Computation power node-oriented trusted access and networking arrangement method, device, medium and product

Abstract

The application discloses a computing power node-oriented trusted access and networking arrangement method and device, medium and product, comprising: obtaining information of a node to be accessed, and generating original access data; performing pre-trusted verification on the node to be accessed, and generating a trusted verification record; generating an access portrait containing node capability and trusted state according to the original access data and the trusted verification record; constructing a dynamic constraint model based on a business intention, a policy constraint, a resource constraint and a network state, and performing joint scoring on a candidate access domain and a candidate path based on the dynamic constraint model to screen a candidate scheme; evaluating the candidate scheme in combination with an influence of the node to be accessed on a global network topology, and generating an access arrangement result; issuing the access arrangement result to an execution side to execute access, and continuously monitoring; when a state drift event is detected, updating the dynamic constraint model based on the drift state, and triggering re-verification, re-decision and re-arrangement.

Description

Technical Field

[0001] This application relates to the field of computing power networks, and in particular to a trusted access and networking arrangement method, device, medium and product for computing power nodes. Background Technology

[0002] With the rapid development of heterogeneous computing infrastructure and cross-domain computing network systems, large-scale GPU, NPU, and RDMA interconnect resources are increasingly being uniformly scheduled and collaboratively used in a multi-regional, multi-cluster, and multi-tenant manner. In practical scenarios, newly added computing nodes typically need to be connected to different security domains, business domains, or resource domains, and the access path, exposure method, and resource bearing target should be dynamically selected according to business needs. However, most existing node access mechanisms only support static registration, simple authentication, or fixed policy matching, lacking unified modeling of node trust status, resource capabilities, interconnection capabilities, and policy constraints, making it difficult to achieve dynamic trusted access and network orchestration for complex computing network environments.

[0003] On the other hand, existing technologies typically employ simple weighted scoring or static rule-based access decisions, lacking the ability to perform layered modeling for hard and soft constraints. This makes it difficult to effectively address the collaborative optimization issues between trusted verification, compliance restrictions, resource constraints, latency requirements, and global load balancing. Furthermore, after a node completes access, existing solutions generally lack continuous monitoring and dynamic re-orchestration mechanisms for state drift events. When certificate expiration, link degradation, reduced resource availability, or policy version changes occur, manual intervention is often required, making it difficult to meet the automated, stable, and trusted access requirements of large-scale computing network environments. Summary of the Invention

[0004] One objective of this application is to provide a trusted access and networking orchestration method, device, medium, and product for computing power nodes, at least to address the problem in the prior art of lacking joint decision-making and dynamic networking orchestration based on the trusted status, resource constraints, and business intentions of computing power nodes.

[0005] To achieve the above objectives, some embodiments of this application provide the following aspects:

[0006] This application provides a trusted access and networking orchestration method for computing power nodes, the method comprising:

[0007] Obtain information about the nodes to be connected and generate raw access data;

[0008] Perform a pre-connection trust verification on the node to be connected and generate a trust verification record;

[0009] Based on the original access data and the trusted verification record, an access profile containing node capabilities and trusted status is generated.

[0010] A dynamic constraint model is constructed based on business intent, policy constraints, resource constraints, and network status. Based on the dynamic constraint model, a joint scoring is performed on candidate access domains and candidate paths to filter candidate solutions.

[0011] The candidate schemes are evaluated based on their impact on the global network topology after the nodes to be accessed are connected, and an access orchestration result is generated.

[0012] The access orchestration results are sent to the execution side to execute the access, and the node running status information is continuously monitored;

[0013] When a state drift event is detected, the dynamic constraint model is updated based on the drift state, triggering re-verification, re-decision, and rearrangement.

[0014] Secondly, some embodiments of this application also provide an electronic device, the electronic device comprising: one or more processors; and a memory storing computer program instructions, which, when executed, cause the processor to perform the steps of the method described above.

[0015] Thirdly, some embodiments of this application also provide a computer-readable medium having computer program instructions stored thereon, which can be executed by a processor to implement the steps of the method described above.

[0016] Fourthly, some embodiments of this application also provide a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the method described above.

[0017] Compared with related technologies, the solution provided in this application, by constructing a closed-loop control mechanism of "trusted verification - access profiling - constraint modeling - joint scoring - access orchestration - drift re-orchestration", realizes unified modeling and collaborative decision-making of the trusted state, node capability state and business intent of the node to be accessed. It can dynamically optimize the candidate access domain and candidate path under the condition of satisfying the trust constraints and resource constraints, thereby improving the trustworthiness, resource utilization efficiency and global load balancing capability in the process of accessing computing power nodes.

[0018] Furthermore, by introducing a multi-objective constraint optimization model, a hierarchical relaxation mechanism for infeasible solutions, and a dynamic re-orchestration mechanism based on state drift events, continuous autonomous control of the access process in complex computing network environments is achieved. Compared to existing static access schemes, this application can automatically trigger re-verification and re-orchestration when link state, resource state, or policy state changes, thereby reducing manual operation and maintenance costs, improving system stability, and enhancing the recoverability of access orchestration. Attached Figure Description

[0019] One or more embodiments are illustrated by way of example with reference numerals in the accompanying drawings. These illustrations do not constitute a limitation on the embodiments. Elements with the same reference numerals in the drawings are denoted as similar elements. Unless otherwise stated, the figures in the drawings are not to be limited by scale.

[0020] Figure 1 A flowchart illustrating a trusted access and networking orchestration method for computing power nodes, provided as an exemplary embodiment of this disclosure;

[0021] Figure 2 A flowchart illustrating another trusted access and networking orchestration method for computing power nodes provided as an exemplary embodiment of this disclosure;

[0022] Figure 3 A flowchart illustrating the constraint optimization solution in a trusted access and networking orchestration method for computing power nodes, provided as an exemplary embodiment of this disclosure;

[0023] Figure 4 A flowchart illustrating the state drift event handling process in a trusted access and networking orchestration method for computing power nodes, provided as an exemplary embodiment of this disclosure;

[0024] Figure 5 An exemplary structural diagram of the electronic device provided for some embodiments of this application. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0026] Figure 1 An exemplary flowchart of a trusted access and networking orchestration method for computing power nodes provided in an exemplary embodiment of this disclosure, the method comprising:

[0027] S101. Obtain the information of the node to be connected and generate the original access data.

[0028] Specifically, such as Figure 2As shown, the access control platform, resource orchestration platform, computing network collaboration platform, or control plane node can perform access information collection on the nodes to be accessed. The nodes to be accessed can be different types of computing power nodes, such as GPU server nodes, NPU server nodes, edge computing power nodes, inference nodes, training nodes, or heterogeneous acceleration nodes. The system can obtain the original access information corresponding to the nodes to be accessed through node registration interfaces, Agent detection interfaces, resource synchronization interfaces, network protocol detection interfaces, or control message interaction methods.

[0029] The original access information includes at least identity and attribution information, node capability information, exposed capability information, and interconnection information.

[0030] The identity and attribution information can be used to represent node identifier, tenant identifier, node attribution relationship, region identifier, cluster identifier, resource domain identifier, or the security domain to which the node belongs, etc.

[0031] The node capability information can be used to characterize the node's computing power, accelerator capabilities, video memory capacity, storage capacity, resource carrying capacity, or collective communication capabilities, etc.

[0032] The exposed capability information can be used to characterize the node's ability to provide services to the outside world, establish access points, or perform cross-domain access. Specifically, it may include service exposure mode, gateway access support capabilities, egress node information, relay forwarding capabilities, or proxy forwarding capabilities.

[0033] The interconnection information can be used to characterize the node's current network status, link status, network interconnection capability, interconnection protocol attributes, route reachability status, link bandwidth status, topology location, or access restrictions, etc.

[0034] In practice, the system can perform unified format conversion, field mapping, data completion, and structured organization on the acquired access information to generate raw access data with a unified structure. For example, heterogeneous resource parameters reported by devices from different vendors can be uniformly mapped to standardized capability fields, or link status under different network protocols can be converted into unified status description information, thereby reducing data differences between different devices in heterogeneous environments and improving the consistency and scalability of subsequent access decisions.

[0035] In some implementations, the system can also perform version identification management, timestamp recording, or validity period marking on the original access data to facilitate subsequent access profile updates, dynamic constraint model updates, access status tracking, and state drift event detection.

[0036] S102. Perform a pre-access trust verification on the node to be connected and generate a trust verification record.

[0037] Specifically, the system can perform a pre-access trust verification on the node before it is formally added to the target resource domain or target network domain, in order to reduce the risk of abnormal nodes, forged nodes, or nodes that do not meet the policy requirements entering the target domain.

[0038] The trusted verification chain may include multiple trusted verification steps, each of which can be used to verify the authenticity of the node's identity, the trustworthiness of the operating environment, the integrity of the node's configuration, and whether the node meets the access rules of the target domain. In specific implementation, trusted verification can be performed based on methods such as certificate verification, digital signature verification, remote proof, trusted execution environment proof, whitelist verification, blacklist verification, policy matching, rule comparison, or configuration consistency checks.

[0039] For example, the system can verify the validity period of node certificates, the issuing authority, or the integrity of the certificate chain to verify the validity of the node's identity; it can verify whether the node's operating environment has been abnormally tampered with through remote proof; and it can also verify whether the node meets the tenant isolation rules, regional restriction rules, or compliance constraints in the target domain based on preset policy rules.

[0040] The system can uniformly record the execution results of each trusted verification step, generating corresponding trusted verification records. These records can be used to characterize the current trusted state of a node, verification results, reasons for anomalies, constraints, or trusted levels. In some implementations, the trusted verification records can also be associated with corresponding trusted identifiers, trusted tags, or trusted scores for subsequent dynamic constraint model construction and access decision-making process invocation.

[0041] In some implementations, when it is detected that a node to be accessed does not meet some trust conditions but is still allowed restricted access, the system can mark the node to be accessed as having passed the downgrade and apply corresponding restriction policies during subsequent access processes; when the trust verification fails, the system can directly terminate the access process and record the reason for the failure.

[0042] S103. Based on the original access data and the trusted verification record, generate an access profile that includes node capabilities and trusted status.

[0043] Specifically, the system can associate raw access data with trusted verification records, and uniformly model node capability status, access restrictions, and trusted status to generate corresponding access profiles.

[0044] The access profile can be used to uniformly express the resource capabilities, trust status, access boundaries, access restrictions, and access validity information of nodes to be accessed. In specific implementations, the access profile can be organized using structured objects, attribute sets, tag sets, status description objects, or graph nodes, etc.

[0045] For example, the system can use node computing resource capabilities, interconnection capabilities, and service exposure capabilities as capability dimension attributes, trust verification results, trust level, and restriction status as trust dimension attributes, and policy restrictions, access restrictions, or exposure restrictions as access boundary attributes, thereby forming a unified access profile.

[0046] In some implementations, the system can also dynamically update the access profile based on historical operating status, historical access behavior, abnormal behavior records, or historical orchestration results, so as to improve the ability of the subsequent dynamic constraint model to reflect the real state of the node.

[0047] The access profile can be stored in a capability directory, resource index library, state database or knowledge graph, and can be called in processes such as candidate access domain screening, path planning, resource matching, dynamic constraint model construction and access orchestration.

[0048] S104. Construct a dynamic constraint model based on business intent, policy constraints, resource constraints, and network status, and perform joint scoring on candidate access domains and candidate paths based on the dynamic constraint model to screen candidate solutions.

[0049] Specifically, the system can determine the target access requirements based on the business intent input from the business side, and combine policy constraints, resource constraints, and real-time network status to perform dynamic constraint analysis, joint scoring, and candidate scheme screening on candidate access domains and candidate paths.

