A scheduling method and device for encrypted card virtual resources, equipment and medium

Abstract

The application discloses a scheduling method and device for encrypted card virtual resources, equipment and medium, and relates to the technical field of cloud computing. The method is applied to an encrypted card system based on SR-IOV technology, and comprises the following steps: grouping a plurality of VFs divided from a physical encrypted card to construct at least one VF group; mapping each VF group to a corresponding virtual machine and providing each virtual machine with a unified encrypted device interface; monitoring the running state indicators of the VF groups, and adjusting the number of VFs in the VF groups according to the running state indicators through a reinforcement learning algorithm. Through the technical scheme, the intelligent scheduling and elastic scaling of the resources of the encrypted card can be realized without deleting or rebuilding the virtual machine or modifying the upper-layer application program when the user business demand changes, so that the system flexibility and resource utilization rate are improved.

Description

Technical Field

[0001] This invention relates to the field of cloud computing technology, and in particular to a method, apparatus, device, and medium for scheduling virtual resources of an encrypted card. Background Technology

[0002] To address the issue of low resource utilization caused by traditional encryption cards typically being exclusively used by a single physical server, cloud computing and modern data centers have introduced encryption card virtualization solutions based on hardware virtualization technology. Specifically, SR-IOV (Single Root I / O Virtualization) technology is used to divide the physical encryption card into multiple VFs (Virtual Functions).

[0003] Each Virtual Function (VF) can be independently mapped to different virtual machines, enabling the sharing and reuse of encrypted resources. However, due to the diversity and dynamic changes in user businesses, the demand for encrypted resources varies. When the processing capacity of a single VF cannot meet business needs, multiple VFs need to be mapped to the same virtual machine to enable "multi-GPU" capabilities. At this point, upper-layer applications need to consider how to perform load balancing among multiple VFs to fully utilize the performance of the encrypted GPUs. Current drawbacks of VF usage include: 1. Applications in the virtual machine need to handle balanced calls between multiple VFs, which inevitably increases the implementation complexity of the upper-layer application. 2. For the three-stage algorithm implementation, there may also be scenarios involving process binding with VF. In this case, if the user's encryption requirements increase or decrease, VF cannot be flexibly added or removed. 3. Security risks exist. In a virtualized environment, when multiple virtual machines share the same physical encryption card, if there is a lack of effective isolation mechanisms, it may lead to security risks such as resource contention and data leakage.

[0004] Therefore, how to provide a solution to the above-mentioned technical problems is a problem that needs to be solved by those skilled in the art. Summary of the Invention

[0005] In view of this, the purpose of this invention is to provide a method, apparatus, device, and medium for scheduling virtual resources of an encrypted card, which can significantly simplify application layer operations and improve compatibility; achieve elastic scaling and intelligent scheduling of resources; and optimize resource utilization and system reliability. The specific solution is as follows: In a first aspect, this application discloses a method for scheduling virtual resources of an encryption card, applied to an encryption card system based on SR-IOV technology, comprising: The multiple VFs divided by the physical encryption card are grouped to construct at least one VF group; Each VF group is mapped to its corresponding virtual machine, and a unified encryption device interface is provided for each virtual machine accordingly. Monitor the operational status indicators of the VF group, and based on the operational status indicators, make decisions and execute adjustments to the number of VFs within the VF group using a reinforcement learning algorithm.

[0006] Optionally, the monitoring of the operational status indicators of the VF group includes: Monitor at least one of the following operational status metrics associated with the VF group: encryption task queue length, processor utilization, task response time, and throughput.

[0007] Optionally, the step of deciding and executing the adjustment of the number of VFs within the VF group through a reinforcement learning algorithm includes: The operating status indicator is taken as the current status, and based on the current status, it is determined whether the resources of the VF group meet the preset business requirements. When the resources of the VF group meet the preset service requirements, the number of VFs in the VF group remains unchanged; When the resources of the VF group do not meet the preset business requirements, the adjustment action corresponding to the current state is output through the reinforcement learning algorithm. Based on the adjustment action, the number of VFs in the VF group is increased or decreased, while keeping the encryption device interface unchanged, and the mapping relationship between the VF group and the corresponding virtual machine is updated.

