates the task scheduling table in the system and clears the task context of the source node to avoid redundant computation or duplicate resource usage. Simultaneously, the new task identifier and status synchronization information will be stored as event records in the task tracing log for future auditing, arbitration, or backtracking purposes.

[0180] According to the task data migration method of this application embodiment, after receiving a task data migration instruction, the first computing node can respond to the task data migration instruction and determine the task context of the task specified in the task data migration instruction, which includes at least one of the following: running state, data state, external dependencies, and task identifier; and generate a network watermark based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. Thus, by modulating the task context based on the network watermark, the network watermark can be implicitly embedded into the task context without modifying the task context itself. Furthermore, since the formation of the network watermark considers not only the globally unique identifier of the task and the digest information based on the task context, but also the signature information of the first computing node, transmitting the modulated data to the second computing node specified in the task data migration instruction can achieve the transmission of the network watermark through implicit embedding without modifying the migrated data itself. This not only completes the cross-node migration of task data in the computing network, but also enables subsequent traceability of migration information through the network watermark, effectively improving the security of task data migration in the computing network.

[0181] It should be noted that, in order to ensure the verifiability and reliable traceability of the task data migration process, this application generates the following multiple identifiers during task initialization and migration: Data Identifier (DID): Calculate the hash using the data fragment and its associated task: ; in, The data identifier represents the i-th data segment; This represents the i-th data segment; Indicates a unique covert mission identifier; This indicates the initial computing node location.

[0182] Migration Log Chain (MLog): Each migration action generates a chain of records: ; in, This indicates the nth migration; This indicates the (n-1)th migration; Indicates the migration timestamp; This indicates the target computing node for migration.

[0183] All logs are written to a private chain (or consortium chain) and indexed and arbitrated using a Merkle Tree structure.

[0184] When there are complex paths such as multi-hop migrations and hidden link traversals, this mechanism can support accurate data / task location and responsibility attribution.

[0185] In one embodiment, the first computing node may use the globally unique identifier of the specified task, the signature information of the first computing node, and the summary information based on the task context as the data identifier (TDI) for this migration.

[0186] Furthermore, the first computing node can convert the data identifier, thereby obtaining the network watermark.

[0187] Specifically, the first computing node can convert the data identifier into binary data and use the converted data as a network watermark.

[0188] This application generates a network watermark using information such as the globally unique identifier of the specified task, the signature information of the first computing power node, and the digest information based on the task context. This allows the network watermark to be implicitly embedded into the task context without modifying the task context itself. Furthermore, since the formation of the network watermark considers not only the globally unique identifier of the task and the digest information based on the task context, but also the signature information of the first computing power node, transmitting the modulated data to the second computing power node specified in the task data migration instruction allows for the transmission of the network watermark through implicit embedding without modifying the migrated data itself. This not only completes the cross-node migration of task data in the computing power network, but also enables subsequent traceability of migration information through the network watermark, effectively improving the security of task data migration in the computing power network.

[0189] It should be noted that the Data Identifier (TDI) in this application can be extracted and verified multiple times throughout the entire task lifecycle, ensuring that every migration of the task can be traced on the blockchain. All TDIs and related communication records will be written to the task log center, and if necessary, can also be synchronously written to the blockchain system for immutable evidence storage. In the event of malicious tampering, migration failure, or abnormal task loss, the task identifier and communication link can be used to trace back to the last migration point, re-triggering the scheduling and migration process, ensuring the robustness and recoverability of the overall system.

[0190] This application designs a lightweight embedding and synchronization mechanism that balances jitter resistance, packet loss resistance, and adaptability to heterogeneous environments.

[0191] In one embodiment, the first computing node can construct a covert channel and perform data modulation based on a stegwriter using a covert channel construction module.

[0192] The covert channel construction module constructs a data channel suitable for watermark / steganography transmission based on network topology and available paths.

[0193] Therefore, multipath perturbation modulation can be applied to the task context. Specifically, the task context can be encapsulated into a portable data container as follows: ; in, Indicates the running status; Indicates data status; Indicates external dependency; Indicates the task identifier.

[0194] Data containers can be created based on lightweight sandboxes, virtual machine images, or system-level thread encapsulation structures.

[0195] Furthermore, by employing unequal-length packets and random path distribution, the data container is divided into at least two task context segments, thus forming a set composed of each task context segment. .

[0196] Furthermore, the network watermark is sequenced to obtain a set of watermark sequences that is the same number as the task context fragments. This completes the network watermark encoding, ensuring recognizability and robustness.

[0197] Furthermore, for each task context segment, modulated data is obtained by using a watermark sequence. Specifically, this can be accomplished as follows: ; in, This represents a compression encryption function, such as the common AES function plus Huffman coding; This is the context fragment for the i-th task; Represents the i-th watermark sequence; This represents the modulation function.

[0198] In other words, this application embeds a steganographic transmission path into a regular service link by constructing network watermarks, synchronization beacons, and network IP packet modulation. Specific methods include using key technologies such as session packet IPID reordering, multi-packet IP packet encoding mapping, and robust collision detection set (DS). A robustly identifiable channel is constructed in the actual data packet stream, and the task context and data identifiers are modulated into a stealth stream format using a flow encoder. To enhance anti-interference and anti-packet loss capabilities, redundant coding and error correction mechanisms are employed, embedding recovery reference points and synchronization control watermarks while distributing data along multiple paths.

[0199] This application modulates the task context through network watermarking, so that the network watermark only applies to transmission behavior characteristics (such as timing, interval, and load) and does not modify the business data content itself, thus ensuring data integrity.