[0050] The business intent can be used to characterize latency requirements, resource requirements, reliability requirements, security isolation requirements, business scaling requirements, service deployment requirements, or load balancing requirements; the policy constraints can be used to characterize cross-domain restrictions, tenant isolation restrictions, access control rules, compliance constraint rules, or security domain restriction rules; the resource constraints can be used to characterize resource availability, link status, network bandwidth status, service carrying capacity, or target domain load status; and the network status can be used to characterize network congestion status, link quality status, path stability status, or cross-domain interconnection status.

[0051] The system can construct corresponding dynamic constraint models based on candidate access domains, candidate paths, node access status, and real-time network status, and filter candidate solutions that meet the constraints. In specific implementation, trusted state constraints, policy restrictions, or compliance restrictions can be used as hard constraints, while resource utilization constraints, latency constraints, network load constraints, or load balancing constraints can be used as soft constraints.

[0052] Subsequently, the system can perform joint scoring on candidate solutions that meet the constraints based on the dynamic constraint model. The joint scoring can comprehensively consider factors such as resource adaptability, path reachability, policy compatibility, trust state matching degree, resource utilization efficiency, and network load status to determine the comprehensive priority of different candidate solutions.

[0053] In some implementations, the system can also dynamically adjust the weights of different scoring dimensions according to different business intentions. For example, in low-latency business scenarios, the weight of path latency-related scores can be increased; in high-security business scenarios, the weight of trusted state-related scores can be increased; and in large-scale training scenarios, the weight of resource carrying capacity-related scores can be increased, so that the access results are more in line with the needs of different business scenarios.

[0054] In some implementations, the system can also update the dynamic constraint model based on real-time network state changes, resource state changes, or policy state changes to improve the dynamic adaptability of the candidate solution screening results to runtime state changes.

[0055] In some implementations, the dynamic constraint model can also perform incremental updates based on the historical evolution sequence corresponding to the state drift event, so that the constraint boundary, scoring weight, and path restriction conditions dynamically converge as the running state changes.

[0056] S105. Evaluate the candidate schemes based on the impact of the access node on the global network topology and generate access orchestration results.

[0057] Specifically, the system can further analyze the impact of the access node on the global network topology, link load status, resource distribution status, and path stability, and perform a comprehensive evaluation in conjunction with candidate solutions.

[0058] In practice, the system can determine the impact of different candidate schemes on the overall network status based on factors such as link bandwidth occupancy, resource coupling relationships, path reachability, network congestion status, neighborhood resource status, or global load status. For example, when a candidate scheme's corresponding path has high link occupancy or the target domain resources are close to saturation, the system can lower the priority of the corresponding candidate scheme; when a candidate scheme can maintain a relatively good global resource balance, the system can increase the priority of the corresponding candidate scheme.

[0059] After completing the comprehensive evaluation, the system can generate corresponding access orchestration results. These results may include the primary access domain, candidate paths, access levels, service exposure methods, backup access schemes, rollback operations, and plan validity periods. The access level characterizes the currently allowed access range or access permission level of a node; the rollback operation restores the pre-access state in case of subsequent execution failures or abnormal states.

[0060] In some implementations, the system can also generate backup access domains or backup access paths based on the priority relationship between candidate schemes to improve recovery capabilities in access failure scenarios.

[0061] S106. The access orchestration result is sent to the execution side to perform the access, and the node running status information is continuously monitored.

[0062] Specifically, the system can distribute access orchestration results to gateways, proxy nodes, service execution nodes, or control proxy nodes to perform access operations. These operations may include creating access relationships, establishing service exposure relationships, configuring network paths, synchronizing access rules, updating routing status, configuring proxy rules, or updating gateway policies.

[0063] After a node completes its connection, the system continuously monitors the node's operating status, link status, resource status, policy status, and service status to continuously acquire dynamic operating status information in the current computing network environment.

[0064] The continuous monitoring process can be performed based on link detection, telemetry acquisition, status reporting, resource probes, or service health checks to improve the system's real-time perception of changes in operating status.

[0065] S107. When a state drift event is detected, the dynamic constraint model is updated based on the drift state, and re-verification, re-decision, and rearrangement are triggered.

[0066] Specifically, the system can identify state drift events during continuous monitoring and update the dynamic constraint model based on the impact of the state drift events.

[0067] The state drift events may include changes in link status, changes in resource availability, changes in trusted status, changes in service exposure status, changes in policy version, changes in network congestion status, or abnormal node operation.

[0068] In some implementations, the system can dynamically adjust the constraints, scoring weights, or path restrictions in the dynamic constraint model based on the impact level of the state drift event. When the impact of the state drift event is minor, only the local path or local strategy needs to be updated; when the impact of the state drift event is significant, the candidate access domain screening, path planning, joint scoring, and access orchestration processes can be re-executed.

[0069] Furthermore, the system can retain the access orchestration results corresponding to the previous stable access state during the re-orchestration process, and restore to the previous stable state if the re-orchestration fails, thereby improving the stability and recoverability of the access process.

[0070] In the above embodiments, by constructing the correlation between original access data, trusted verification records, and access profiles, a unified model of the trusted state, resource capabilities, and access boundaries of the nodes to be accessed is achieved. Furthermore, a dynamic constraint model is constructed by combining business intent, policy constraints, resource constraints, and network status, thereby completing candidate scheme selection and access orchestration, improving the trustworthiness, flexibility, and resource scheduling capabilities during the access process of computing power nodes. In addition, by continuously monitoring state drift events and dynamically updating the dynamic constraint model, autonomous access control in complex computing network environments can be achieved, thereby reducing manual operation and maintenance costs, improving system operational stability, and enhancing the recoverability of the access process.

[0071] Furthermore, in one embodiment, obtaining the information of the node to be accessed and generating the original access data specifically includes:

[0072] Collect the identity information, affiliation information, accelerator capabilities, interconnection capabilities, exposed capabilities, and basic connectivity information of the nodes to be connected to form raw access data.

[0073] Specifically, in this embodiment, the system can collect multi-dimensional capability information of the nodes to be accessed through the node registration interface, Agent detection interface, resource synchronization interface or control plane detection interface to generate raw access data with a unified structure.

[0074] The identity information and ownership information can be used to characterize the tenant to which a node belongs, the resource domain to which it belongs, and the node's ownership relationship. In some implementations, the identity information and ownership information include at least node_id, tenant_id, domain_id, region_id, cluster_id, and owner_type.

[0075] Among them, node_id can be used to uniquely identify the corresponding node to be connected; tenant_id can be used to represent the tenant to which the node belongs; domain_id can be used to represent the resource domain or security domain to which the node belongs; region_id can be used to represent the region to which the node belongs; cluster_id can be used to represent the cluster to which the node belongs; and owner_type can be used to represent the subject type to which the node belongs.

[0076] The system can establish a node affiliation mapping based on the identity information and affiliation information, and use it for subsequent cross-domain access control, tenant isolation control and compliance constraint analysis processes.

[0077] The accelerator capabilities can be used to characterize the heterogeneous computing resource capabilities corresponding to the nodes to be connected. In some implementations, the accelerator capabilities include at least accelerator_type, accelerator_count, memory_size, and compute_tflops.

[0078] The accelerator_type can be used to characterize the accelerator type, including GPU type or NPU type. For example, it can include different models of accelerators such as A100, H100, and Ascend 910B; accelerator_count can be used to characterize the number of accelerators in a node; memory_size can be used to characterize the video memory capacity; and compute_tflops can be used to characterize the node's floating-point computing capability.

[0079] The system can evaluate the model training capability, inference capability, and resource carrying capacity of the corresponding node based on the above accelerator capability parameters, and use them for subsequent resource adaptation analysis and candidate access domain selection process.

[0080] The interconnection capability can be used to characterize the high-performance network interconnection capability corresponding to the node to be connected. In some embodiments, the interconnection capability includes at least rdma_capable, roce_version, nic_type, link_speed_gbps, mtu, and the collective communication efficiency factor eta_collective.

[0081] Among them, rdma_capable can be used to characterize whether a node supports RDMA communication; roce_version can be used to characterize the RoCE protocol version; nic_type can be used to characterize the network interface card type; link_speed_gbps can be used to characterize the link bandwidth; mtu can be used to characterize the maximum transmission unit; and eta_collective can be used to characterize the communication efficiency of the node collection.

[0082] The system can analyze the collective communication performance, link transmission capacity, and cross-node communication efficiency between different nodes based on interconnection capability parameters, and use them for subsequent path planning, load balancing analysis, and access orchestration processes in distributed training scenarios.

[0083] The exposed capabilities can be used to characterize the ability of a node to provide services or establish access paths. In some implementations, the exposed capabilities include at least service_export_mode, gateway_support, egress_points, and relay_capable.

[0084] Among them, service_export_mode can be used to characterize the service exposure mode; gateway_support can be used to characterize whether the node supports gateway access; egress_points can be used to characterize the available egress node information; relay_capable can be used to characterize whether the node supports relay forwarding capability.

[0085] The system can analyze the service exposure method, cross-domain access capability, and network forwarding capability of the node based on the exposed capabilities, and use them for subsequent access path planning and access orchestration processes.

[0086] In some implementations, the data collected by the system may further include topology location information of the nodes. This topology location information may include NUMA node information, PCIe switching layer information, and rack location information, among other things.

[0087] Among them, NUMA node information can be used to characterize the memory access relationship between different computing resources within the node; PCIe switching layer information can be used to characterize the PCIe topology relationship between different accelerators; rack location information can be used to characterize the physical deployment location of the node in the data center.

[0088] The system can analyze the physical proximity, link topology, and resource coupling relationships between different nodes based on the above topology location information, and use this information for subsequent global topology impact assessment, aggregated communication efficiency analysis, and global access optimization processes.

[0089] In some implementations, the system can also perform standardization processing, field mapping processing, and version marking processing on the collected raw access data to improve data compatibility and unified management capabilities between different devices in a heterogeneous environment.

[0090] In one embodiment, performing pre-access trust verification on the node to be accessed and generating a trust verification record includes:

[0091] The following checks are performed on the nodes to be accessed: identity and certificate validity verification, node signature and metadata integrity verification, remote proof verification, whitelist and blacklist verification, and consistency verification of domain policy and compliance constraints.

[0092] The trusted verification record is generated based on the verification result. The trusted verification record represents any one of the following states: pass, downgrade pass, and rejection.

[0093] Specifically, before a node to be accessed enters the target access domain, the system can sequentially execute multiple trusted verification steps according to a preset trusted verification chain to jointly verify the authenticity of the node's identity, the trustworthiness of its operating environment, the integrity of its node configuration, and the compliance of its access policy. The trusted verification chain can be uniformly orchestrated by the control plane, and corresponding verification rules can be dynamically loaded according to different access scenarios.

[0094] The identity and certificate validity verification function is used to verify the legitimacy of the identity of the node to be connected and the validity of the access credentials. The system can verify the issuing authority of the node certificate, the integrity of the certificate chain, the certificate validity period, and the revocation status, and verify whether the node's identity identifier is consistent with the pre-registered information. When the node certificate is invalid, revoked, or the identity identifier does not match, it can be determined that the corresponding node does not meet the access conditions.

[0095] Node signature and metadata integrity verification can be used to verify whether the data reported by the node to be connected has been tampered with. The system can perform digital signature verification on the capability description information, configuration description information, or resource status information uploaded by the node, and verify the integrity of the node's metadata based on the digest value. When a node capability parameter is detected to be inconsistent with the signature digest, the corresponding node can be marked as abnormal.

[0096] Remote verification can be used to verify the trustworthiness of the runtime environment of the node to be connected. The system can verify the node startup chain, runtime environment, and key component status based on the Quote mechanism of the Trusted Platform Module (TPM) and the Event Log replay verification method; it can also verify the integrity of the node's runtime environment based on the Trusted Execution Environment (TEE). The TEE may include trusted execution environments such as Intel SGX, AMD SEV, or ARM TrustZone.

