A multi-device running resource isolation scheduling method

Abstract

The present application relates to the technical field of multi-device cooperative operation control and resource isolation scheduling, and particularly relates to a multi-device operation resource isolation scheduling method, which constructs a closed-loop resource group, a closed-loop consistency baseline and an executor fence token in target task operation, identifies resource binding and execution residue according to operation observation and residual observation, calculates closed-loop split degree and execution suspension degree, determines regulation and control level and token state, and executes dynamic isolation scheduling accordingly, wherein the present application uniformly constrains resource binding and execution control through the closed-loop resource group, the closed-loop consistency baseline and the executor fence token, determines regulation and control level and fence state in combination with the closed-loop split degree, the execution suspension degree and the token state, realizes dynamic isolation scheduling, and improves resource consistency isolation and execution safety.

Description

Technical Field

[0001] This invention relates to the field of multi-device collaborative operation control and resource isolation scheduling technology, and more specifically, to a multi-device operation resource isolation scheduling method. Background Technology

[0002] With the development of edge computing, mobile inspection, industrial control, and multi-device collaborative operations, the same target task is no longer completed independently by a single device, but rather by the joint participation of sensing resources, computing resources, communication resources, execution resources, and state resources. In such scenarios, the target task may migrate, be taken over, and be collaboratively executed between different devices or different task instances due to changes in device location, load status, communication quality, task priority, or security policies. For example, in scenarios such as pipe gallery inspection, emergency response of unmanned equipment, and production line linkage control, sensing acquisition devices, edge computing devices, communication relay devices, and execution control devices need to continuously maintain consistent relationships in terms of resource ownership, state version, and control permissions.

[0003] In existing technologies, resource allocation and task scheduling can typically be performed based on device load, network connectivity, task priority, or resource availability. They can also restrict the control scope of different devices over execution resources through permission identifiers, control tokens, or access control policies. This approach can meet general resource scheduling and control isolation requirements when task status is stable, device relationships are clear, and control links are complete.

[0004] However, during the joint operation of a target task by multiple devices, the target task often involves migration and takeover, control switching, state version succession, and delays in execution command feedback. At this time, some resources may still maintain their original binding relationships, while others have switched to new task instances; some execution resources may have received control commands from the old control source, but the feedback confirmation has not yet been closed; some tokens may be in a transferred, frozen, or generational update state. If isolation scheduling is based solely on the state of a single device, a single task, or static permission relationships, it is difficult to accurately identify whether closed-loop resources have split, and it is also difficult to determine whether there are residual execution relationships among the execution resources.

[0005] Based on this, this application proposes a method for resource isolation scheduling of multiple devices. Summary of the Invention

[0006] To address the shortcomings of existing technologies, the present invention aims to provide a method for isolating and scheduling resources for multiple devices.

[0007] To achieve the above objectives, the present invention provides the following technical solution: A method for resource isolation scheduling of multiple devices, comprising: Step 1: During the execution of the target task in a multi-device system, construct a closed-loop resource group and a closed-loop consistency baseline corresponding to the target task, and configure actuator fence tokens for the closed-loop resource group. Step 2: Obtain the closed-loop operation observation set corresponding to the closed-loop resource group and the execution residual observation set corresponding to the executor fence token. Based on the closed-loop operation observation set, the execution residual observation set, and the closed-loop consistency baseline, determine the current resource binding relationship of the closed-loop resource group and the residual execution relationship of the execution resources. The execution residual observation set includes at least the token validity status, token generation version status, and token transfer status. Step 3: Determine the closed-loop split degree corresponding to the target task based on the current resource binding relationship, and determine the execution dangling degree corresponding to the target task based on the residual execution relationship of the execution resources; Step 4: Determine the joint isolation control level and token fence status of the target task based on the closed-loop split degree, execution suspend degree, and the token validity status, token generation version status, and token transfer status in the execution residual observation set. Step 5: Based on the joint isolation control level and token fence status, perform dynamic isolation scheduling on the closed-loop resource group to ensure that resources within the closed-loop resource group maintain consistent isolation.

[0008] In one embodiment, the construction of the closed-loop resource group and the closed-loop consistency baseline includes: grouping the sensing resources involved in the acquisition of target task input, the computing resources for computational processing, the communication resources for data transmission, the execution resources for control output, and the state resources for state maintenance into a closed-loop resource group based on the resource dependencies, control output relationships, and state feedback relationships of the target task. Based on the resource topology, isolation domain, resource role, time base, state spectrum, migration phase, and execution control relationship of the closed-loop resource group, a closed-loop consistency baseline is generated, including resource topology baseline, isolation domain baseline, resource role baseline, time base baseline, state spectrum baseline, migration phase baseline, and execution control baseline.