[0008] Optionally, the reinforcement learning algorithm includes a Q-learning algorithm, and correspondingly, the step of deciding and executing the adjustment of the number of VFs within the VF group through the reinforcement learning algorithm includes: A multidimensional vector composed of the operational status indicators is defined as the state space, an action set is defined as the action space, and a function for calculating the reward value based on the operational status indicators is defined as the reward function; wherein, the action set includes: a first action that keeps the current number of VFs unchanged, a second action that adds one VF to the VF group, and a third action that removes one VF from the VF group; Initialize the Q-table and set the learning rate, discount factor, and exploration rate for the Q-learning algorithm; Based on the exploration rate, a random action is selected from the action space as the adjustment action, or the action corresponding to the maximum Q value in the current state is selected from the Q table as the adjustment action; When the adjustment action is the second action, a VF is allocated from the global resource pool and added to the VF group; When the adjustment action is the third action, a VF is removed from the VF group and released back to the global resource pool.

[0009] Optionally, after making a decision and performing an adjustment to the number of VFs within the VF group using a reinforcement learning algorithm, the method further includes: Collect a new running state and use the new running state as the next state. Based on the next state, determine the reward value according to the reward function. Based on the learning rate, the discount factor, and the reward value, the Q-table is updated using the Q-learning update formula; the Q-learning update formula is: ; in, In the current state Next action The corresponding Q value; The learning rate is... To perform the action The reward value obtained subsequently The discount factor; In the next state The estimate of the maximum Q value that can be obtained after performing all possible actions a.

[0010] Optionally, the method for scheduling virtual resources of the encrypted card further includes: Based on a preset exploration rate adjustment strategy, the exploration rate is gradually reduced as the training process of the Q-learning algorithm increases.

[0011] Optionally, the method for scheduling virtual resources of the encrypted card further includes: The task scheduler evenly distributes the encryption tasks to each VF in the VF group. When a target VF in the VF group is detected to be idle for more than a preset threshold, the target VF is automatically released back to the global resource pool.

[0012] Secondly, this application discloses a scheduling device for virtual resources of an encrypted card, applied to an encrypted card system based on SR-IOV technology, comprising: The VF group building module is used to group multiple VFs divided from the physical encryption card to build at least one VF group; The VF group management module is used to map each VF group to the corresponding virtual machine and provide each virtual machine with its own unified encryption device interface. The operation status monitoring module is used to monitor the operation status indicators of the VF group and, based on the operation status indicators; The resource dynamic adjustment module is used to make decisions and execute adjustments to the number of VFs within the VF group through reinforcement learning algorithms.

[0013] Thirdly, this application discloses an electronic device, which includes a processor and a memory; wherein the memory is used to store a computer program, which is loaded and executed by the processor to implement the aforementioned method for scheduling virtual resources of an encrypted card.

[0014] Fourthly, this application discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned method for scheduling virtual resources of an encrypted card.

[0015] As can be seen, this invention, by introducing VF groups as the basic unit for resource management and mapping, and combining reinforcement learning to achieve intelligent elastic scaling of resources within the group, achieves the following beneficial effects: On the one hand, each virtual machine obtains a unified encrypted device interface through its mapped VF group. Upper-layer applications do not need to be aware of the specific number and dynamic increase or decrease of VFs within the group, nor do they need to implement load balancing logic among multiple VFs. This ensures good compatibility and transparency while greatly reducing the complexity of application development and maintenance. Simultaneously, when business requirements change, there is no need to interrupt business or modify application logic, achieving business-agnostic dynamic resource scheduling and improving the overall flexibility and maintainability of the system. On the other hand, by continuously monitoring the operating status of each VF group through reinforcement learning algorithms and automatically deciding to adjust the number of VFs within the group, on-demand allocation and elastic scaling of resources are achieved.