[0200] In one embodiment, the first computing node can generate additional error correction code packets for each group of data in the modulation data and add them to the corresponding group of data as forward error correction codes. Thus, even if some data packets are lost during transmission, the receiver can use the received error correction code packets and the remaining data packets to restore all the original data through the decoding algorithm.

[0201] Furthermore, a lightweight hash checksum can be calculated for each group of data in the modulated data and added as a checksum to the corresponding group of data. This allows the receiver to immediately verify whether the received data segment is complete and error-free.

[0202] Furthermore, an incremental sequence number can be assigned to each group of data in the modulated data to achieve anti-out-of-order and anti-replay; and special, known synchronization bit patterns can be periodically inserted at the beginning of the modulated data stream and during transmission, thereby embedding synchronization beacons to help the receiver accurately determine the start and end of a data block.

[0203] Based on this, the data to be transmitted can be obtained.

[0204] Furthermore, the first computing node can determine the data packet transmission order of the corresponding group of modulated data based on each watermark sequence in the network watermark. Specifically, the data packet transmission order of each group of data can be determined by each watermark sequence in conjunction with Table 1 below: Table 1 ; The identification information can be determined by the watermark sequence, and the numbers in the modulation code table indicate the transmission order of the data packets. For example, (1,2,6,5,4,3) means that six data packets in a set of data are transmitted in the order of the first, second, sixth, fifth, fourth and third.

[0205] Thus, the construction of the covert channel is completed.

[0206] Furthermore, for each group of data in the modulated data, the data packets within that group are transmitted to the second computing node specified in the task data migration instruction according to their corresponding transmission order. This allows the receiver to intercept the data transmission communication IP packet stream of the first computing node at the network layer. And extract the 16-bit IP identification field -- IP ID -- from each message.

[0207] Figure 3This is a schematic diagram of the watermark embedding process in the covert channel of the task data migration method provided in this application embodiment, as shown below. Figure 3 As shown, in one embodiment, after initializing the parameters, network packets are received. Upon receiving a packet, it is determined whether M (the initial value of M is the same as the number of modulation data packets) is equal to 0. If yes, the watermark embedding is considered complete, and the process terminates. If no, it is determined whether watermark embedding should be performed. If yes, n packets (the specific value can be preset according to requirements) are continuously buffered, their order is adjusted according to the mapping relationship, and they are sent. Then, M is decremented by one. If no, the packet is forwarded, and network packets are received again.

[0208] Therefore, the task context, data identifiers, and other content are watermarked and encoded into a steganographic format according to actual needs, and then transmitted step by step through this covert channel.

[0209] This application ensures that the covert channel can not only transmit secrets, but also transmit reliably in complex and unreliable real network environments, and transmit undetected in adversarial environments.

[0210] In one embodiment, the task data migration method further includes: Obtain the resource status data of the first computing node; the resource status data includes at least one of the following: CPU idle rate, memory utilization, and node load; Based on resource status data, determine the node availability score of the first computing power node; If the node availability score is lower than the preset score threshold, a task data migration instruction is issued to the first computing power node; the task data migration instruction is used to instruct the first computing power node to transfer the task context to the second computing power node. Upon receiving the task data migration instruction, the first computing node performs the following steps: In response to a task data migration instruction, determine the task context of the task specified in the task data migration instruction; the task context includes at least one of runtime state, data state, external dependencies, and task identifier. A network watermark is generated based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. Modulated data is obtained by modulating the task context based on network watermarking; Transmit the modulated data to the second computing node specified in the task data migration instruction.

[0211] It should be noted that the execution entity of the task data migration method provided in this application embodiment can be a computing power network control node.

[0212] It should be further noted that the overall system in this application includes computing network users, computing power nodes, and computing power network control nodes.

[0213] In this context, computing network users are consumers of computing power services, also known as tenants, and can submit computing tasks (such as artificial intelligence model training, big data analysis, scientific computing, etc.) to the computing network control nodes. Computing tasks can include specific task content, resource requirements, and service quality requirements (such as deadlines and budgets).

[0214] The computing network control node is responsible for the unified scheduling, management, and orchestration of all network resources. Specifically, it can monitor the resource status of all connected computing nodes in real time (including but not limited to CPU utilization, memory utilization, node load, network bandwidth, etc.) to form a global resource view. Furthermore, based on the computing network user's task requirements, node resource status, optimization strategies (such as minimum cost, minimum latency), and other computing task-related information, it can make initial scheduling decisions (which computing node to assign the task to) and migration decisions (when to migrate the task from the current computing node to another computing node). Additionally, it can receive and record task migration events from each computing node, maintain a global log of tasks throughout their lifecycle, and provide centralized query support for auditing and traceability.

[0215] Computing nodes can receive computing tasks from the computing network control node, provide computing resources such as CPU, memory, and graphics processing units (GPUs), and create secure runtime environments (such as containers or virtual machines) to execute the relevant computing tasks. Simultaneously, they monitor local resource consumption and task execution status in real time and report to the computing network control node periodically; that is, they must at least report resource status data to the computing network control node. Furthermore, upon receiving a task data migration instruction from the computing network control node, they transfer the task context of the specified task to another specified computing node. In other words, when task data migration is required, the computing nodes in this application can include a first computing node and a second computing node. The first computing node is the original processing node (i.e., the migration-out node) for the specified task, while the second computing node is the receiving node (i.e., the migration-in node) for the specified task.