[0097] In some implementations, the remote proof verification result can output a corresponding remote proof score T_attestation, where T_attestation ∈ [0, 100]. Specifically, when T_attestation ≥ 80, the corresponding node is determined to meet the pass condition; when 50 ≤ T_attestation < 80, the corresponding node is determined to meet the downgrade pass condition; and when T_attestation < 50, the corresponding node is determined to be in a rejection state.

[0098] Whitelist and blacklist verification can be used to check whether nodes to be connected meet preset access rules. The system can perform whitelist or blacklist matching based on the node's tenant, domain, originating organization, partner information, or historical behavior records. When a node matches a blacklist rule, access can be directly denied; when a node meets a whitelist rule, the corresponding node's trust level can be increased.

[0099] Domain policy and compliance constraint consistency verification can be used to verify whether the node to be connected meets the security policies, cross-domain policies, and compliance restrictions in the target access domain. The system can perform rule matching analysis on the node to be connected based on the tenant isolation rules, regional access rules, cross-border data restriction rules, or security access policies corresponding to the target access domain.

[0100] In some implementations, the system may process compliance constraints in the following manner:

[0101]

[0102] Where C(d) represents the original score corresponding to the candidate access domain, This indicates whether the corresponding candidate access domain meets the k-th compliance constraint. When any compliance constraint is not met, the score for this dimension of the corresponding candidate access domain can be set to zero.

[0103] The system can uniformly summarize the verification results of each trusted verification step and generate corresponding trusted verification records. The trusted verification records may include trusted status, reasons for anomalies, verification time, constraints, trusted level or trusted score, etc.

[0104] In some implementations, when all trusted verification results meet the target access requirements, the system can generate a trusted verification record corresponding to the pass status; when some trusted verification results do not meet the full pass condition but limited access is still allowed, the system can generate a trusted verification record corresponding to the downgrade pass status; when a critical trusted verification fails, the system can generate a trusted verification record corresponding to the rejection status and terminate the subsequent access process.

[0105] Furthermore, in some implementations, when the trusted status corresponding to the trusted verification record is a downgrade passed status, the system can restrict the corresponding node to only accessing low-sensitivity domains, read-only service domains, or gray-scale access domains, and impose network isolation restrictions, service exposure restrictions, or traffic restriction policies on it to reduce the impact of potential risks on the target network environment.

[0106] In the above embodiments, by constructing a pre-constructed trusted verification chain that includes identity validity verification, integrity verification, remote proof verification, and policy consistency verification, multi-dimensional joint verification of the trusted state of nodes to be accessed is achieved, thereby improving the trustworthiness and security of the node access process. Furthermore, by introducing a downgraded pass state and corresponding restriction policies, the system's compatibility and access flexibility for complex access scenarios can be improved while ensuring overall network security.

[0107] In one embodiment, generating an access profile that includes node capabilities and trusted status includes:

[0108] A comprehensive trust score is generated based on the original access data and the trusted verification record;

[0109] The comprehensive trust score is calculated by weighting the remote proof score, the historical behavior trust score, and the time decay factor.

[0110] Specifically, the system can quantitatively model the trustworthiness of nodes based on their remote proof results, historical operating behavior, and changes in trustworthiness status. It can also generate a corresponding comprehensive trustworthiness score in the access profile, which can be used for subsequent candidate access domain screening, dynamic constraint model construction, joint scoring, access path decision-making, and trustworthiness assessment during the access orchestration process.

[0111] The remote proof score characterizes the trustworthiness of the current operating environment of the node to be connected. The system generates a corresponding remote proof score based on factors such as the integrity of the node's startup chain, the results of the trusted execution environment verification, the status of key components, and the consistency of the operating environment. A higher remote proof score indicates a more trustworthy operating environment for the corresponding node.

[0112] Historical behavior trust scoring can be used to characterize the trustworthy behavior status of nodes during their historical operation. The system can assess the trustworthiness of a node's historical behavior based on information such as historical access success rate, abnormal behavior records, policy violation records, historical operational stability, and service availability.

[0113] In some implementations, historical behavior trust scoring The update can be performed in the following ways:

[0114]

[0115] Where α and β are Bayesian prior parameters, This indicates the number of successful attempts within a preset time window. This indicates the number of failures within a preset time window.

[0116] In some implementations, when abnormal behavior is detected in a node, the system can also deduct from the historical behavior trust score. The deduction method can be expressed as follows:

[0117]

[0118] Where R represents the behavioral abnormality risk score, and κ represents the deduction coefficient.

[0119] The time decay factor can be used to characterize how the trustworthiness of a node changes over time. The system can perform time decay processing on the trustworthiness of a node based on the time interval since the last trust verification, in order to reduce the trustworthiness score of nodes that have not been re-verified for a long time.

[0120] In some implementations, the time decay factor The exponential decay model can be used for calculation:

[0121]

[0122] in, Let λ represent the initial confidence score, λ represent the decay rate, and t represent the time interval since the last verification.

[0123] Furthermore, the half-life corresponding to the time decay model can be expressed as:

[0124]

[0125] In some implementations, the corresponding half-life parameter can be dynamically adjusted according to different security level scenarios. For example, a shorter half-life can be used in high security level scenarios and a longer half-life can be used in low security level scenarios to improve the adaptability of trusted state assessment in different scenarios.

[0126] The system can generate a comprehensive trust score based on remote proof score, historical behavior trust score, and time decay factor. The comprehensive trust score can be expressed as:

[0127]

[0128] in, Indicates the score for remote proof. Indicates trust score based on historical behavior. Indicates the time decay factor. , as well as This represents the corresponding weight parameter.

[0129] In some implementations, the system can dynamically adjust the corresponding weight parameters according to different business scenarios. For example, in high-security scenarios, the weight corresponding to the remote proof score can be increased, and in long-term operation scenarios, the weight corresponding to the historical behavior trust score can be increased, thereby improving the adaptability of the comprehensive trust score to different business scenarios.

[0130] The generated comprehensive trust score can be used as a trust status representation parameter in the access profile to participate in subsequent candidate access domain selection, joint scoring, access orchestration, and re-orchestration processes. When the comprehensive trust score is lower than a preset trust threshold, the system can restrict the corresponding node from entering a high-sensitivity domain or directly deny the corresponding node access.

[0131] In the above embodiments, by introducing a joint trust modeling mechanism that combines remote proof score, historical behavior trust score, and time decay factor, a dynamic quantitative assessment of the trust status of nodes to be accessed is achieved, thereby improving the access profile's ability to reflect the true trust status of nodes. Furthermore, the time decay mechanism and the dynamic update mechanism for historical behavior can reduce the impact of long-term unverified nodes or abnormal nodes on system trustworthiness, improving the accuracy and security of access decisions in complex computing network environments.

[0132] In one embodiment, the step of constructing a dynamic constraint model based on business intent, policy constraints, resource constraints, and network status, and performing joint scoring on candidate access domains and candidate paths based on the dynamic constraint model to filter candidate solutions, includes:

[0133] A multi-objective constrained optimization model is constructed using the combination of node selection and routing path as decision variables;

[0134] The multi-objective constrained optimization model includes hard constraints and an objective function, wherein the objective function is constructed by weighted summation of multiple optimization components.

[0135] The optimization components include a latency optimization component to characterize end-to-end latency, a resource utilization optimization component to characterize target domain resource utilization, and a load balancing optimization component to characterize global load balancing.

[0136] Specifically, the system can perform joint constraint modeling and optimization on candidate access domains and candidate paths based on the access profile, service intent, resource status, and candidate access domain status of the node to be accessed, so as to improve the comprehensive balance between reliability, resource utilization efficiency and global network stability of the access orchestration results.

[0137] The system can use the combination of node selection and routing path as decision variables, and construct a multi-objective constraint optimization model based on candidate access domain status, link status, resource status, and service requirements. This multi-objective constraint optimization model can be used to perform unified constraint analysis and comprehensive optimization on different candidate schemes.

[0138] In some implementations, the multi-objective constrained optimization model can be expressed as:

[0139]

[0140]

[0141] Where x represents the decision variable corresponding to the combination of node selection and routing path. Indicates the delay optimization component, This represents the component for optimizing resource utilization. This indicates the load balancing optimization component. Represents a set of hard constraints. This represents the state where the hard constraints for candidate solution x are satisfied.

[0142] The latency optimization component can be used to characterize the end-to-end latency status between the node to be accessed and the target access domain. The system can generate corresponding latency optimization components based on link hop count, network congestion status, path propagation latency, forwarding latency, or interconnection link status. When the end-to-end latency corresponding to the candidate path is low, the latency optimization result of the corresponding candidate scheme can be improved.

[0143] The resource utilization optimization component can be used to characterize the current resource utilization status of the target access domain. The system can generate corresponding resource utilization optimization components based on the resource availability, resource occupancy rate, service carrying status, resource saturation level, or resource distribution status in the target access domain. When the resource utilization rate of the target access domain is high or the resource availability is insufficient, the system can reduce the priority of the corresponding candidate solutions to reduce the risk of resource hotspot concentration.

[0144] Load balancing optimization components can be used to characterize the impact of different candidate schemes on global resource distribution and global network load status. The system can generate corresponding load balancing optimization components based on resource distribution, link load, network congestion status, and regional resource balance status among different access domains. When a candidate scheme can improve the global resource balance or reduce the risk of local resource congestion, the load balancing optimization result of the corresponding candidate scheme can be improved.

[0145] Furthermore, in some implementations, the set of hard constraints includes at least the constraint that the comprehensive trust score meets the minimum trust threshold, the constraint that the target security domain meets the cross-domain policy constraint, and the constraint that the compliance authentication validity is satisfied.

[0146] In some implementations, the minimum confidence threshold constraint can be expressed as:

[0147]

[0148] in, Indicates the overall credibility score. This represents the lowest confidence threshold.

[0149] For candidate solutions that do not meet the hard constraints, the system can directly perform filtering. For example, when a candidate access domain does not meet the minimum trust threshold, target domain policy restrictions, geographical restriction rules, or minimum resource threshold, the system can directly eliminate the corresponding candidate solution to prevent nodes that do not meet the basic access conditions from entering the subsequent scoring stage.

[0150] In some implementations, the system can use resource utilization constraints, latency constraints, path preference constraints, or load balancing constraints as soft constraints, and integrate these soft constraints into the objective function through a penalty function to achieve a unified solution for different optimization objectives.

[0151] In some implementations, the system may also use resource utilization constraints, latency constraints, path preference constraints, or load balancing constraints as soft constraints, and integrate these soft constraints into the objective function through a penalty function.

[0152] The corresponding objective function can be expressed as:

[0153]

[0154] in, This indicates the weights corresponding to the delay optimization components. The weights of the resource utilization optimization components are represented by λ, where λ represents the penalty coefficient. This indicates the degree to which the candidate solution violates the soft constraints.

[0155] In some implementations, the system can dynamically adjust the weight parameters corresponding to different optimization components according to different business intentions. For example, in low-latency business scenarios, the weight corresponding to the latency optimization component can be increased; in distributed training scenarios, the weight corresponding to the resource utilization optimization component can be increased; and in large-scale cross-domain access scenarios, the weight corresponding to the load balancing optimization component can be increased, so as to improve the adaptability of access orchestration results under different business scenarios.

[0156] This embodiment constructs a multi-objective constraint optimization model that includes hard constraints, multiple optimization components, and a soft constraint penalty mechanism. This model enables joint modeling and comprehensive optimization of candidate access domains and candidate paths, thereby improving the overall coordination capability of access orchestration results in terms of reliability, resource utilization efficiency, and global load balancing. Furthermore, by introducing a soft constraint penalty mechanism and a collective communication efficiency correction mechanism, the dynamic adaptability and resource scheduling capability of access orchestration results in complex computing network environments and distributed training scenarios can be improved.