[0009] In one embodiment, configuring an actuator fence token for a closed-loop resource group includes: configuring a closed-loop resource group identifier, an isolation domain identifier, a closed-loop topology version, and an actuator fence token for the closed-loop resource group; wherein, the actuator fence token includes a token identifier, a token generation version, a token holder, a token validity status, a token transfer status, a control command sequence number level, and an allowed control range, and the token holder is a device or task instance currently allowed to output control commands to the execution resource.

[0010] In one embodiment, the closed-loop operation observation set includes resource status observation, migration takeover observation, time spectrum observation and closed-loop link observation; wherein, resource status observation is used to characterize resource ownership, resource role and resource availability status, and time spectrum observation is used to characterize resource time base status and status resource version status; The execution residual observation set includes command residual observations, execution convergence observations, feedback confirmation observations, token state observations, and control source observations; among them, token state observations include token validity status, token generation version status, and token transfer status.

[0011] In one embodiment, determining the closed-loop split degree corresponding to the target task based on the current resource binding relationship includes: constructing a closed-loop split feature vector based on the current resource binding relationship, wherein the closed-loop split feature vector includes resource state deviation, migration timing deviation, and link closure deviation; and aggregating the closed-loop split feature vector according to a preset closed-loop split weight and closed-loop topology version to obtain the closed-loop split degree corresponding to the target task.

[0012] In one embodiment, the resource status deviation is determined based on the degree of deviation of the resource status observation from the resource topology baseline, the isolation domain baseline, and the resource role baseline; The migration timeline deviation is determined based on the degree of deviation of the migration takeover observations and time spectrum observations from the migration phase baseline, time reference baseline, and state spectrum baseline; The link closure deviation is determined based on the degree of deviation of the closed-loop link observation relative to the resource topology baseline and the execution control baseline.

[0013] In one embodiment, determining the execution suspense degree corresponding to the target task based on the residual execution relationship of the execution resources includes: constructing an execution suspense feature vector based on the residual execution relationship of the execution resources, wherein the execution suspense feature vector includes command execution deviation, feedback closure deviation, and token control deviation; and aggregating the execution suspense feature vector according to the preset execution security weight, control command sequence level, and token generation version to obtain the execution suspense degree corresponding to the target task.

[0014] In one embodiment, the command execution deviation is determined based on command residual observations, execution convergence observations, and control command sequence level. The feedback closure deviation is determined based on feedback confirmation observations; The token control deviation is determined based on token state observation, control source observation, token holder, and token generation version.

[0015] In one embodiment, the joint isolation control level and token fence state of the target task are determined based on the closed-loop split degree, execution dangling degree, and the token validity state, token generation version state, and token transfer state in the execution residual observation set, including: The closed-loop split degree is compared with the first preset closed-loop split threshold and the second preset closed-loop split threshold, and the execution dangling degree is compared with the first preset execution dangling threshold and the second preset execution dangling threshold; Based on the comparison results and the token validity status, token generation version status, and token transfer status in the residual observation set, the joint isolation control level and token fence status of the target task are determined.

[0016] In one embodiment, the joint isolation control level includes a closed-loop maintenance level, a closed-loop rebinding level, an execution convergence level, an overall migration level, and a security degradation level; the token fence state includes a token holding state, a token prohibition transfer state, a token frozen state, a token invalid state, and a token transferable state.

[0017] Compared with the prior art, the present invention has the following beneficial effects: This invention constructs a closed-loop resource group and a closed-loop consistency baseline during the operation of the target task, and configures executor fence tokens for the closed-loop resource group. This enables the resource binding relationship, execution control relationship and token constraint relationship involved in the target task to be uniformly constrained under the same closed-loop framework, which helps to avoid the problem of decreased isolation consistency caused by the dispersion of resource ownership and unclear control boundaries during the collaborative operation of multiple devices. By acquiring the closed-loop operation observation set and the execution residual observation set, and combining the closed-loop consistency baseline to determine the current resource binding relationship and the residual execution relationship of the execution resources, the resource binding offset and the execution command residual can be identified synchronously. Furthermore, based on the closed-loop split degree and the execution dangling metric, the closed-loop deviation state of the target task is quantified, which helps to improve the accuracy of judging complex operation states such as task migration, control takeover, token generation change and execution feedback not closed. Based on the closed-loop split degree, execution suspend degree, token validity status, token generation version status, and token transfer status, the joint isolation control level and token fence status are determined, and dynamic isolation scheduling is performed on the closed-loop resource group accordingly. This allows different operational risk states to be matched with corresponding isolation scheduling strategies, which helps to ensure the consistency isolation and execution security of resources within the closed-loop resource group during the target task operation, switching, and convergence process. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating a multi-device operation resource isolation scheduling method according to the present invention; Figure 2This is a schematic diagram illustrating the construction of the closed-loop resource group and the closed-loop consistency baseline of the present invention; Figure 3 This is a schematic diagram illustrating the configuration of the actuator fence token of the present invention; Figure 4 This is a schematic diagram illustrating the corresponding verification of the closed-loop operation observation set, the execution residual observation set, and the closed-loop consistency baseline of this invention. Figure 5 This is a schematic diagram illustrating the determination of the joint isolation control level, token fence state, and dynamic isolation scheduling in this invention. Detailed Implementation