[0216] Specifically, when a computing power user submits a computing task to the computing power network control node, the computing power network control node automatically generates a globally unique identifier (Data Identifier, DataID) for each computing task. The content of this identifier includes, but is not limited to: Task ID, Tenant ID, Submission Timestamp, Initial Computing Node Location (NodeID / IP), Task Type and Model Summary (Hash), Source Watermark Fingerprint (Watermark).

[0217] The computing power network control node can encapsulate the above information into a globally unique identifier using the following format: ; Where Hash{} represents a hash operation; TaskID1 represents the ID of the first task; TenantID2 represents the information of the second tenant; H data This indicates the task type and model summary.

[0218] Secondly, the computing power network control node further signs the DataID: Specifically, the computing power network control node is based on a public-private key system. It uses the private key to sign the DataID (Signature = SM2_Sign(DataID, PrivateKey)). Subsequently, the computing power node can verify the legality of the signature through the corresponding public key to ensure that the identifier has not been tampered with.

[0219] This globally unique identifier is generated through a hash or signature mechanism and can be embedded in the task's runtime context and data blocks, serving as the core basis for subsequent task migration, channel synchronization, and responsibility allocation.

[0220] In other words, this globally unique identifier can be embedded in task logs, model weights, input data fragments, etc., using digital watermarking or structured steganography to ensure that it is not easily detected or tampered with.

[0221] Furthermore, the computing power network control node can periodically collect resource status data of each computing power node through the computing power monitoring agent (ComputeAgent) deployed on each computing power node, forming the following computing power description tuple: ; in, This represents the CPU idle rate of computing node i; This represents the memory usage rate of computing node i; This represents the network bandwidth utilization rate of computing node i; This represents the node load of computing node i.

[0222] Furthermore, the computing power network control node can calculate the node availability score of each computing power node through its control and orchestration management unit. : ; in, , is an adjustable parameter of the strategy.

[0223] In one embodiment, if the node availability score of the computing node where any computing task resides... Below a certain migration threshold (This can be referred to as a preset scoring threshold in this application), which triggers the task migration process, designates the computing power node as the first computing power node, and issues a task data migration instruction to it. Thus, the task data migration instruction instructs the first computing power node to transfer the task context of the specified task running thereto to the specified second computing power node.

[0224] Regarding the determination process of the second computing power node, this application does not impose specific limitations, and the designated second computing power node can be determined in various feasible ways. For example, the computing power node with the highest node availability score can be designated as the designated second computing power node, or the computing power node with a node availability score higher than a preset score threshold and a distance from the first computing power node less than a preset distance threshold can be designated as the designated second computing power node.

[0225] In another embodiment, the computing power network control node can use its task scheduling module to dynamically assess whether the current computing task is running stably, taking into account the resources of the current computing power node and the computing power network control node.

[0226] Furthermore, if security risks are a primary concern, the computing power network control node can be further integrated with the security monitoring modules deployed on the computing power nodes. Based on the security detection outputs provided, it can determine whether there are risks such as external intrusion or exposure of covert channels, and determine the level of risk. Weighting node availability score and risk level This determines whether to migrate the current computing task. For example, if the node availability score is lower than a preset score threshold and the risk level is higher than a preset risk threshold, it is determined to enter the migration preparation stage.

[0227] In another embodiment, the computing power network control node can also determine if a computing power node has a resource bottleneck (i.e., node availability score). Below a certain migration threshold When delays exceed limits or an attack risk is encountered, the system is determined to enter the migration preparation phase.

[0228] The watermark embedding parameters are dynamically adjusted based on the real-time resource status of CPU, memory, bandwidth, etc., to achieve a balance between performance and traceability concealment.

[0229] After determining that the migration preparation phase has begun, the computing power network control node can designate the computing power node as the first computing power node and issue a task data migration instruction to it. This task data migration instruction instructs the first computing power node to transfer the task context of a specified task running on it to a specified second computing power node. It should be noted that the task data migration instruction may include not only the specified task and the specified second computing power node, but also the DataID of the specified task.

[0230] Furthermore, the first computing node that receives the task data migration instruction can respond to the task data migration instruction and export the complete status information of the task specified in the task data migration instruction as the task context through the task context export module.

[0231] The task context includes the running state. Data status External dependencies With task identifier One or more of them.

[0232] In one embodiment, the task context includes at least the running state, data state, external dependencies, and task identifier.

[0233] The runtime status includes memory snapshots, program counter (PC), stack, and other information; the data status includes temporary data and intermediate results; external dependencies include file, network connection, channel, peripheral device, and other dependencies; the task identifier is a unique hidden task identifier generated by computation task T, calculated in the following way: ; Where H() represents hash operation; Indicates the submission timestamp of the computation task; The signature data representing the DataID of the computation task.

[0234] It should be noted that, to support security and robustness during migration, the first computing node can be based on a lightweight container or micro virtual machine, build migration units for the task context, and generate intermediate snapshots for interrupt recovery.

[0235] In addition, the first computing node can obtain the globally unique identifier of the specified task, the signature information of the first computing node itself, and the digest information obtained by hashing the task context.

[0236] After obtaining the globally unique identifier of the specified task, the signature information of the first computing node, and the summary information based on the task context, the first computing node can generate a data identifier (TDI) for this migration.

[0237] Furthermore, by processing this data identifier, a web watermark can be obtained.

[0238] Furthermore, the first computing node can divide the network watermark into multiple sets of sequences and the task context into multiple segments of data. Then, different segments of the task context can be modulated using different sets of sequences. In this way, the network watermark can be implicitly embedded into the task context without modifying the task context itself, thus obtaining the modulated data.