[0157] In one embodiment, performing joint scoring on candidate access domains and candidate paths based on the dynamic constraint model includes:

[0158] A joint scoring is performed on candidate solutions that satisfy the hard constraints to determine the values ​​of each optimization component;

[0159] The joint score includes a resource adaptation score component, an intent compatibility score component, and a trustworthy adaptation score component.

[0160] The resource adaptation score component corresponds to the resource utilization optimization component, the intent compatibility score component corresponds to the latency optimization component and the load balancing optimization component, and the trusted adaptation score component is determined by the comprehensive trusted score in the access profile.

[0161] Specifically, after filtering under hard constraints, the system can perform joint scoring on candidate solutions that meet the basic access conditions to further determine the comprehensive performance of different candidate solutions in terms of resource adaptability, business intent adaptability, and credibility.

[0162] In some implementations, the system can calculate a comprehensive score AdmissionScore(d) for each candidate access domain d, and the corresponding joint score result can be expressed as:

[0163]

[0164] Where T(d) represents the trusted adaptation score component, C(d) represents the intent compatibility score component, and R(d) represents the resource adaptation score component. , as well as This indicates the weight of the corresponding rating component.

[0165] The trusted adaptation score component T(d) can be used to characterize the trustworthiness of the node corresponding to the candidate access domain. In some implementations, the trusted adaptation score component T(d) can be further extended based on the comprehensive trusted score in the access profile, and jointly corrected by authentication status, historical access records, compliance authentication status, and historical reputation status. The system can generate a corresponding trusted adaptation score based on authentication status, historical reputation status, compliance authentication status, and historical access behavior.

[0166] In some implementations, the trusted fit scoring component T(d) can be expressed as:

[0167]

[0168] in, Indicates identity and certificate verification score. Indicates historical reputation score, Indicates compliance certification score, This indicates the score for historical access records.

[0169] In some implementations, the historical reputation score T_repu can be expressed as:

[0170]

[0171] SuccessRate represents the historical access success rate. This indicates the number of historical penalties. AttendanceRate represents the node's online attendance rate. By default, w_1=0.5, w_2=0.3, and w_3=0.2.

[0172] The system can dynamically adjust the corresponding trustworthiness score based on the node's historical stable operation, abnormal behavior, and historical trustworthiness status. When a node has a large number of historical abnormal behaviors or frequent violation records, the corresponding trustworthiness score can be lowered.

[0173] The resource adaptation score component R(d) can be used to characterize the degree of resource matching between the candidate access domain and the node to be accessed. The system can generate corresponding resource adaptation scores based on computing power, memory capacity, memory bandwidth, interconnect bandwidth, resource carrying capacity, and service exposure capabilities.

[0174] In some implementations, the resource adaptation score component R(d) can be expressed as:

[0175]

[0176] Where n represents the total number of resource indicators, This indicates the weights corresponding to different resource indicators. This indicates the normalization result of the corresponding resource indicator.

[0177] In some implementations, the resource adaptation score may include six-dimensional resource indicators:

[0178] The computing power metric has a weight α = 0.30. The system can use logarithmic normalization to normalize the corresponding TFLOPS or TOPS of the GPU or NPU to support cross-order-of-magnitude computing power comparisons. The corresponding normalization method can be expressed as:

[0179]

[0180] Where x represents the current value of the resource metric. This represents the minimum value of the corresponding resource indicator. This indicates the maximum value of the corresponding resource indicator.

[0181] The video memory capacity metric has a weight α = 0.20. The system can generate the corresponding video memory capacity score using Min-Max normalization.

[0182] The memory bandwidth metric has a weight α = 0.15. The system can generate the corresponding memory bandwidth score using the Min-Max normalization method.

[0183] The interconnection bandwidth metric has a weight of α=0.15. The system can generate a corresponding interconnection bandwidth score based on the protocol type correction coefficient and the normalized result of the measured bandwidth. The protocol type correction coefficient λ_protocol can include IB=1.0, RoCE=0.85, and TCP=0.50.

[0184] The carrying capacity index has a weight α = 0.15. The system can use Sigmoid normalization to normalize the carrying capacity of the target access domain resources. The corresponding normalization method can be expressed as:

[0185]

[0186] Where k represents the normalized slope parameter, This represents the resource carrying capacity threshold.

[0187] The exposure capability metric has a weight α = 0.05. The system can generate the corresponding service exposure capability score using Min-Max normalization.

[0188] In some implementations, when the target access scenario is a distributed training scenario, the system may further introduce a collective communication efficiency factor. The resource compatibility score has been revised.

[0189] The corresponding correction method can be expressed as:

[0190]

[0191] Where R'(d) represents the resource adaptation score after incorporating set communication efficiency correction, and R(d) represents the original resource adaptation score. This represents the communication efficiency factor, and β represents the corrected weight parameter for distributed training scenarios. The default value is β=0.20.

[0192] In some implementations, the aggregation communication efficiency factor It can be represented as:

[0193]

[0194] in, This indicates the measured AllReduce bandwidth. Indicates the theoretical peak bandwidth. This indicates the protocol type correction factor.

[0195] The intent compatibility score component C(d) can be used to characterize the degree to which candidate solutions adapt to business intent and policy constraints. The system can generate corresponding intent compatibility scores based on hardware matching status, latency matching status, path reachability status, policy compatibility status, compliance satisfaction status, and exposure method compatibility status.

[0196] In some implementations, the intended compatibility rating component C(d) can be expressed as:

[0197]

[0198] Where m represents the total number of intent compatibility metrics. This indicates the weights corresponding to compatibility metrics for different intentions. This indicates the compatibility result of the candidate access domain d under the service intent I.

[0199] In some implementations, the intent compatibility score may include the following six sub-indicators:

[0200] Hardware matching degree M1, with a weight γ=0.15, is used to characterize the degree of matching between the accelerator type and the target mission requirements;

[0201] The latency matching degree M2, with a weight γ=0.25, is used to characterize the degree of matching between the latency status of the candidate path and the latency requirement of the target service.

[0202] Path reachability M3, with a weight γ=0.15, is used to characterize whether the target path meets the network connectivity requirements;

[0203] The policy compatibility M4, with a weight γ=0.20, is used to characterize whether the candidate solution meets the policy constraints.

[0204] The compliance satisfaction score M5, with a weight γ=0.15, is used to characterize whether the candidate solution meets the regional compliance requirements and the security compliance requirements.

[0205] Exposure mode compatibility M6, with a weight γ=0.10, is used to characterize the degree of adaptation between service exposure mode and business requirements.

[0206] In some implementations, the delay matching degree M2 can be calculated using a piecewise linear decay function. When L(d)≤L_target, M2=1.0; when L_target<L(d)<L_budget, it can be calculated using a linear decay method; when L(d)≥L_budget, M2=0.

[0207] The corresponding calculation method can be expressed as:

[0208]

[0209] Where L(d) represents the delay of the current candidate path, Indicates the target delay. This indicates the maximum allowable delay.

[0210] In some implementations, the system can dynamically adjust the weights of corresponding scoring components based on the business priority in the business intent. The weight adjustment mechanism can employ a dynamic adjustment mechanism combining lookup tables and rule engines.

[0211] For example, when the business type is a high-sensitivity compliance isolation scenario, the weight of the trust compatibility score can be increased; when the business type is a distributed training expansion scenario, the weight of the resource compatibility score can be increased; when the business type is a low-latency inference scenario, the weight of the intent compatibility score can be increased.

[0212] Furthermore, in some implementations, the system can also dynamically adjust the weights of each scoring component based on a rules engine. For example, when the compliance requirements for a business scenario are at a strict level, the weight of the trusted adaptation score is increased to enhance the focus on the trusted and compliant status of nodes during the access decision-making process; when the expected bandwidth requirement for a business scenario is greater than or equal to 100Gbps, the weight of the resource adaptation score is increased to enhance the assessment of high-performance interconnection capabilities and resource carrying capacity; when the latency requirement for a business scenario is less than 5ms, the weight of the intent compatibility score is increased to enhance the optimization of path latency and service response capabilities during the access decision-making process.

[0213] In some implementations, the system may also set a minimum weight limit for each scoring component. =0.10, to prevent any scoring dimension from being completely ignored, thereby improving the comprehensiveness and stability of the access decision-making process.

[0214] After completing the joint scoring, the system can sort different candidate schemes according to AdmissionScore(d) and select the candidate scheme with the best score or that meets the target conditions to enter the subsequent access orchestration stage.

[0215] In the above embodiments, by constructing a joint scoring mechanism among trustworthiness matching score, resource matching score, and intent compatibility score, unified collaborative modeling of node trustworthiness status, resource status, and business intent is achieved, thereby improving the dynamic adaptability of access orchestration results in complex computing network environments. Furthermore, by introducing multi-dimensional resource indicators, a collective communication efficiency correction mechanism, and an intent-driven dynamic weight adjustment mechanism, resource scheduling capabilities and access decision accuracy in distributed training scenarios, high-security scenarios, and low-latency scenarios can be further improved.

[0216] Furthermore, in one embodiment, the evaluation of the candidate schemes, taking into account the impact of the access node on the global network topology, to generate access orchestration results includes:

[0217] The AdmissionPlan is generated based on the candidate scheme scoring results and the global topology impact assessment results.

[0218] Specifically, after completing the joint scoring of candidate schemes and the global impact assessment, the system can generate the corresponding access orchestration result AdmissionPlan to guide the subsequent node access execution process.

[0219] In some implementations, the AdmissionPlan includes at least the primary access domain, backup domains, exposure mode, candidate paths, admission level, rollback action, and plan duration.

[0220] Among them, primary_domain represents the current target primary access domain; backup_domains represents the backup access domains that can be switched to when the current access fails or the target domain is abnormal; exposure_mode represents the service exposure mode; candidate_paths represents the set of candidate communication paths; admission_level represents the access permission level allowed by the current node; rollback_action represents the rollback action corresponding to the access failure; and plan_ttl_s represents the effective time period corresponding to the current access orchestration result.

[0221] In some implementations, the access levels include at least full access, restricted access, gray-scale access, and denied access.

[0222] Full access indicates that the corresponding node meets all trust and resource conditions, allowing the node to perform full service access; restricted access indicates that the corresponding node is allowed to perform partial service access under preset restrictions; gray-scale access indicates that the corresponding node is only allowed to carry a portion of test traffic or a low proportion of service traffic; in some implementations, the system can perform phased traffic ramping control on gray-scale access nodes based on preset traffic ratios, and dynamically adjust the corresponding traffic ratios according to operational stability. Denied access indicates that the corresponding node does not meet the basic access conditions and is prohibited from entering the target network environment.

[0223] In some implementations, the system can dynamically determine the corresponding access level based on the node's trust level, resource status, policy restrictions, and global impact assessment results.

[0224] The rollback operation includes at least revoking exposure, switching to a backup domain, reclaiming access entries, and isolating nodes.

[0225] Among them, "Cancel Exposure" is used to cancel the service exposure relationship corresponding to the current node; "Switch to Backup Domain" is used to migrate the node to the backup access domain when the current access domain is abnormal; "Reclaim Access Entry" is used to delete the routing entries, access mapping relationships or resource binding relationships generated during the current access process; and "Isolate Node" is used to restrict abnormal nodes from continuing to participate in subsequent network communication or resource scheduling.

[0226] Before generating the AdmissionPlan, the system can further calculate the impact of the access node on the global network topology.