[0016] Furthermore, the scheduling device, equipment, and storage medium for encrypted card virtual resources provided in this application correspond to the aforementioned scheduling method for encrypted card virtual resources and have the same effect. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0018] Figure 1 This application discloses a flowchart of a method for scheduling virtual resources of an encrypted card. Figure 2 This application discloses an implementation and mapping block diagram of a group; Figure 3 This is a schematic diagram of dynamic resource scheduling and elastic scaling of a group disclosed in this application; Figure 4 This is a schematic diagram of the structure of a scheduling device for virtual resources of an encrypted card disclosed in this application; Figure 5 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] For ease of understanding, the terminology used in this article is briefly described below.

[0021] Cloud computing is a pay-as-you-go model that provides available, convenient, on-demand network access to a shared pool of configurable computing resources (including networks, servers, storage, applications, and services) that can be rapidly provisioned with minimal management effort or interaction with the service provider.

[0022] Virtual machine: refers to a complete computer system that is simulated by software, has full hardware system functions, and runs in a completely isolated environment.

[0023] Encryption card virtualization function: Divide the physical encryption card device into multiple VFs, which can be used independently by virtual machines, thereby improving the resource utilization of the device.

[0024] Currently, the direct mapping scheme of VFs requires upper-layer applications to handle load balancing of multiple VFs, which is highly complex and cannot dynamically and transparently add or remove VFs according to business needs.

[0025] To address this, this application provides a scheduling scheme for virtual resources of encrypted cards. This scheme enables intelligent scheduling and elastic scaling of encrypted card resources without deleting or rebuilding virtual machines or modifying upper-layer applications when user business needs change. This allows for rapid response to business changes and improves system flexibility and resource utilization.

[0026] This invention discloses a method for scheduling virtual resources of an encryption card, applied to an encryption card system based on SR-IOV technology. See [link to relevant documentation]. Figure 1 As shown, the method includes: Step S11: Divide the multiple VFs from the physical encryption card into groups to construct at least one VF group.

[0027] The core foundation of this application's embodiments lies in the innovation of the VF resource organization and mapping architecture of the encryption card, namely, the introduction of a logical management level called VF Group. This step aims to organically integrate and abstract multiple discrete VFs partitioned by the physical encryption card through hardware virtualization technology (such as SR-IOV), thereby providing upper-layer applications with a simplified, unified, and elastically scalable resource view.

[0028] In one feasible implementation, in the SR-IOV-based encryption card resource management architecture, physical encryption cards are divided into multiple Virtual Functions (VFs). The system organizes these VFs into one or more independent VF groups based on the total number of VFs on the physical encryption cards and the initial resource allocation strategy. Each VF belongs to a group. Therefore, a group refers to a collection of VFs containing one or more VFs, used for unified mapping to virtual machines. In a preferred initial configuration, each group can initially be set to contain one VF. This design makes the initial system state compatible with the traditional single VF mapping mode, facilitating smooth deployment. Each group is logically an independent resource container and management unit, which can accommodate one or more VFs.

[0029] Step S12: Map each VF group to the corresponding virtual machine, and provide each virtual machine with its own unified encryption device interface.

[0030] After the VF group is built, the system performs a crucial mapping operation: treating the VF group as a whole, mapping each VF group to its corresponding virtual machine, instead of directly mapping individual VFs to virtual machines as in the traditional approach. This means that the virtual machines and the operating systems and applications running within them do not perceive one or more discrete VF devices that they need to manage themselves, but rather a single, logical "encrypted device." The system implements a unified encrypted device interface for the group through the device driver layer or virtualization management layer, and transparently aggregates the combined capabilities of all VFs within the group behind this interface. In this way, regardless of whether the group contains one or more VFs, upper-layer applications always see only a unified encrypted device interface. Therefore, adding or removing VFs does not affect the implementation complexity of upper-layer applications, ensuring good compatibility and transparency.