[0239] Furthermore, the first computing node can first determine the data packet transmission order of each group of data in the modulated data based on the network watermark, and then transmit each group of data to the second computing node specified in the task data migration instruction according to the corresponding data packet transmission order. Each group of data may include multiple data packets.

[0240] Furthermore, the second computing node can receive modulated data transmitted in packets by the first computing node.

[0241] Furthermore, the second computing node can reconstruct the original task context and network watermark using the modulation data from each group of the demodulation module. After reconstructing the TDI based on the network watermark, it can then reconstruct the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context.

[0242] Then, the second computing node verifies the received modulated data by comparing the node signature and the task context digest information, and obtains the verification result as either successful or unsuccessful.

[0243] In one embodiment, the second computing node can use the public key of the first node to decrypt and verify the restored node signature, thereby determining whether the TDI was indeed issued by the source node claimed by the TDI, and not forged by a malicious node. Furthermore, the second computing node can calculate the hash value of the received complete task context and compare it with the digest information of the restored task context, thereby determining whether the task context has been erroneous or tampered with.

[0244] Furthermore, once it is determined that the node signature and digest information have passed verification, the modulation data has also passed verification. At this point, the task can be restored using the restored task context.

[0245] Specifically, the second computing node can create a runtime environment (such as a container or virtual machine) on the target node that is compatible with the source node, based on information from the task context. The received task context is loaded into the new environment, and the program counter (PC) is restored to the position at the time of the interruption. Thus, the CPU begins execution from the instruction address pointed to by the PC, and the computing task seamlessly resumes execution from the precise breakpoint, without the user being aware of this migration process.

[0246] Specifically, the second computing node can use a demodulation module to unpack and reassemble the received data set one by one through the following process: Watermark detection: The watermark detection module identifies and correctly restores embedded network watermark information from network traffic. The key steps involved are as follows: Session segmentation: First, the detector divides the entire network traffic into multiple independent session flows based on the packet's five-tuple information (source IP address, destination IP address, source port, destination port, and transport layer protocol), denoted as... each It is treated as an independent detection unit, and watermark extraction and analysis are performed separately.

[0247] Detection group traversal: For each session stream The detector uses a sliding window of length n to buffer the identification field of IP packets into n packet groups, extracts the IP ID values ​​of all IP packets in the window, and constructs the original IP ID sequence: .

[0248] Detection set matching After the standardized sequence (seq) is generated, it is matched against a predefined detection set (DS). If the seq is in the DS, it means that the sliding window has successfully detected a valid network watermark segment (i.e., watermark sequence). If no network watermark is detected, the oldest IP ID in the window is removed and the window is cached again.

[0249] Watermark reconstruction and restoration: The detector can progressively identify all embedded watermark segments (i.e., all watermark sequences) within the session stream. The watermark segments are then concatenated sequentially according to the detection order, ultimately restoring the original network watermark. , in W represents the i-th watermark sequence. i .

[0250] Watermark demodulation function: ; Where, p i This represents the i-th group of data in the modulation data. The modulation function is denoted by Dec(); the decompression function is denoted by d. i This represents the demodulated data of the i-th group of data in the modulation data.

[0251] In addition, information reorganization of the task context is performed.

[0252] Furthermore, the second computing node can enable error correction mechanisms (such as Reed-Solomon) to deal with packet loss and ensure that the context recovery rate reaches 99.9%.

[0253] At the same time, an anonymous acknowledgment (ACK) channel is introduced to complete channel synchronization acknowledgment and notify the source node (i.e., the first computing power node) of successful migration.

[0254] In other words, once the computing task has been fully rebuilt and verified, the second computing node can automatically send a channel confirmation message to the control and orchestration management unit of the computing network control node, indicating that the migration operation has been completed and the task can continue to run.

[0255] Therefore, by maintaining the inheritance and continuous embedding of the watermark context before and after the migration of computing power tasks, the cross-node traceability chain is ensured to remain uninterrupted.

[0256] Figure 2 This is a flowchart illustrating the watermark detection process in the task data migration method provided in this application embodiment, as shown below. Figure 2 As shown, in one embodiment, after detection begins, initialization can be performed and network packets containing modulated data sent by the first computing node can be received. Further, it can be determined whether the buffer is full; if not, a copy of the current packet's IPID is stored. If so, the IPID in the current window is normalized, and the normalized result is matched against the detection set. If a match is successful, the sliding window buffer is cleared, and watermark information is appended to L. If a match is unsuccessful, the oldest IPID is discarded, and network packets are received again.

[0257] Therefore, by constructing a data identification structure with computing power awareness, task binding, and migration tracking capabilities, and combining network watermarking embedding technology with gateway collaboration mechanisms, end-to-end, full-path, verifiable traceability of data flow in the computing power network can be achieved, enhancing the controllability, security, and full lifecycle traceability of data.

[0258] It should be further noted that if the computing network control node receives a channel acknowledgment response, it automatically updates the task scheduling table in the system and clears the task context of the source node to avoid redundant computation or duplicate resource usage. Simultaneously, the new task identifier and status synchronization information will be stored as event records in the task tracing log for future auditing, arbitration, or backtracking purposes.