[0227] In some implementations, global topology impact scoring It can be represented as:

[0228]

[0229] in, This represents the single-link capacity impact factor. This represents the influence value corresponding to the resource coupling strength matrix. This represents the change in the global equilibrium index. , as well as This represents the corresponding weight parameter.

[0230] In some implementations, the single-link capacity impact factor It can be represented as:

[0231]

[0232] in, This represents the expected increase in traffic to be introduced by the node to be connected. This indicates the currently available bandwidth for the corresponding link.

[0233] The system can analyze the impact of node access on the bandwidth utilization and congestion risk of critical links based on single-link capacity impact factors. When the remaining bandwidth of the corresponding link is low, the impact value of the corresponding link can increase.

[0234] In some implementations, the resource coupling strength matrix C_ij can be expressed as:

[0235]

[0236] Where P(i,j) represents the set of paths corresponding to resource i and resource j. Indicates link weight, as well as Indicates the corresponding resource load status. Indicates the link bandwidth.

[0237] The system can analyze the degree of correlation between different resources based on the resource coupling strength matrix to identify potential resource hotspots or link coupling risk areas.

[0238] The change in the global equilibrium index It can be used to characterize the global resource distribution and load changes before and after a node is connected. When the connection of a node leads to an increase in the degree of regional resource imbalance, the corresponding change in the global equilibrium index may increase.

[0239] In some implementations, when Exceeding the preset impact threshold In such cases, the system can reduce the access priority of the corresponding candidate solution, or further incorporate the corresponding candidate solution into the neighborhood-aware decision-making mode or the global optimization mode to re-execute the access evaluation.

[0240] In some implementations, the system may employ a three-stage progressive global optimization scheme to perform differentiated optimizations for different access scenarios.

[0241] Phase 1 is a single-point admission mode. In this mode, the system makes access decisions based solely on the remaining resources of the candidate node, making it suitable for lightweight access scenarios.

[0242] Phase two is the neighborhood-aware mode. In this mode, the system further incorporates the resource status of one-hop neighbors and the remaining capacity of shared links for joint evaluation, which is suitable for medium-sized cluster access scenarios.

[0243] Phase three is the global optimization mode. In this mode, the system performs a comprehensive analysis of link status, resource status, path status, and load status based on a complete global computing network topology map, which is suitable for large-scale cross-domain access scenarios.

[0244] In some implementations, the system can be based on The system dynamically switches between different optimization stages based on the degree of impact. When the impact is low, a single-point admission mode is used; when the impact is moderate, it switches to a neighborhood awareness mode; and when the impact is high, it switches to a global optimization mode to improve the dynamic adaptability and resource scheduling capability of the access orchestration process in complex computing network environments.

[0245] In the above embodiments, by constructing an access orchestration result generation mechanism that includes a primary access domain, a backup domain, candidate paths, and rollback operations, structured orchestration and dynamic control of the access process are achieved. Furthermore, by introducing a global topology impact assessment mechanism and a three-stage progressive global optimization mechanism, the ability of access decisions to perceive link status, resource status, and global load status in complex computing network environments can be improved, thereby enhancing the overall system stability and resource scheduling efficiency.

[0246] In one embodiment, performing joint scoring on candidate access domains and candidate paths based on the dynamic constraint model further includes:

[0247] When the multi-objective constrained optimization model has no feasible solution, at least one of the following processing strategies shall be executed:

[0248] The soft constraint relaxation strategy is to remove all soft constraints and retain only the hard constraints for resolving.

[0249] A hierarchical relaxation strategy for hard constraints is implemented, which downgrades low-priority hard constraints to soft constraints with penalties in a priority sequence.

[0250] The fallback strategy is to select the candidate solution with the lowest constraint violation as the degraded solution.

[0251] And a delayed rescheduling strategy that rejects access and adds the node to be accessed to the scheduling queue when the constraint violation exceeds the security threshold.

[0252] Specifically, such as Figure 3 As shown, when the system solves for candidate access domains and candidate paths based on a multi-objective constraint optimization model, there may be no feasible solution that satisfies all constraints due to insufficient resources, path limitations, conflicts in trusted constraints, or policy restrictions. In this case, the system can execute corresponding constraint relaxation and degradation processing strategies to improve the continuity and fault tolerance of access orchestration in complex computing network environments.

[0253] Among them, the soft constraint relaxation strategy can be used to relax the constraints corresponding to some non-critical optimization objectives while retaining the basic security constraints and trust constraints, so as to improve the feasibility of candidate solutions.

[0254] In some implementations, when the system detects that no feasible solution exists in the current multi-objective constrained optimization model, it can remove all soft constraints and retain only the hard constraints to re-execute the solution. The soft constraints may include non-mandatory constraints such as resource utilization constraints, load balancing constraints, path preference constraints, or latency preference constraints.

[0255] For example, when a low-latency service cannot simultaneously meet both low-latency constraints and load balancing constraints, the system can prioritize retaining trust constraints, compliance constraints, and minimum resource threshold constraints, and temporarily remove load balancing-related soft constraints to increase the probability of generating candidate solutions.

[0256] In some implementations, the degree of violation of soft constraints can be introduced into the objective function through a penalty function, and the corresponding penalty term can be expressed as follows:

[0257]

[0258] Where λ represents the penalty coefficient. Represents the set of soft constraints for candidate solution x. The degree of violation.

[0259] The hard constraint hierarchical relaxation strategy can be used to perform limited degradation processing on low-priority hard constraints when the basic feasible solution still does not exist, so as to further improve the recoverability of access orchestration in complex scenarios.

[0260] In some implementations, the system can generate a constraint priority sequence based on the importance of different hard constraints, and progressively convert low-priority hard constraints into soft constraints with penalties. For example, some area access restrictions, some business preference restrictions, or some resource redundancy restrictions can be downgraded to soft constraints, while trust constraints, compliance constraints, and critical isolation constraints are retained.

[0261] In some implementations, the system can calculate the degree of constraint violation based on the following method:

[0262]

[0263] in, This indicates the degree of violation of the i-th constraint for candidate solution x. This represents the actual value of the i-th constraint corresponding to candidate solution x. This indicates the corresponding constraint boundary.

[0264] The rollback strategy can be used to select the candidate solution with the least degree of constraint violation as the downgraded access solution when it is still impossible to generate a candidate solution that fully satisfies the constraints.

[0265] In some implementations, the system can sort the constraint violation rates of multiple candidate solutions and select the candidate solution with the lowest constraint violation rate as the fallback solution. For example, when all candidate access domains have partial resource shortages, the system can prioritize the candidate solution with the smallest resource gap and satisfactory trusted state as the downgraded access result.

[0266] Furthermore, in some implementations, the system can also impose additional restrictions on the fallback scheme. For example, it can restrict the corresponding node to only access low-sensitivity service domains, limit the maximum resource quota of the corresponding node, or limit the service exposure range of the corresponding node, so as to reduce the impact of downgraded access on the overall system stability.

[0267] The delayed rescheduling strategy can be used to temporarily suspend the current access operation when a safe and feasible solution cannot be generated in the current environment, and wait for the subsequent resource status to recover or the network status to change before rescheduling is performed.

[0268] In some implementations, when the constraint violation exceeds a preset security threshold, the system can reject the current access request and add the corresponding node to the scheduling queue. The scheduling queue can be used to cache node requests that currently do not meet the access conditions but are allowed to be rescheduled later.

[0269] In some implementations, the system can periodically re-detect the resource status, link status, and candidate access domain status of the corresponding nodes in the scheduling queue, and re-execute the constraint modeling and access orchestration process after detecting resource recovery, path recovery, or policy change.

[0270] Furthermore, in some implementations, the system can also dynamically adjust the rescheduling order based on the service priority, waiting time, or trust level of the nodes in the scheduling queue, so as to improve the access recovery efficiency in high-priority service scenarios.

[0271] In the above embodiments, by constructing soft constraint relaxation strategies, hard constraint hierarchical relaxation strategies, rollback strategies, and delayed rescheduling strategies, dynamic fault-tolerant processing is achieved when there is no feasible solution in the multi-objective constraint optimization model, thereby improving the stability and recoverability of the access orchestration system in complex computing network environments. Furthermore, through constraint violation analysis and hierarchical constraint degradation mechanisms, the flexibility and resource utilization efficiency of the access orchestration process can be improved while ensuring basic security and trustworthiness.

[0272] Furthermore, in one embodiment, the system can also perform predictive access scheduling based on historical state sequences and resource change trends.

[0273] Specifically, the system can predict the trend of resource changes and network status changes in the future based on the historical resource status, historical link status, historical load status and historical drift event sequence of the target access domain, and perform access orchestration optimization in advance based on the prediction results.

[0274] In some implementations, the system can predict the future resource availability, link congestion probability, and node load change trends of the target access domain based on time series prediction models, sliding window statistical models, or machine learning prediction models.

[0275] The predictive metrics include at least the future GPU memory availability, future link bandwidth availability, future network congestion probability, and future drift risk level.

[0276] In some implementations, the system can generate a prediction confidence score based on the prediction results, and determine whether to perform a pre-arrangement or pre-migration operation based on the prediction confidence score.

[0277] When the prediction confidence level is greater than a preset threshold, the system can generate an alternative AdmissionPlan in advance and pre-establish corresponding candidate paths, alternative routes or service exposure relationships to reduce the switching latency when subsequent state drift events occur.

[0278] Furthermore, in some implementations, when the prediction result indicates that the future resource shortage risk of the target access domain exceeds a preset threshold, the system can perform node migration, resource expansion, or access path switching operations in advance to reduce the risk of service interruption caused by sudden resource depletion during operation.

[0279] In the above embodiments, by constructing a predictive access scheduling mechanism based on historical state sequences and future trend predictions, the system achieves early perception and proactive scheduling of potential resource risks and link risks in complex computing network environments, thereby improving the forward-looking control capability, dynamic adaptability, and system operation stability of the access orchestration system.

[0280] In one embodiment, the step of updating the dynamic constraint model based on the drift state upon detecting a state drift event, and triggering re-verification, re-decision, and rearrangement, includes:

[0281] The frequency of occurrence of the state drift event within a preset time window is statistically analyzed, and a target cooling level is determined based on the occurrence frequency. The target cooling level is used to characterize the suppression duration of the re-arrangement.

[0282] Based on the suppression duration and time decay model, the rearrangement is subjected to suppression or desuppression operations.

[0283] After the suppression is lifted, a rate limit determination is made for the total re-arrangement frequency and the single-node re-arrangement frequency.

[0284] When the speed limit determination conditions are met, the re-verification, re-decision, and rearrangement are performed based on the updated dynamic constraint model.

[0285] Specifically, such as Figure 4 As shown, the system can continuously monitor the node's operating status, link status, resource status, trust status, and service status after the node completes access. When a state drift event is detected, the system performs classification analysis, risk assessment, and re-orchestration control on the corresponding drift event to improve the stability and autonomous recovery capability of the access orchestration system in complex computing network environments.

[0286] In some implementations, the system employs a three-layer hybrid monitoring architecture of "probe-telemetry-agent" to continuously monitor the node status.

[0287] Link-layer monitoring is used to monitor network link status and interconnection status. The system can use the BFD protocol to perform link fault detection and continuously push link status data using streaming telemetry.

[0288] In some implementations, the BFD protocol uses a 50ms transmission interval and a 3x detection rate by default to achieve a link fault detection capability of approximately 150ms; the streaming telemetry method uses a 1-second acquisition cycle to continuously collect link status data by default.

[0289] Service layer monitoring is used to monitor operational information related to GPU, NPU, and trusted status. The system can collect the operating status of the GPU or NPU, and collect certificate status and policy version status through the monitoring agent.

[0290] In some implementations, a default sampling period of 15 seconds is used to collect indicators such as video memory usage, resource utilization, temperature, power consumption, and ECC errors; the monitoring agent uses a default sampling period of 30 seconds to check certificate validity and policy version consistency.