[0031] like Figure 2The diagram illustrates the architecture and resource mapping relationships of the VF (Vehicle Function Group) in this invention. From left to right, the diagram clearly shows a three-layer structure: 1. Physical Resource Layer: The leftmost layer is the physical encryption card, which is divided into multiple VFs using SR-IOV technology. Each VF has independent computation and cryptographic processing capabilities. 2. Group Abstraction Layer: Physical VFs are dynamically allocated to different Groups. Each Group is a logical resource pool that can contain one or more VFs. The Group provides a unified encryption device interface, shielding the underlying VF quantity from changes. 3. Virtual Machine Mapping Layer: Each Group is mapped to one or more virtual machines. Applications within the virtual machines only perceive the unified encryption device and do not need to know the specific number of VFs contained within a Group.

[0032] Initially, each Group contains one Virtual Machine (VF) and maps it to a specified virtual machine. When business requirements change, the system uses a dynamic scheduling mechanism (see...). Figure 3 The number of Virtual Functions (VFs) within a Group can be adjusted (expanding or shrinking), but no code or configuration needs to be modified on the virtual machine side; encrypted resources are always accessed through the same interface. The arrows in the diagram illustrate the flow path of VF resources. It is evident that by decoupling physical resources from upper-layer applications through the Group abstraction layer, transparent resource scheduling is achieved.

[0033] Step S13: Monitor the operating status indicators of the VF group, and based on the operating status indicators, make a decision and execute an adjustment to the number of VFs in the VF group through a reinforcement learning algorithm.

[0034] During actual operation, the system continuously collects operational status metrics for the Group. These metrics are key signals for sensing business load and resource pressure. In a preferred embodiment, the monitored metrics include, but are not limited to, at least one of the following operational status metrics: encrypted task queue length, processor (CPU) utilization, task response time, and throughput. These metrics together constitute a multi-dimensional state vector, providing a real-time and comprehensive data foundation for subsequent intelligent decision-making.

[0035] The monitoring module collects the aforementioned metrics at a preset sampling period, standardizes them, and inputs them into the reinforcement learning decision engine. In practice, based on the reinforcement learning algorithm, the monitored operational status metrics are transformed into adjustment decisions for the number of Virtual Functions (VFs) and executed, thereby achieving on-demand scaling of resources.

[0036] Specifically, the Q-learning reinforcement learning algorithm is used to analyze the operational status indicators to determine whether the current Group meets the user's business needs. The reinforcement learning algorithm then decides and executes adjustments to the number of VFs within the VF group, combined with... Figure 3 As shown, it includes the following steps: Step 1: Define the multidimensional vector composed of the operation status indicators as the state space, define the action set as the action space, and define the function that calculates the reward value based on the operation status indicators as the reward function.

[0037] When using the Q-learning algorithm, the state space consists of a multi-dimensional vector composed of runtime state indicators collected in the preceding steps, such as the encryption task queue length, CPU utilization, task response time, and throughput. The action space defines three basic operations: the first action A0, which keeps the current number of VFs unchanged; the second action A1, which adds a VF to the VF group; and the third action A2, which removes a VF from the VF group. The reward function is designed as a multi-dimensional reward function to evaluate the quality of the system state after performing a certain action, comprehensively considering factors such as task response time, throughput, and resource utilization. For example, a positive reward is given when task response time is shortened and throughput is improved; a negative reward is given when there is resource waste or performance degradation.

[0038] Step 2: Initialize the Q-table and set the learning rate, discount factor, and exploration rate for the Q-learning algorithm.

[0039] During the initialization phase, the Q-table is initialized with an initial value of 0; the learning rate α, discount factor γ, and exploration rate ε are set. It should be noted that the Group structure also needs to be initialized at this stage, with each Group containing a Virtual Function (VF). Simultaneously, the monitoring module is started to collect multi-dimensional operational status metrics.

[0040] Further, the process moves into the business requirement detection phase. First, multi-dimensional metrics for the current Group are obtained from the monitoring module, and the operational status metrics are used as the current state to construct a state vector St=[S1,S2,S3,S4]. Second, based on the current state, it is determined whether the resources of the VF group meet the preset business requirements and whether scheduling is needed. When the resources of the VF group meet the preset business requirements, it proves that no scheduling is needed, and the number of VFs within the VF group remains unchanged, i.e., the current Group configuration is maintained. When the resources of the VF group do not meet the preset business requirements, i.e., the current state St differs significantly from the target state (e.g., task queue length > threshold, response time > threshold), the scheduling phase begins. The reinforcement learning algorithm outputs the adjustment action corresponding to the current state. Subsequently, based on the adjustment action output by Q-learning, the number of VFs in the VF group is dynamically increased or decreased to achieve on-demand scheduling.