[0259] According to the task data migration method of this application embodiment, after receiving a task data migration instruction, the first computing node can respond to the task data migration instruction and determine the task context of the task specified in the task data migration instruction, which includes at least one of the following: running state, data state, external dependencies, and task identifier; and generate a network watermark based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. Thus, by modulating the task context based on the network watermark, the network watermark can be implicitly embedded into the task context without modifying the task context itself. Furthermore, since the formation of the network watermark considers not only the globally unique identifier of the task and the digest information based on the task context, but also the signature information of the first computing node, transmitting the modulated data to the second computing node specified in the task data migration instruction can achieve the transmission of the network watermark through implicit embedding without modifying the migrated data itself. This not only completes the cross-node migration of task data in the computing network, but also enables subsequent traceability of migration information through the network watermark, effectively improving the security of task data migration in the computing network.

[0260] It should be noted that, in order to ensure the verifiability and reliable traceability of the task data migration process, this application generates the following multiple identifiers during task initialization and migration: Data Identifier (DID): Calculate the hash using the data fragment and its associated task: ; in, The data identifier represents the i-th data segment; This represents the i-th data segment; Indicates a unique covert mission identifier; This indicates the initial computing node location.

[0261] Migration Log Chain (MLog): Each migration action generates a chain of records: ; in, This indicates the nth migration; This indicates the (n-1)th migration; Indicates the migration timestamp; This indicates the target computing node for migration.

[0262] All logs are written to a private chain (or consortium chain) and indexed and arbitrated using a Merkle Tree structure.

[0263] When there are complex paths such as multi-hop migrations and hidden link traversals, this mechanism can support accurate data / task location and responsibility attribution.

[0264] In one embodiment, the first computing node may use the globally unique identifier of the specified task, the signature information of the first computing node, and the summary information based on the task context as the data identifier (TDI) for this migration.

[0265] Furthermore, the first computing node can convert the data identifier, thereby obtaining the network watermark.

[0266] Specifically, the first computing node can convert the data identifier into binary data and use the converted data as a network watermark.

[0267] This application generates a network watermark using information such as the globally unique identifier of the specified task, the signature information of the first computing power node, and the digest information based on the task context. This allows the network watermark to be implicitly embedded into the task context without modifying the task context itself. Furthermore, since the formation of the network watermark considers not only the globally unique identifier of the task and the digest information based on the task context, but also the signature information of the first computing power node, transmitting the modulated data to the second computing power node specified in the task data migration instruction allows for the transmission of the network watermark through implicit embedding without modifying the migrated data itself. This not only completes the cross-node migration of task data in the computing power network, but also enables subsequent traceability of migration information through the network watermark, effectively improving the security of task data migration in the computing power network.

[0268] It should be noted that the Data Identifier (TDI) in this application can be extracted and verified multiple times throughout the entire task lifecycle, ensuring that every migration of the task can be traced on the blockchain. All TDIs and related communication records will be written to the task log center, and if necessary, can also be synchronously written to the blockchain system for immutable evidence storage. In the event of malicious tampering, migration failure, or abnormal task loss, the task identifier and communication link can be used to trace back to the last migration point, re-triggering the scheduling and migration process, ensuring the robustness and recoverability of the overall system.

[0269] This application designs a lightweight embedding and synchronization mechanism that balances jitter resistance, packet loss resistance, and adaptability to heterogeneous environments.

[0270] In one embodiment, the first computing node can construct a covert channel and perform data modulation based on a stegwriter using a covert channel construction module.

[0271] The covert channel construction module constructs a data channel suitable for watermark / steganography transmission based on network topology and available paths.

[0272] Therefore, multipath perturbation modulation can be applied to the task context. Specifically, the task context can be encapsulated into a portable data container as follows: ; in, Indicates the running status; Indicates data status; Indicates external dependency; Indicates the task identifier.

[0273] Data containers can be created based on lightweight sandboxes, virtual machine images, or system-level thread encapsulation structures.

[0274] Furthermore, by employing unequal-length packets and random path distribution, the data container is divided into at least two task context segments, thus forming a set composed of each task context segment. .

[0275] Furthermore, the network watermark is sequenced to obtain a set of watermark sequences that is the same number as the task context fragments. This completes the network watermark encoding, ensuring recognizability and robustness.

[0276] Furthermore, for each task context segment, modulated data is obtained by using a watermark sequence. Specifically, this can be accomplished as follows: ; in, This represents a compression encryption function, such as the common AES function plus Huffman coding; This is the context fragment for the i-th task; Represents the i-th watermark sequence; This represents the modulation function.

[0277] In other words, this application embeds a steganographic transmission path into a regular service link by constructing network watermarks, synchronization beacons, and network IP packet modulation. Specific methods include using key technologies such as session packet IPID reordering, multi-packet IP packet encoding mapping, and robust collision detection set (DS). A robustly identifiable channel is constructed in the actual data packet stream, and the task context and data identifiers are modulated into a stealth stream format using a flow encoder. To enhance anti-interference and anti-packet loss capabilities, redundant coding and error correction mechanisms are employed, embedding recovery reference points and synchronization control watermarks while distributing data along multiple paths.

[0278] This application modulates the task context through network watermarking, so that the network watermark only applies to transmission behavior characteristics (such as timing, interval, and load) and does not modify the business data content itself, thus ensuring data integrity.

[0279] In one embodiment, the first computing node can generate additional error correction code packets for each group of data in the modulation data and add them to the corresponding group of data as forward error correction codes. Thus, even if some data packets are lost during transmission, the receiver can use the received error correction code packets and the remaining data packets to restore all the original data through the decoding algorithm.