[0291] Application-layer monitoring is used to monitor service runtime status and application reachability. The system can use KubernetesProbe, API gateway proactive health checks, and gRPC Health Check to perform service status monitoring.

[0292] In some implementations, Kubernetes Probe performs liveness and readiness checks every 10 seconds by default; API Gateway proactive health checks perform health probes every 5 to 10 seconds by default; and gRPC HealthCheck is used to detect the availability status of service interfaces.

[0293] In some implementations, the system can construct a multi-dimensional monitoring indicator system based on trusted status, certificate status, link status, RDMA link status, target domain resource status, and network congestion status, as shown in Table 1 below.

[0294] Table 1

[0295]

[0296] In some implementations, when the amount of free GPU memory decreases by more than 50% within half a sampling cycle, the system triggers a Warning alarm; when the amount of free GPU memory decreases by more than 80%, the system triggers a Critical alarm, in order to improve the response capability to sudden resource exhaustion scenarios.

[0297] In some implementations, the state drift events include at least certificate expiration, certificate invalidation, remote authentication failure, domain policy version update, link unreachable, service exposure capability change, and insufficient target domain resources.

[0298] When the number of consecutive anomalies exceeds a preset threshold, a state drift event is marked as a high-risk event, or the validity period of the AdmissionPlan (plan_ttl_s) expires, the system triggers a re-verification, re-decision, and re-orchestration process.

[0299] In some implementations, the system employs an adaptive graded cooling mechanism based on drift frequency to determine the target cooling level. The corresponding cooling level can be expressed as:

[0300]

[0301] Here, `flap_count_in_window` represents the number of times the state drift event occurs within the preset time window. Indicates the maximum allowed cooling level.

[0302] In some implementations, the cooling levels include at least:

[0303] Level L0 corresponds to the initial arrangement;

[0304] Level L1 corresponds to a single failure or drifting once within 1 hour;

[0305] Level L2 corresponds to two consecutive failures or two to three drifts within one hour.

[0306] Level L3 corresponds to more than 3 consecutive failures or more than 4 drifts within 1 hour.

[0307] Level L4 corresponds to network cascading faults.

[0308] The system can determine the corresponding cooling time based on the target cooling level and dynamically adjust the corresponding penalty value based on the exponential decay penalty model.

[0309] In some implementations, the exponential decay penalty model can be expressed as:

[0310]

[0311] Where P(t) represents the current penalty value at time t. Indicates the initial penalty value. Indicates half-life.

[0312] In some implementations, when the penalty value exceeds the suppression threshold, the system triggers cooling suppression; when the penalty value decays to below the reuse threshold, the system releases the cooling state and allows access orchestration to be re-executed.

[0313] In some implementations, the system may also add a jitter factor to the cooling time to prevent multiple nodes from triggering re-arrangement simultaneously.

[0314] Furthermore, in some implementations, the system employs a two-layer rate-limiting architecture to control the reprogramming frequency.

[0315] The global sliding window controls the overall re-arrangement frequency, while the node-level token bucket controls the burst re-arrangement frequency of a single node.

[0316] In some implementations, the global sliding window is limited by a default total re-arrangement frequency of 10 times / second; the node-level token bucket has a default capacity of 100 and a token filling rate of 10 tokens / second.

[0317] In some implementations, when the rate limit determination condition is met, the system can adjust the constraints, scoring weights, path restrictions or resource status parameters in the dynamic constraint model according to the drift state corresponding to the current state drift event, and re-execute the trust verification, candidate access domain screening, joint scoring and access orchestration process based on the adjusted dynamic constraint model.

[0318] For example, when a link congestion state drift event is detected, the system can increase the weight of path delay-related constraints and restrict highly congested paths from participating in candidate path selection; when insufficient resource reserves in the target domain are detected, the system can adjust resource utilization constraints and reduce the resource adaptation score of the corresponding target domain; when a decline in trusted state is detected, the system can increase the trusted state constraint level and restrict the corresponding node from participating in access to highly sensitive domains.

[0319] Furthermore, the system can regenerate candidate solution priorities based on the updated dynamic constraint model, and perform re-decision and re-orchestration based on the updated candidate solutions, so as to improve the dynamic adaptability of the access orchestration system to changes in runtime state.

[0320] In some implementations, drift events during the cooling period can be classified and processed according to event priority.

[0321] P0 level emergency events include complete certificate invalidation, security threat detection, or high-risk trusted anomalies. A P0 level event immediately interrupts the cooling-off state and triggers an emergency re-orchestration.

[0322] Non-urgent events enter the priority buffer queue and undergo deduplication and aggregation processing and batch reordering processing after the cooldown period.

[0323] In some implementations, the system can also control the re-arrangement process based on a three-state model.

[0324] The Closed state allows normal re-running; the Open state rejects new re-running requests; and the Half-Open state allows tentative re-running.

[0325] In some implementations, when the number of consecutive re-arrangement failures exceeds a preset threshold, the system enters the Open state; after the cooling-off period, the system enters the Half-Open state and allows a limited number of tentative re-arrangement requests; when the tentative re-arrangement is successful, the system returns to the Closed state.

[0326] Furthermore, in some implementations, when a new access plan fails to execute, the system can automatically roll back to the previous stable access plan to improve the operational stability and anomaly recovery capability of the access orchestration system in a complex computing network environment.

[0327] In the above embodiments, by constructing a state drift detection mechanism, an adaptive cooling mechanism, a two-layer rate limiting mechanism, and a three-state circuit breaker autonomous control mechanism based on a three-layer hybrid monitoring architecture, continuous perception and dynamic control of node state changes in complex computing network environments are achieved. Furthermore, by dynamically adjusting the constraints and scoring weights in the dynamic constraint model based on the drift state after the rate limiting judgment condition is met, and re-executing the trust verification, joint scoring, and access orchestration processes, the system's dynamic adaptability to runtime state changes can be improved, reducing the risk of system oscillations caused by frequent re-orchestration. Further, by introducing RDMA link monitoring, memory spike detection, and a multi-level priority event handling mechanism, the system's response capability and autonomous recovery capability to abnormal states in high-performance computing network scenarios can be improved.

[0328] Furthermore, in one embodiment, the system employs a hierarchical control architecture to perform collaborative control over node access, access orchestration, status monitoring, and re-orchestration processes.

[0329] Specifically, the system adopts a three-level hierarchical control architecture and deploys feedback control loops with different time scales at different control layers to achieve policy control, orchestration control and execution control in complex computing network environments.

[0330] In some implementations, the three-tiered hierarchical control architecture includes at least the Intent and Policy Control (IPC) layer, the Orchestration and Decision Control (ODC) layer, and the Execution and Monitoring Control (EMC) layer.

[0331] The Intent and Policy Control (IPC) layer is used to perform global business intent analysis, global policy control, and global optimization decisions. This layer corresponds to time scales from minutes to hours and forms a policy loop control mechanism.

[0332] In some implementations, the control objectives of the IPC layer include maximizing SLA compliance rate, minimizing global resource cost, and minimizing the frequency of drift events.

[0333] The corresponding state variables at the IPC layer may include global resource status. SLA compliance rate, effective strategy set, and overall health status.

[0334] In some implementations, the optimization objective for the IPC layer can be expressed as:

[0335]

[0336] in, This represents the global optimization objective function corresponding to the intent and policy control layer. Indicates SLA compliance rate, Represents the global resource cost function. This indicates the frequency of drift events.

[0337] The IPC layer can receive business intent information, compile the business intent into a formal constraint set, and then send it to the orchestration and decision control layer (ODC).

[0338] The Orchestration and Decision Control (ODC) layer is used to perform credible constraint analysis, joint scoring, constraint solving, and Admission Plan generation. This layer corresponds to time scales from seconds to minutes and forms a slow-loop control mechanism.

[0339] In some implementations, the status variables corresponding to the ODC layer include at least the node capability set C_nodes, the trust matrix T_matrix, the access profile set P_profiles, the AdmissionPlan status AP_status, and the drift alarm set D_alerts.

[0340] The ODC layer can perform hard constraint filtering, multi-dimensional joint scoring, candidate path selection, and access orchestration generation based on node capability status, access profile status, and trust status.

[0341] In some implementations, the trust constraint conditions corresponding to the ODC layer can be expressed as:

[0342]

[0343] in, Represents the trust matrix. This represents the confidence threshold.

[0344] The system can execute node access decisions under trusted constraints to improve the trustworthiness and security of the access orchestration process in complex computing network environments.

[0345] The Execution and Monitoring Control (EMC) layer is used for Admission Plan distribution, configuration execution, status monitoring, and execution status feedback. This layer corresponds to a millisecond to second time scale and forms a fast-loop control mechanism.

[0346] In some implementations, the state variables corresponding to the EMC layer include at least the configuration state S_config, the connection state S_conn, the resource utilization rate U_resource, the latency indicator H_latency, and the local alarm A_local.

[0347] The EMC layer is responsible for executing access configuration distribution, link establishment, service exposure configuration, routing configuration, and atomic configuration operations, and continuously monitors the deviation between the actual execution status and the target status.

[0348] In some implementations, the optimization objective corresponding to the EMC layer can be expressed as:

[0349]

[0350] in, This represents the objective function representing the execution deviation corresponding to the monitoring and control layer. Indicates the actual operating status. This indicates the target's operating status.

[0351] Based on the above optimization objectives, the system can continuously reduce the deviation between the actual state and the expected state, thereby improving the stability and consistency of the access execution process.

[0352] In some implementations, the control layers can perform collaborative communication through standardized interfaces.

[0353] Specifically, the IPC layer and the ODC layer can transmit constraint sets and policy control information through the intent compilation interface; the ODC layer and the EMC layer can transmit access orchestration results through the AdmissionPlan distribution interface; the EMC layer and the ODC layer can transmit monitoring data and execution status through the status feedback interface; and the ODC layer and the IPC layer can transmit drift alarms and re-orchestration status information through the drift event reporting interface.

[0354] In some implementations, the interfaces of each layer can adopt standardized message formats and support asynchronous communication mechanisms; asynchronous message transmission between each control layer can be performed based on event bus, message queue or publish-subscribe mechanism to reduce the coupling between different control layers and improve the decoupling capability and horizontal expansion capability of multi-layer control systems in complex computing network environments.

[0355] Furthermore, in some implementations, when the EMC layer detects that the deviation between the actual state and the desired state exceeds a preset threshold, the EMC layer reports a drift event to the ODC layer.

[0356] Upon receiving a drift event, the ODC layer can trigger re-verification, re-decision, and re-orchestration processes.

[0357] When the frequency of drift events exceeds the threshold of the corresponding policy of the IPC layer, the ODC layer further reports the drift status to the IPC layer, and the IPC layer can perform policy adjustment, weight adjustment, constraint adjustment or manual intervention decision-making.

[0358] In some implementations, the IPC layer can also dynamically adjust global constraint strategies and global optimization objectives based on historical drift statistics to reduce the risk of system oscillations caused by continuous drift or frequent re-arrangement in complex computing network environments.

[0359] In the above embodiments, by constructing a three-level hierarchical control architecture comprising IPC, ODC, and EMC layers, multi-timescale collaborative control of policy control, access orchestration, and execution monitoring processes in complex computing network environments is achieved. Furthermore, by constructing a feedback control mechanism combining slow and fast loops, the system's dynamic response to state drift, resource changes, and link anomalies can be improved, thereby enhancing the stability, autonomy, and global resource scheduling capabilities of the access orchestration system.

[0360] Furthermore, in one embodiment, the step of sending the access orchestration result to the execution side for access execution includes:

[0361] When an access failure occurs, a rollback score is calculated, and a progressive rollback strategy is triggered when the rollback score is greater than the rollback threshold.