[0041] Step 3: Based on the exploration rate, randomly select an action from the action space as the adjustment action, or select the action corresponding to the maximum Q value in the current state from the Q table as the adjustment action.

[0042] During the dynamic resource scheduling phase, when making a decision, Q-learning randomly selects an action At with a certain probability (exploration rate ε) to explore the unknown state (exploration); or selects the action with the highest estimated long-term benefit (Q value) in the current state with a probability of (1-ε), that is, selects the action with the largest Q value corresponding to St in the Q table with a probability of 1-ε (utilization).

[0043] It should be noted that, based on the preset exploration rate adjustment strategy, as the training process of the Q-learning algorithm increases, the exploration rate ε will gradually decrease, causing the system to shift from extensive exploration to relying on the utilization of mature strategies.

[0044] Step 4: When the adjustment action is the second action, allocate a VF from the global resource pool and add it to the VF group; Step 5: When the adjustment action is the third action, remove a VF from the VF group and release it back to the global resource pool.

[0045] When performing the adjustment action At, if the second action is to add a VF, it usually means that the resources of the current group are insufficient to meet business needs (such as task response time exceeding expectations, task queue being too long, etc.). The system will trigger the expansion mechanism, allocate an idle VF from the global resource pool, and dynamically add it to the current group, thereby improving resource utilization and task processing capabilities.

[0046] Conversely, when the adjustment action is the third action of reducing a VF, it usually corresponds to the determination of idle resources (such as the low resource utilization of the group and the light task load). The system will trigger the scaling down mechanism, select a VF from the current group (such as the one that has been idle for the longest time), remove it and release it back to the global resource pool for use by other groups, thereby achieving elastic scaling and load balancing of resources.

[0047] It's important to note that during adjustments, regardless of the number of Virtual Functions (VFs), the system automatically updates the mapping between Groups and virtual machines. Crucially, it ensures that the encryption device interface provided to upper-layer applications remains singular and unchanged. This way, regardless of changes in the number of VFs within a Group, upper-layer applications access encryption resources through a unified encryption device interface without requiring modifications to application-layer logic. This means applications are completely unaware of underlying resource changes, achieving complete transparency in scheduling.

[0048] Furthermore, after each action is performed, the system collects a new state and calculates an immediate reward, then updates the Q-value table within the model using a temporal difference learning method (such as the Q-learning update formula). Specifically, a new running state is collected and designated as the next state St+1. Based on this next state, the reward value Rt is determined according to the reward function. The Q-table is then updated using the Q-learning update formula based on the learning rate, discount factor, and reward value.

[0049] The Q learning update formula is: ; in, In the current state Next action The corresponding Q value; The learning rate is... To perform the action The reward value obtained subsequently Discount factor; For the next state The estimate of the maximum Q value that can be obtained after performing all possible actions a.

[0050] Through numerous such "state-action-reward-new state" interactions, the model can autonomously learn the optimal VF quantity configuration strategy under different load conditions, thereby achieving intelligent elastic scaling.

[0051] In one feasible implementation, this embodiment of the application can also combine load balancing and resource reclamation mechanisms to avoid resource idleness or over-allocation, thereby improving overall system efficiency. Specifically, through a task scheduler, encryption tasks are evenly distributed to each VF within the VF group, avoiding single-point performance bottlenecks. When a target VF in the VF group is detected to be idle for more than a preset threshold, the target VF is automatically released back to the global resource pool for use by other groups.

[0052] In summary, through the aforementioned closed loop of "monitoring-decision-execution-learning," this invention can dynamically and intelligently adjust encrypted resources without manual intervention or changes to upper-layer applications, achieving an optimal balance between resource utilization and business performance.