[0280] Furthermore, a lightweight hash checksum can be calculated for each group of data in the modulated data and added as a checksum to the corresponding group of data. This allows the receiver to immediately verify whether the received data segment is complete and error-free.

[0281] Furthermore, an incremental sequence number can be assigned to each group of data in the modulated data to achieve anti-out-of-order and anti-replay; and special, known synchronization bit patterns can be periodically inserted at the beginning of the modulated data stream and during transmission, thereby embedding synchronization beacons to help the receiver accurately determine the start and end of a data block.

[0282] Based on this, the data to be transmitted can be obtained.

[0283] Furthermore, the first computing node can determine the data packet transmission order of the corresponding group of modulated data based on each watermark sequence in the network watermark. Specifically, the data packet transmission order of each group of data can be determined by each watermark sequence in conjunction with Table 1 below: Table 1 ; The identification information can be determined by the watermark sequence, and the numbers in the modulation code table indicate the transmission order of the data packets. For example, (1,2,6,5,4,3) means that six data packets in a set of data are transmitted in the order of the first, second, sixth, fifth, fourth and third.

[0284] Thus, the construction of the covert channel is completed.

[0285] Furthermore, for each group of data in the modulated data, the data packets within that group are transmitted to the second computing node specified in the task data migration instruction according to their corresponding transmission order. This allows the receiver to intercept the data transmission communication IP packet stream of the first computing node at the network layer. And extract the 16-bit IP identification field -- IP ID -- from each message.

[0286] Figure 3 This is a schematic diagram of the watermark embedding process in the covert channel of the task data migration method provided in this application embodiment, as shown below. Figure 3 As shown, in one embodiment, after initializing the parameters, network packets are received. Upon receiving a packet, it is determined whether M (the initial value of M is the same as the number of modulation data packets) is equal to 0. If yes, the watermark embedding is considered complete, and the process terminates. If no, it is determined whether watermark embedding should be performed. If yes, n packets (the specific value can be preset according to requirements) are continuously buffered, their order is adjusted according to the mapping relationship, and they are sent. Then, M is decremented by one. If no, the packet is forwarded, and network packets are received again.

[0287] Therefore, the task context, data identifiers, and other content are watermarked and encoded into a steganographic format according to actual needs, and then transmitted step by step through this covert channel.

[0288] This application ensures that the covert channel can not only transmit secrets, but also transmit reliably in complex and unreliable real network environments, and transmit undetected in adversarial environments.

[0289] The task data migration apparatus provided in this application is described below. The task data migration apparatus described below can be referred to in correspondence with the task data migration method described above.

[0290] Furthermore, this application also provides a task data migration apparatus.

[0291] The task data migration device includes: The first determining module is configured to, in response to a task data migration instruction, determine the task context of the task specified in the task data migration instruction; the task context includes at least one of running state, data state, external dependencies, and task identifier. The generation module is used to generate a network watermark based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. A modulation module is used to modulate the task context based on the network watermark to obtain modulated data; The transmission module is used to transmit the modulated data to the second computing node specified in the task data migration instruction.

[0292] The task data migration device of this application allows the first computing node to respond to a task data migration instruction upon receiving it. This response determines the task context of the specified task, including at least one of the following: running state, data state, external dependencies, and task identifier. A network watermark is generated based on the globally unique identifier of the specified task, the signature information of the first computing node, and a digest of the task context. By modulating the task context using the network watermark, the watermark can be implicitly embedded into the task context without modifying the task context itself. Furthermore, since the formation of the network watermark considers not only the globally unique identifier of the task and the digest information based on the task context but also the signature information of the first computing node, transmitting the modulated data to the second computing node specified in the task data migration instruction allows for the implicit embedding of the network watermark without modifying the migrated data. This not only completes the cross-node migration of task data in the computing network but also enables subsequent traceability of migration information through the network watermark, effectively improving the security of task data migration in the computing network.

[0293] In one embodiment, the task data migration apparatus further includes: The receiving module is used to receive modulated data transmitted by the first computing node; The verification module is used to perform data verification based on the modulation data and obtain the verification result; The task recovery module is used to perform task recovery based on the modulation data if the verification result is successful. The modulation data is transmitted by the first computing node in the following manner: In response to a task data migration instruction, the task context of the task specified in the task data migration instruction is determined; the task context includes at least one of running status, data status, external dependencies, and task identifier. A network watermark is generated based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. Based on the network watermark, the task context is modulated to obtain modulated data; The modulated data is transmitted to the second computing node specified in the task data migration instruction.

[0294] In one embodiment, the task data migration apparatus further includes: The acquisition module is used to acquire the resource status data of the first computing node; The second determining module is used to determine the node availability score of the first computing power node based on the resource status data. The sending module is used to send a task data migration instruction to the first computing power node when the node availability score is lower than a preset score threshold; the task data migration instruction is used to instruct the first computing power node to transfer the task context to the second computing power node. Upon receiving the task data migration instruction, the first computing node performs the following steps: In response to a task data migration instruction, the task context of the task specified in the task data migration instruction is determined; the task context includes at least one of running status, data status, external dependencies, and task identifier. A network watermark is generated based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. Based on the network watermark, the task context is modulated to obtain modulated data; The modulated data is transmitted to the second computing node specified in the task data migration instruction.

[0295] Figure 4 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 4 As shown, the electronic device may include a processor 410, a communications interface 420, a memory 430, and a communication bus 440, wherein the processor 410, the communications interface 420, and the memory 430 communicate with each other via the communication bus 440. The processor 410 may invoke logical instructions in the memory 430 to execute the following method: in response to a task data migration instruction, determining the task context of the task specified in the task data migration instruction; the task context includes at least one of running state, data state, external dependencies, and task identifier. A network watermark is generated based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. Based on the network watermark, the task context is modulated to obtain modulated data; The modulated data is transmitted to the second computing node specified in the task data migration instruction.