[0362] The progressive rollback strategy includes, in sequence, performing traffic isolation operations, performing configuration rollback operations to revoke changed configurations, performing access entry reclamation operations to delete access records, and performing node isolation operations for abnormal nodes.

[0363] Specifically, after generating the access orchestration results, the system can distribute the corresponding access orchestration results to gateways, proxy nodes, service execution nodes, routing control nodes, or network controllers to perform actual access operations. The access operations may include establishing access relationships, creating routing paths, synchronizing access policies, configuring service exposure rules, updating network forwarding tables, or establishing cross-domain communication relationships.

[0364] During the access process, the system continuously monitors the execution status, link status, configuration status, and node running status of the corresponding access task. When an access failure is detected, the system can further analyze the impact of the current failure on the overall computing network environment and decide whether to trigger a rollback.

[0365] The failure to access the system may include configuration failure, route establishment failure, service exposure failure, link unreachability, abnormal node exit, policy conflict, resource allocation failure, or abnormal change in trusted status.

[0366] The system can generate a corresponding rollback score based on the anomaly level, impact scope, resource consumption, and network status corresponding to the failure state. The rollback score can be used to characterize the degree of impact of the current anomaly state on system stability and network security.

[0367] In some implementations, the rollback score can be expressed as:

[0368]

[0369] in, Indicates the severity of the abnormality. Indicates the degree of resource impact. Indicates the network risk level. , as well as This represents the corresponding weight parameter.

[0370] When the rollback score does not exceed the preset rollback threshold, the system can perform only partial recovery operations or wait for subsequent retries; when the rollback score exceeds the preset rollback threshold, the system can trigger a gradual rollback strategy to gradually restore the system to a stable state.

[0371] Traffic isolation can be used to quickly prevent traffic from abnormal nodes from continuing to affect the target network environment. The system can perform rate limiting, blocking, or isolation on traffic corresponding to abnormal nodes based on network policies, gateway rules, access control rules, or service mesh policies to reduce the risk of abnormal states spreading.

[0372] Configuration rollback can be used to undo configuration changes made during the current access process. The system can restore the original routing configuration, service exposure configuration, access control configuration, or network policy configuration, and delete any temporary configurations added during the current access process.

[0373] In some implementations, the system can save a corresponding configuration snapshot before the access is executed, and restore the corresponding historical configuration state when the configuration rollback operation is triggered, so as to improve the recovery efficiency and configuration consistency of the rollback process.

[0374] The access entry reclamation operation can be used to delete access records, resource binding relationships, or routing entries generated during the current access process. The system can release resource quotas, session resources, routing resources, and access mapping relationships occupied during the current access process to prevent abnormal access states from occupying system resources for a long time.

[0375] Node isolation operations can be used to restrict abnormal nodes from participating in subsequent network interactions or resource scheduling. The system can migrate abnormal nodes to an isolation area, restrict the access permissions of the corresponding nodes, block the cross-domain communication capabilities of the corresponding nodes, or stop the corresponding nodes from participating in the access orchestration process.

[0376] In some implementations, the system can dynamically adjust the execution scope of different rollback stages based on the severity of the anomaly. For example, low-risk anomalies may only require traffic isolation, medium-risk anomalies may require configuration rollback, and high-risk anomalies may require node isolation.

[0377] Furthermore, in some implementations, the system can also generate a corresponding rollback record after the rollback is completed, and write the cause of the exception, the rollback stage, the recovery result and the node status into the exception event log for subsequent exception analysis, strategy optimization and trusted state update processes.

[0378] In some implementations, the system can also dynamically adjust the corresponding rollback threshold based on historical rollback results. For example, when a certain type of anomaly causes serious system impact over a long period, the corresponding rollback threshold can be lowered to improve the system's response speed to high-risk anomalies.

[0379] In the above embodiments, by constructing a progressive rollback mechanism based on rollback scoring, phased recovery control is achieved in access failure scenarios, thereby improving the stability and anomaly recovery capability of the access orchestration system in complex computing network environments. Furthermore, through multi-level rollback strategies such as traffic isolation, configuration rollback, access entry reclamation, and node isolation, the impact of abnormal access states on the overall network environment and resource scheduling system can be reduced.

[0380] In one embodiment, the method further includes:

[0381] When the trusted verification record contains a downgrade pass status, a multi-level network restriction instruction set is generated. The multi-level network restriction instruction set includes at least one of network segmentation restriction, namespace isolation, network policy restriction, gateway rate limiting, data layer read-only restriction, and traffic ratio restriction.

[0382] Specifically, in this embodiment, when the system detects that the trusted verification record corresponding to the node to be accessed is in a downgraded pass state, the corresponding node can be allowed to enter the target network environment in a restricted manner, and a multi-level network restriction instruction set can be generated for the corresponding node to reduce the security risks caused by low-trust nodes to the overall network environment.

[0383] The downgrade pass status can be used to indicate that the corresponding node does not fully meet all trusted access conditions, but meets the preset minimum trusted threshold condition. In this case, the system may not directly reject the corresponding node's access, but instead control the corresponding node's access scope, resource permissions, and service exposure capabilities by applying multi-level restriction policies.

[0384] The system can generate corresponding network restriction instruction sets based on node trust level, anomaly type, risk level, target access domain security level, and service priority. These network restriction instruction sets can be uniformly generated by the control plane and distributed to gateways, proxy nodes, network controllers, service mesh components, or access control components for execution.

[0385] Network segmentation restrictions can be used to limit the access of a node to a specified network segment or low-sensitivity resource area. The system can restrict the operation of a node to a specified network area based on Virtual Local Area Network (VLAN), Virtual Extended Local Area Network (VXLAN), Software Defined Networking (SDN), or logical security domain partitioning, thereby reducing the risk of abnormal nodes accessing other domains.

[0386] Namespace isolation can be used to restrict corresponding nodes to only perform resource access or service calls within a specified namespace. The system can leverage the namespace isolation mechanism within the container orchestration platform to limit the range of resources accessible to corresponding nodes, thereby preventing low-trust nodes from accessing highly sensitive resources.

[0387] Network policy restrictions can be used to limit the network access behavior of corresponding nodes. The system can restrict the target addresses, ports, protocol types, or service ranges that a corresponding node is allowed to access based on network access control policies, service access policies, or traffic control policies. For example, access to the core control plane can be prohibited for a corresponding node, allowing it only to access specified business service interfaces.

[0388] Gateway rate limiting can be used to restrict the network access rate or request frequency of a corresponding node. The system can control the request traffic, number of connections, or bandwidth usage of a corresponding node based on gateway-side rate limiting rules, token bucket mechanisms, or traffic shaping mechanisms, in order to reduce the risk of network congestion or resource contention caused by abnormal nodes.

[0389] Read-only restrictions at the data layer can be used to limit a node to only performing data read operations, while prohibiting it from performing data write, data modification, or data deletion operations. For example, in some low-trust access scenarios, a node may be allowed to access inference data or monitoring data, but prohibited from modifying core training data or system configuration data.

[0390] Traffic ratio limits can be used to restrict the proportion of business traffic allocated to a given node. The system can dynamically adjust the proportion of business traffic that a given node is allowed to carry based on its trust level, risk level, or historical behavior. For example, only a small amount of gray-scale traffic can be allocated to low-trust nodes to reduce the impact of abnormal nodes on the overall stability of the business system.

[0391] In some implementations, the system can also dynamically adjust the corresponding restriction policies based on changes in the node's trust status. When the corresponding node completes trust verification again and its trust level improves, the corresponding restrictions can be gradually lifted; when the risk level of the corresponding node further increases, the restriction intensity can be further increased or the corresponding node's access can be terminated directly.

[0392] Furthermore, in some implementations, the system can generate corresponding restriction levels based on the node trust level and dynamically combine different restriction strategies according to the restriction level. For example, only traffic ratio restrictions are imposed on lightly risky nodes, namespace isolation and network policy restrictions are imposed on medium-risk nodes, and network segmentation restrictions and data layer read-only restrictions are imposed on high-risk nodes.

[0393] In some implementations, the system can also continuously monitor the operating status, access behavior, and traffic behavior of restricted nodes, and dynamically adjust the corresponding network restriction policies based on changes in behavior. When an abnormal behavior trend is detected to be expanding in a corresponding node, the system can increase the corresponding restriction level; when a corresponding node is detected to be running stably for a long period of time, the system can gradually decrease the corresponding restriction level.

[0394] In the above embodiments, by introducing a multi-level network restriction mechanism in the downgraded state, restricted access control for low-trust nodes is achieved, thereby improving the flexibility of the access mechanism in complex computing network environments while ensuring the overall security of the system. Furthermore, by dynamically adjusting the restriction policies and restriction levels, the system's ability to control risks associated with abnormal nodes and its autonomous management capabilities in complex access scenarios can be improved.

[0395] Furthermore, in one embodiment, the method further includes:

[0396] Collect the historical operating status sequence of computing nodes and generate predicted status values ​​through the multi-dimensional resource trend prediction module;

[0397] Calculate a comprehensive predicted confidence level based on the predicted state value, including resource exhaustion confidence, link quality confidence, certificate risk confidence, and hardware health confidence.

[0398] When the comprehensive prediction confidence reaches the preset trigger threshold, an action trigger command is generated that includes the status of attention, alarm, preparation and execution. When the action trigger command is in the execution status, pre-arrangement and pre-migration operations are triggered.

[0399] Specifically, in this embodiment, the system can continuously collect the historical operating status sequence of the corresponding node during the operation of the computing node, and predict the future operating status of the node based on the historical state change trend, so as to identify potential resource risks, link risks, trust risks or hardware anomaly risks in advance, thereby improving the proactive scheduling capability and risk prevention capability of the access orchestration system in complex computing network environments.

[0400] The historical operating status sequence may include resource utilization sequence, link status sequence, certificate status sequence, hardware health status sequence, network load status sequence, service operating status sequence, or node trust status sequence, etc.

[0401] The system can generate corresponding predicted state values ​​based on the collected historical operating state sequences through a multi-dimensional resource trend prediction module. This multi-dimensional resource trend prediction module can predict the future operating state of nodes based on time series analysis, trend fitting analysis, sliding window analysis, state change analysis, or machine learning prediction models.

[0402] In some implementations, the system can predict the trends of resource utilization, link quality, certificate validity, and hardware health status, and generate corresponding predicted status values.

[0403] Among them, the resource utilization prediction status value can be used to characterize the risk of resource exhaustion of the target node within a future preset time window; the link quality prediction status value can be used to characterize the future link congestion risk, link jitter risk, or link degradation risk; the certificate risk prediction status value can be used to characterize the certificate invalidation risk, certificate expiration risk, or trusted status degradation risk; and the hardware health prediction status value can be used to characterize the GPU failure risk, storage failure risk, abnormal heat dissipation risk, or device offline risk.

[0404] The system can generate a corresponding comprehensive prediction confidence score based on the above predicted state values. The comprehensive prediction confidence score can be used to characterize the probability that the target node will enter an abnormal or high-risk state in the future.

[0405] In some implementations, the system can generate resource exhaustion confidence, link quality confidence, certificate risk confidence, and hardware health confidence respectively, and then perform fusion processing on the results of different confidence levels.

[0406] Among them, the resource depletion confidence score can be used to characterize the probability of a node's future resource depletion; the link quality confidence score can be used to characterize the probability of future link degradation; the certificate risk confidence score can be used to characterize the probability of future trust status anomalies; and the hardware health confidence score can be used to characterize the probability of future hardware failures.

[0407] In some implementations, the overall prediction confidence level can be expressed as:

[0408]

[0409] in, This indicates the confidence level of resource depletion. Indicates the confidence level of link quality. Indicates the confidence level of the certificate risk. Indicates the confidence level of hardware health. , , as well as This represents the corresponding weight parameter.