[0053] As can be seen, this invention, by introducing VF groups as the basic unit for resource management and mapping, and combining reinforcement learning to achieve intelligent elastic scaling of resources within the group, achieves the following beneficial effects: On the one hand, each virtual machine obtains a unified encrypted device interface through its mapped VF group. Upper-layer applications do not need to be aware of the specific number and dynamic increase or decrease of VFs within the group, nor do they need to implement load balancing logic among multiple VFs. This ensures good compatibility and transparency while greatly reducing the complexity of application development and maintenance. Simultaneously, when business requirements change, there is no need to interrupt business or modify application logic, achieving business-agnostic dynamic resource scheduling and improving the overall flexibility and maintainability of the system. On the other hand, by continuously monitoring the operating status of each VF group through reinforcement learning algorithms and automatically deciding to adjust the number of VFs within the group, on-demand allocation and elastic scaling of resources are achieved.

[0054] Accordingly, this application also discloses a scheduling device for virtual resources of an encryption card, applied to an encryption card system based on SR-IOV technology. See [link to relevant documentation]. Figure 4 As shown, the device includes: VF group construction module 11 is used to group multiple VFs divided from the physical encryption card to construct at least one VF group; VF group management module 12 is used to map each VF group to the corresponding virtual machine and provide each virtual machine with its own unified encryption device interface accordingly. The operation status monitoring module 13 is used to monitor the operation status indicators of the VF group and, based on the operation status indicators; The resource dynamic adjustment module 14 is used to make decisions and execute adjustments to the number of VFs within the VF group through a reinforcement learning algorithm.

[0055] For more detailed information on the working process of each of the above modules, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0056] Therefore, the above-described scheme in this embodiment, by introducing VF groups as the basic unit for resource management and mapping, and combining reinforcement learning to achieve intelligent elastic scaling of resources within the group, achieves the following beneficial effects: On the one hand, each virtual machine obtains a unified encrypted device interface through its mapped VF group. Upper-layer applications do not need to be aware of the specific number and dynamic increase or decrease of VFs within the group, nor do they need to implement load balancing logic among multiple VFs. This ensures good compatibility and transparency while greatly reducing the complexity of application development and maintenance. Simultaneously, when business requirements change, there is no need to interrupt business or modify application logic, achieving business-agnostic dynamic resource scheduling and improving the overall flexibility and maintainability of the system. On the other hand, by continuously monitoring the operating status of each VF group through reinforcement learning algorithms and automatically deciding to adjust the number of VFs within the group, on-demand allocation and elastic scaling of resources are achieved.

[0057] Furthermore, embodiments of this application also disclose an electronic device, Figure 5 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0058] Figure 5 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the encryption card virtual resource scheduling method disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be a computer.

[0059] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0060] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk, or optical disk, etc. The resources stored on it can include an operating system 221, computer programs 222, and data 223, etc. The data 223 can include various types of data. The storage method can be temporary storage or permanent storage.

[0061] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the encryption card virtual resource scheduling method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include a computer program capable of performing other specific tasks.

[0062] Furthermore, this application also discloses a computer-readable storage medium, which includes random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, magnetic disks, optical disks, or any other form of storage medium known in the art. The computer program, when executed by a processor, implements the aforementioned method for scheduling virtual resources of the encryption card. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0063] Furthermore, embodiments of this application also provide a computer program product, including a computer program / instruction, which, when executed by a processor, implements any of the above-described methods for scheduling virtual resources of an encrypted card.

[0064] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0065] The steps of the scheduling method or algorithm for virtual resources of an encrypted card described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0066] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0067] The above provides a detailed description of the scheduling method, apparatus, device, and medium for virtual resources of an encrypted card provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only intended to help understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for scheduling virtual resources of an encrypted card, characterized in that, Applications to encryption card systems based on SR-IOV technology include: The multiple VFs divided by the physical encryption card are grouped to construct at least one VF group; Each VF group is mapped to its corresponding virtual machine, and a unified encryption device interface is provided for each virtual machine accordingly. Monitor the operational status indicators of the VF group, and based on the operational status indicators, make decisions and execute adjustments to the number of VFs within the VF group using a reinforcement learning algorithm.