[0296] Or execute the following method: Receive modulated data transmitted by the first computing node; Data verification is performed based on the modulation data to obtain verification results; If the verification result is successful, task recovery is performed based on the modulation data; The modulation data is transmitted by the first computing node in the following manner: In response to a task data migration instruction, the task context of the task specified in the task data migration instruction is determined; the task context includes at least one of running status, data status, external dependencies, and task identifier. A network watermark is generated based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. Based on the network watermark, the task context is modulated to obtain modulated data; The modulated data is transmitted to the second computing node specified in the task data migration instruction.

[0297] Or execute the following method: Obtain resource status data of the first computing node; the resource status data includes at least one of the following: CPU idle rate, memory utilization rate, and node load; Based on the resource status data, determine the node availability score of the first computing power node; If the node availability score is lower than a preset score threshold, a task data migration instruction is issued to the first computing power node; the task data migration instruction is used to instruct the first computing power node to transfer the task context to the second computing power node. Upon receiving the task data migration instruction, the first computing node performs the following steps: In response to a task data migration instruction, the task context of the task specified in the task data migration instruction is determined; the task context includes at least one of running status, data status, external dependencies, and task identifier. A network watermark is generated based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. Based on the network watermark, the task context is modulated to obtain modulated data; The modulated data is transmitted to the second computing node specified in the task data migration instruction.

[0298] Furthermore, the logical instructions in the aforementioned memory 430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to related technologies, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0299] In another aspect, embodiments of this application also provide a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the methods provided in the above embodiments, including, for example,: in response to a task data migration instruction, determining the task context of a task specified in the task data migration instruction; the task context includes at least one of running state, data state, external dependencies, and task identifier; A network watermark is generated based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. Based on the network watermark, the task context is modulated to obtain modulated data; The modulated data is transmitted to the second computing node specified in the task data migration instruction.

[0300] Or include: Receive modulated data transmitted by the first computing node; Data verification is performed based on the modulation data to obtain verification results; If the verification result is successful, task recovery is performed based on the modulation data; The modulation data is transmitted by the first computing node in the following manner: In response to a task data migration instruction, the task context of the task specified in the task data migration instruction is determined; the task context includes at least one of running status, data status, external dependencies, and task identifier. A network watermark is generated based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. Based on the network watermark, the task context is modulated to obtain modulated data; The modulated data is transmitted to the second computing node specified in the task data migration instruction.

[0301] Or include: Obtain resource status data of the first computing node; the resource status data includes at least one of the following: CPU idle rate, memory utilization rate, and node load; Based on the resource status data, determine the node availability score of the first computing power node; If the node availability score is lower than a preset score threshold, a task data migration instruction is issued to the first computing power node; the task data migration instruction is used to instruct the first computing power node to transfer the task context to the second computing power node. Upon receiving the task data migration instruction, the first computing node performs the following steps: In response to a task data migration instruction, the task context of the task specified in the task data migration instruction is determined; the task context includes at least one of running status, data status, external dependencies, and task identifier. A network watermark is generated based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. Based on the network watermark, the task context is modulated to obtain modulated data; The modulated data is transmitted to the second computing node specified in the task data migration instruction.

[0302] In another aspect, embodiments of this application also provide a computer program product having a computer program stored thereon. When the computer program is executed by a processor, it is implemented to perform the methods provided in the above embodiments, such as including: in response to a task data migration instruction, determining the task context of the task specified in the task data migration instruction; the task context includes at least one of running state, data state, external dependencies, and task identifier; A network watermark is generated based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. Based on the network watermark, the task context is modulated to obtain modulated data; The modulated data is transmitted to the second computing node specified in the task data migration instruction.

[0303] Or include: Receive modulated data transmitted by the first computing node; Data verification is performed based on the modulation data to obtain verification results; If the verification result is successful, task recovery is performed based on the modulation data; The modulation data is transmitted by the first computing node in the following manner: In response to a task data migration instruction, the task context of the task specified in the task data migration instruction is determined; the task context includes at least one of running status, data status, external dependencies, and task identifier. A network watermark is generated based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. Based on the network watermark, the task context is modulated to obtain modulated data; The modulated data is transmitted to the second computing node specified in the task data migration instruction.

[0304] Or include: Obtain resource status data of the first computing node; the resource status data includes at least one of the following: CPU idle rate, memory utilization rate, and node load; Based on the resource status data, determine the node availability score of the first computing power node; If the node availability score is lower than a preset score threshold, a task data migration instruction is issued to the first computing power node; the task data migration instruction is used to instruct the first computing power node to transfer the task context to the second computing power node. Upon receiving the task data migration instruction, the first computing node performs the following steps: In response to a task data migration instruction, the task context of the task specified in the task data migration instruction is determined; the task context includes at least one of running status, data status, external dependencies, and task identifier. A network watermark is generated based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. Based on the network watermark, the task context is modulated to obtain modulated data; The modulated data is transmitted to the second computing node specified in the task data migration instruction.

[0305] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0306] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the parts that contribute to the related technology, can be embodied in the form of software products. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0307] Finally, it should be noted that the above embodiments are only used to illustrate this application and are not intended to limit this application. Although this application has been described in detail with reference to the embodiments, those skilled in the art should understand that various combinations, modifications, or equivalent substitutions of the technical solutions of this application do not depart from the spirit and scope of the technical solutions of this application.