[0410] In some implementations, the system can dynamically adjust the corresponding weight parameters according to different business scenarios. For example, in high-security scenarios, the weight corresponding to certificate risk confidence can be increased; in large-scale training scenarios, the weight corresponding to resource exhaustion confidence can be increased; and in edge node scenarios, the weight corresponding to link quality confidence can be increased.

[0411] The system can generate corresponding action trigger instructions based on the relationship between the comprehensive prediction confidence level and the preset trigger threshold. The action trigger instructions can be used to characterize the future risk level of the current node and the corresponding processing stage.

[0412] Among them, the "Attention" status can be used to characterize a node's future slight risk trend; the "Alarm" status can be used to characterize a node's future risk level continuously increasing; the "Ready" status can be used to characterize a node's future high probability of anomaly and early entry into the resource preparation stage; and the "Execution" status can be used to characterize a node's future high probability of entering an abnormal state and triggering proactive migration or proactive rescheduling processes.

[0413] In some implementations, the system can generate corresponding action trigger states based on different confidence levels. For example, when the overall prediction confidence is lower than a first threshold, an attention state is generated; when the overall prediction confidence is higher than the first threshold but lower than a second threshold, an alarm state is generated; when the overall prediction confidence is higher than the second threshold but lower than a third threshold, a preparation state is generated; and when the overall prediction confidence is higher than the third threshold, an execution state is generated.

[0414] When the action triggers the corresponding execution state, the system can trigger pre-arrangement and pre-migration operations in advance.

[0415] Among them, pre-orchestration operations can be used to generate backup access paths, backup access domains, or backup resource allocation schemes in advance; pre-migration operations can be used to perform service migration, task migration, traffic migration, or resource switching operations in advance to reduce the impact of node anomalies on the overall business system.

[0416] In some implementations, the system can also synchronize the resource status, service configuration status, and access control status of the target node in advance before the formal migration, so as to reduce the risk of business interruption during the formal migration phase.

[0417] Furthermore, in some implementations, the system can dynamically adjust the pre-scheduling trigger threshold and the pre-migration trigger threshold according to different business priorities. For example, a lower trigger threshold can be used for high-priority business scenarios to improve the risk response capability under high-priority business scenarios.

[0418] In some implementations, the system can also dynamically adjust the prediction model parameters based on the deviation between historical prediction results and actual abnormal results, so as to improve the long-term adaptability of the multi-dimensional resource trend prediction module to complex computing network environments.

[0419] In the above embodiments, by constructing a predictive risk analysis mechanism based on historical operational state sequences, resource risks, link risks, trust risks, and hardware risks are identified in advance, thereby improving the proactive risk control capabilities of the access orchestration system in complex computing network environments. Furthermore, by introducing action triggering commands and pre-orchestration and pre-migration mechanisms, the impact of node anomalies on the overall stability of the business system can be reduced, improving system operational continuity and resource scheduling reliability.

[0420] The steps of the various methods described above are only for clarity. In practice, they can be combined into one step or some steps can be split into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this application. Adding insignificant modifications or introducing insignificant designs to the algorithm or process, but without changing the core design of the algorithm and process, are also within the scope of protection of this application.

[0421] Furthermore, some embodiments of this application also provide an electronic device. The electronic device can be various forms of digital computer, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, etc. The electronic device can also be various forms of mobile devices, such as cellular phones, smartphones, wearable devices, and other similar computing devices.

[0422] The electronic device includes: one or more processors; and a memory storing computer program instructions that, when executed, cause the processor to perform the steps of the methods provided in any one or more of the above embodiments. Figure 5 An exemplary structural diagram of the electronic device is disclosed. The electronic device includes one or more processors 1101, a memory 1102, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components are interconnected via different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the electronic device, including instructions stored in or on memory to display graphical information of a GUI on an external input / output device (such as a display device coupled to the interface). In some other embodiments, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple electronic devices can be connected, each providing some of the necessary operations. The components, their connections and relationships, and their functions shown herein are merely examples and are not intended to limit the implementation of the present application described and / or claimed herein.

[0423] The electronic device may further include an input device 1103 and an output device 1104. The processor 1101, memory 1102, input device 1103 and output device 1104 may be connected by a bus or other means, as shown in the figure, which is connected by a bus.

[0424] Input device 1103 can receive input numerical or character information, and generate key signal inputs related to user settings and function control of the electronic device, such as a touch screen, keypad, mouse, trackpad, touchpad, joystick, one or more mouse buttons, trackball, joystick, etc. Output device 1104 may include a display device, auxiliary lighting device (e.g., LED), and haptic feedback device (e.g., vibration motor). The display device may include, but is not limited to, a liquid crystal display, a light-emitting diode display, and a plasma display. In some embodiments, the display device may be a touch screen.

[0425] To provide interaction with the user, the electronic device can be a computer. The computer has: a display device (e.g., a cathode ray tube or LCD monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback); and input from the user can be received in any form (e.g., voice input or tactile input).

[0426] In this embodiment, a computer-readable medium stores a computer program / instructions that, when executed by a processor, implement the steps of the methods provided in any one or more of the above embodiments. This computer-readable medium may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into that device. The aforementioned computer-readable medium carries one or more computer-readable instructions.

[0427] The memory 1102 can serve as a non-transitory computer-readable storage medium, used to store non-transitory software programs, non-transitory computer-executable programs, and modules. The processor 1101 executes various functional applications and data processing of the server by running the non-transitory software programs, instructions, and modules stored in the memory 1102, thereby implementing the program instructions / modules corresponding to the methods provided in any one or more of the embodiments described above in this application.

[0428] The memory 1102 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the electronic device. Furthermore, the memory 1102 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory 1102 may optionally include memory remotely located relative to the processor 1101, and these remote memories can be connected to the electronic device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0429] It should be noted that the computer-readable medium described in this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. Computer-readable media can be, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, electrical connections having one or more wires, portable computer disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory, optical fibers, portable compact disk read-only memory, optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, a computer-readable medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0430] Computer-readable media include permanent and non-permanent, removable and non-removable media, which can store information by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory, static random access memory, dynamic random access memory, other types of random access memory, read-only memory, electrically erasable programmable read-only memory, flash memory or other memory technologies, read-only optical discs, digital versatile optical discs or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0431] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including local area networks (LANs) or wide area networks (WANs), or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0432] In the above embodiments, all or part of the implementation can be achieved through software, hardware, firmware, or any combination thereof. For example, it can be implemented using an application-specific integrated circuit (ASIC), a general-purpose computer, or any other similar hardware device. In some embodiments, the software program of this application can be executed by a processor to implement the above steps or functions. Similarly, the software program of this application (including related data structures) can be stored in a computer-readable recording medium, such as RAM memory, magnetic or optical drives, floppy disks, and similar devices. In addition, some steps or functions of this application can be implemented in hardware, for example, as circuitry that cooperates with a processor to perform the various steps or functions.

[0433] The computer program product provided in this application includes one or more computer programs / instructions. When executed by a processor, these computer programs / instructions generate, in whole or in part, the processes or functions described in this application. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive), etc.

[0434] The flowcharts or block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of devices, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-specific system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0435] The scope of this application is defined by the appended claims rather than the foregoing description, and is therefore intended to encompass all variations falling within the meaning and scope of equivalents of the claims. No reference numerals in the claims should be construed as limiting the scope of the claims. Furthermore, it is clear that the word "comprising" does not exclude other elements or steps, and the singular does not exclude the plural.

[0436] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily made by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims, and the above embodiments should be regarded as exemplary and non-limiting.

Claims

1. A trusted access and networking orchestration method for computing power nodes, characterized in that, The method includes: Obtain information about the nodes to be connected and generate raw access data; Perform a pre-connection trust verification on the node to be connected and generate a trust verification record; Based on the original access data and the trusted verification record, an access profile containing node capabilities and trusted status is generated. A dynamic constraint model is constructed based on business intent, policy constraints, resource constraints, and network status. A joint scoring process is then performed on candidate access domains and candidate paths based on this dynamic constraint model to filter candidate solutions. Specifically, this includes: A multi-objective constrained optimization model is constructed using the combination of node selection and routing path as decision variables; The multi-objective constrained optimization model includes hard constraints and an objective function, wherein the objective function is constructed by weighted summation of multiple optimization components. The optimization components include a latency optimization component for characterizing end-to-end latency, a resource utilization optimization component for characterizing target domain resource utilization, and a load balancing optimization component for characterizing global load balancing. The candidate schemes are evaluated based on their impact on the global network topology after the nodes to be accessed are connected, and an access orchestration result is generated. The access orchestration results are sent to the execution side to execute the access, and the node running status information is continuously monitored; When a drift event in the network state or node state is detected, the dynamic constraint model is updated based on the drift state, triggering re-verification, re-decision, and rearrangement.

2. The method according to claim 1, characterized in that, The step of performing a pre-access trust verification on the node to be connected and generating a trust verification record includes: The following checks are performed on the nodes to be accessed: identity and certificate validity verification, node signature and metadata integrity verification, remote proof verification, whitelist and blacklist verification, and consistency verification of domain policy and compliance constraints. The trusted verification record is generated based on the verification result. The trusted verification record represents any one of the following states: pass, downgrade pass, and rejection.

3. The method according to claim 1, characterized in that, The generation of the access profile, which includes node capabilities and trust status, includes: A comprehensive trust score is generated based on the original access data and the trusted verification record; The comprehensive trust score is calculated by weighting the remote proof score, the historical behavior trust score, and the time decay factor.

4. The method according to claim 1, characterized in that, The joint scoring of candidate access domains and candidate paths based on the dynamic constraint model includes: A joint scoring is performed on candidate solutions that satisfy the hard constraints to determine the values ​​of each optimization component; The joint score includes a resource adaptation score component, an intent compatibility score component, and a trustworthy adaptation score component. The resource adaptation score component corresponds to the resource utilization optimization component, the intent compatibility score component corresponds to the latency optimization component and the load balancing optimization component, and the trusted adaptation score component is determined by the comprehensive trusted score in the access profile.

5. The method according to claim 1, characterized in that, The joint scoring of candidate access domains and candidate paths based on the dynamic constraint model also includes: When the multi-objective constrained optimization model has no feasible solution, at least one of the following processing strategies shall be executed: The soft constraint relaxation strategy is to remove all soft constraints and retain only the hard constraints for resolving. A hierarchical relaxation strategy for hard constraints is implemented, which downgrades low-priority hard constraints to soft constraints with penalties in a priority sequence. The fallback strategy is to select the candidate solution with the lowest constraint violation as the degraded solution. And a delayed rescheduling strategy that rejects access and adds the node to be accessed to the scheduling queue when the constraint violation exceeds the security threshold.

6. The method according to claim 1, characterized in that, Upon detecting a state drift event, the dynamic constraint model is updated based on the drift state, triggering re-verification, re-decision, and rearrangement, including: The frequency of occurrence of the state drift event within a preset time window is statistically analyzed, and a target cooling level is determined based on the occurrence frequency. The target cooling level is used to characterize the suppression duration of the re-arrangement. Based on the suppression duration and time decay model, the rearrangement is subjected to suppression or desuppression operations. After the suppression is lifted, a rate limit determination is made for the total re-arrangement frequency and the single-node re-arrangement frequency. When the speed limit determination conditions are met, the re-verification, re-decision, and rearrangement are performed based on the updated dynamic constraint model.

7. An electronic device, characterized in that, The electronic device includes: One or more processors; and A memory storing computer program instructions, which, when executed, cause the processor to perform the steps of the method as described in any one of claims 1 to 6.

8. A computer-readable medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1 to 6.

9. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1 to 6.

Images