2. The method for scheduling virtual resources of an encrypted card according to claim 1, characterized in that, The monitoring of the operational status indicators of the VF group includes: Monitor at least one of the following operational status metrics associated with the VF group: encryption task queue length, processor utilization, task response time, and throughput.

3. The method for scheduling virtual resources of an encrypted card according to claim 1, characterized in that, The step of making and executing the adjustment of the number of VFs within the VF group through a reinforcement learning algorithm includes: The operating status indicator is taken as the current status, and based on the current status, it is determined whether the resources of the VF group meet the preset business requirements. When the resources of the VF group meet the preset service requirements, the number of VFs in the VF group remains unchanged; When the resources of the VF group do not meet the preset business requirements, the adjustment action corresponding to the current state is output through the reinforcement learning algorithm. Based on the adjustment action, the number of VFs in the VF group is increased or decreased, while keeping the encryption device interface unchanged, and the mapping relationship between the VF group and the corresponding virtual machine is updated.

4. The method for scheduling virtual resources of an encrypted card according to claim 3, characterized in that, The reinforcement learning algorithm includes the Q-learning algorithm. Correspondingly, the step of deciding and executing the adjustment of the number of VFs within the VF group through the reinforcement learning algorithm includes: A multidimensional vector composed of the aforementioned operational status indicators is defined as the state space, an action set is defined as the action space, and a function for calculating the reward value based on the aforementioned operational status indicators is defined as the reward function; wherein, the action set includes: a first action that keeps the current number of VFs unchanged, a second action that adds one VF to the VF group, and a third action that removes one VF from the VF group; Initialize the Q-table and set the learning rate, discount factor, and exploration rate for the Q-learning algorithm; Based on the exploration rate, a random action is selected from the action space as the adjustment action, or the action corresponding to the maximum Q value in the current state is selected from the Q table as the adjustment action; When the adjustment action is the second action, a VF is allocated from the global resource pool and added to the VF group; When the adjustment action is the third action, a VF is removed from the VF group and released back to the global resource pool.

5. The method for scheduling virtual resources of an encrypted card according to claim 4, characterized in that, After making a decision and performing an adjustment to the number of VFs within the VF group using a reinforcement learning algorithm, the method further includes: Collect a new running state and use the new running state as the next state. Based on the next state, determine the reward value according to the reward function. Based on the learning rate, the discount factor, and the reward value, the Q-table is updated using the Q-learning update formula; the Q-learning update formula is: ； in, In the current state Next action The corresponding Q value; The learning rate is... To perform the action The reward value obtained subsequently The discount factor; In the next state The estimate of the maximum Q value that can be obtained after performing all possible actions a.

6. The method for scheduling virtual resources of an encrypted card according to claim 4, characterized in that, Also includes: Based on a preset exploration rate adjustment strategy, the exploration rate is gradually reduced as the training process of the Q-learning algorithm increases.

7. The method for scheduling virtual resources of an encrypted card according to any one of claims 1 to 6, characterized in that, Also includes: The task scheduler evenly distributes the encryption tasks to each VF in the VF group. When a target VF in the VF group is detected to be idle for more than a preset threshold, the target VF is automatically released back to the global resource pool.

8. A scheduling device for virtual resources of an encrypted card, characterized in that, Applications to encryption card systems based on SR-IOV technology include: The VF group building module is used to group multiple VFs divided from the physical encryption card to build at least one VF group; The VF group management module is used to map each VF group to the corresponding virtual machine and provide each virtual machine with its own unified encryption device interface. The operation status monitoring module is used to monitor the operation status indicators of the VF group and, based on the operation status indicators; The resource dynamic adjustment module is used to make decisions and execute adjustments to the number of VFs within the VF group through reinforcement learning algorithms.

9. An electronic device, characterized in that, The electronic device includes a processor and a memory; wherein the memory is used to store a computer program, which is loaded and executed by the processor to implement the method for scheduling virtual resources of an encrypted card as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store computer programs; wherein the computer programs, when executed by a processor, implement the scheduling method for virtual resources of an encrypted card as described in any one of claims 1 to 7.

Images