Claims

1. A method for migrating task data, characterized in that, Applied to the first computing node, the task data migration method includes: In response to a task data migration instruction, the task context of the task specified in the task data migration instruction is determined; the task context includes at least one of running status, data status, external dependencies, and task identifier. A network watermark is generated based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. Based on the network watermark, the task context is modulated to obtain modulated data; The modulated data is transmitted to the second computing node specified in the task data migration instruction.

2. The task data migration method according to claim 1, characterized in that, The step of generating a network watermark based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context includes: A data identifier is generated based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context; A network watermark is generated based on the data identifier.

3. The task data migration method according to claim 1, characterized in that, The step of transmitting the modulated data to the second computing node specified in the task data migration instruction includes: The modulation data is configured with forward error correction coding, a checksum, a sequence number, and a synchronization beacon to obtain the data to be transmitted. The data to be transferred is transmitted to the second computing node specified in the task data migration instruction.

4. The task data migration method according to claim 3, characterized in that, The step of transmitting the data to be transferred to the second computing node specified in the task data migration instruction includes: Based on the network watermark, the data packet transmission order of each group of data in the data to be transmitted is determined respectively; Each data packet is transmitted to the second computing node specified in the task data migration instruction according to the corresponding data packet transmission order.

5. The task data migration method according to claim 1, characterized in that, The modulation of the task context based on the network watermark to obtain modulated data includes: The task context is segmented to obtain at least two task context fragments; The network watermark is segmented into a sequence to obtain a watermark sequence with the same number of task context segments; For each of the task context segments, modulated data is obtained by modulating it using one of the watermark sequences.

6. The task data migration method according to claim 5, characterized in that, The task context is segmented to obtain at least two task context fragments, including: The task context is encapsulated as a data container; The data container is segmented to obtain at least two task context fragments.

7. A method for migrating task data, characterized in that, Applied to the second computing node, the task data migration method includes: Receive modulated data transmitted by the first computing node; Data verification is performed based on the modulation data to obtain verification results; If the verification result is successful, task recovery is performed based on the modulation data; The modulation data is transmitted by the first computing node in the following manner: In response to a task data migration instruction, the task context of the task specified in the task data migration instruction is determined; the task context includes at least one of running status, data status, external dependencies, and task identifier. A network watermark is generated based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. Based on the network watermark, the task context is modulated to obtain modulated data; The modulated data is transmitted to the second computing node specified in the task data migration instruction.

8. A method for migrating task data, characterized in that, The task data migration method, applied to the control node of a computing network, includes: Obtain resource status data of the first computing node; the resource status data includes at least one of the following: CPU idle rate, memory utilization rate, and node load; Based on the resource status data, determine the node availability score of the first computing power node; If the node availability score is lower than a preset score threshold, a task data migration instruction is issued to the first computing power node; the task data migration instruction is used to instruct the first computing power node to transfer the task context to the second computing power node. Upon receiving the task data migration instruction, the first computing node performs the following steps: In response to a task data migration instruction, the task context of the task specified in the task data migration instruction is determined; the task context includes at least one of running status, data status, external dependencies, and task identifier. A network watermark is generated based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. Based on the network watermark, the task context is modulated to obtain modulated data; The modulated data is transmitted to the second computing node specified in the task data migration instruction.

9. A task data migration device, characterized in that, include: The first determining module is used to determine the task context of the task specified in the task data migration instruction in response to the task data migration instruction. The task context includes at least one of the following: running state, data state, external dependencies, and task identifier; The generation module is used to generate a network watermark based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. A modulation module is used to modulate the task context based on the network watermark to obtain modulated data; The transmission module is used to transmit the modulated data to the second computing node specified in the task data migration instruction.

10. A task data migration device, characterized in that, include: The receiving module is used to receive modulated data transmitted by the first computing node; The verification module is used to perform data verification based on the modulation data and obtain the verification result; The task recovery module is used to perform task recovery based on the modulation data if the verification result is successful. The modulation data is transmitted by the first computing node in the following manner: In response to a task data migration instruction, the task context of the task specified in the task data migration instruction is determined; the task context includes at least one of running status, data status, external dependencies, and task identifier. A network watermark is generated based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. Based on the network watermark, the task context is modulated to obtain modulated data; The modulated data is transmitted to the second computing node specified in the task data migration instruction.

11. A task data migration device, characterized in that, include: The acquisition module is used to acquire the resource status data of the first computing node; The second determining module is used to determine the node availability score of the first computing power node based on the resource status data. The sending module is used to send a task data migration instruction to the first computing power node when the node availability score is lower than a preset score threshold; the task data migration instruction is used to instruct the first computing power node to transfer the task context to the second computing power node. Upon receiving the task data migration instruction, the first computing node performs the following steps: In response to a task data migration instruction, the task context of the task specified in the task data migration instruction is determined; the task context includes at least one of running status, data status, external dependencies, and task identifier. A network watermark is generated based on the globally unique identifier of the specified task, the signature information of the first computing node, and the digest information based on the task context. Based on the network watermark, the task context is modulated to obtain modulated data; The modulated data is transmitted to the second computing node specified in the task data migration instruction.

12. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the task data migration method as described in any one of claims 1 to 8.

13. A storage medium, said storage medium being a non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the task data migration method as described in any one of claims 1 to 8.

14. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the task data migration method according to any one of claims 1 to 8.

Images