[0019] Reference Figures 1 to 5 A method for isolating and scheduling resources for multiple devices, comprising: Step 1: During the execution of the target task in a multi-device system, construct a closed-loop resource group and a closed-loop consistency baseline corresponding to the target task, and configure actuator fence tokens for the closed-loop resource group. Organize the operational resources involved in the target task within the multi-device system according to closed-loop relationships to avoid the input, processing, transmission, output, and state maintenance of the target task being scattered across different devices or resource domains, thus avoiding a lack of unified constraints. The closed-loop resource group provides the resource set boundary for the target task, the closed-loop consistency baseline records the resource relationships, state relationships, and control relationships that the closed-loop resource group should satisfy under normal operating conditions, and the actuator fence token limits the control permissions for the execution resources. Through this process, the target task has a clearly defined closed-loop resource scope, consistency judgment criteria, and execution control access criteria during operation.

[0020] Taking the task of handling pipeline leaks jointly completed by multiple inspection drones, edge computing devices, communication gateways, and valve actuators as an example, a closed-loop resource merging relationship is established around the target task. Based on the resource dependency relationship, control output relationship, and state feedback relationship of the target task, gas concentration sensing resources, temperature sensing resources, and image acquisition resources that participate in the input acquisition of the target task are extracted. Computational resources that undertake the computational processing of leak identification, risk judgment, and control strategy generation are extracted. Communication resources that undertake the data transmission of data interaction between inspection drones, edge computing devices, and valve actuators are extracted. Execution resources that undertake the control output of valve closing, fan start-up and shutdown, and warning device triggering are extracted. State resources that store the leak level, valve opening, control command sequence, and state maintenance of the handling stage are also extracted. The above resources are merged into a closed-loop resource group according to the closed relationship between input acquisition, computational processing, data transmission, control output, and state maintenance. When the closed-loop resource group is formed, a closed-loop consistency baseline is generated synchronously based on the resource topology, isolation domain, resource role, time base, state spectrum, migration phase, and execution control relationship of the closed-loop resource group. Among them, the resource topology baseline records the connection order and dependency boundary between various resources, the isolation domain baseline records the isolation range to which the resource occupied by the target task belongs, the resource role baseline records the roles of sensing resources, computing resources, communication resources, execution resources, and state resources in the target task, the time base baseline records the time alignment relationship of control and feedback between various devices, the state spectrum baseline records the inheritance relationship of state resource version changes with the handling stage, the migration phase baseline records the stage position when the target task is taken over from the inspection drone side to the edge computing device side, and the execution control baseline records the source, order, and allowed range of control commands received by the execution resources. In one embodiment, the closed-loop consistency baseline is denoted as . . Includes benchmark resource set Baseline resource topology edge set Baseline attribute set, baseline time alignment relationship Reference state spectrum version Reference migration phase, reference execution control relationship and the benchmark closed-loop topology version Benchmark resource set Including the The first to the second One benchmark resource, and ; It records the dependencies between sensing resources, computing resources, communication resources, execution resources, and state resources; the baseline attribute set records the baseline resource affiliation, baseline isolation domain, baseline resource role, and baseline availability status of each resource. Within any sampling period, This represents the current valid closed-loop consistency baseline; after the baseline is inherited, the new baseline will be registered as the new baseline. The migration phase includes and ,in, Indicates a non-migrated state. Indicates the status of the migration application. This indicates that the resource is frozen. This indicates the token handover status. Indicates the resource verification status. This indicates that the takeover is complete. Each sampling time is recorded as Adjacent sampling times are collected according to a preset sampling period; the time synchronization window is denoted as... The feedback confirmation timeout window is recorded as The convergence timeout window is recorded as The token transfer timeout window is recorded as The closed-loop observation set includes the current set of observation resources. Current topological edge set Current topological edge set Corresponding runtime topology version Resource ownership, isolation domain, resource role, resource availability status, observation timestamp, state hierarchy version, migration phase, and control source. When the observation timestamp is... The deviation of the corresponding time base is greater than At that time, this observation item is recorded as the time deviation item. Resource verification objects include... and current set of observational resources .belong But it did not appear Resources listed in the table are recorded as unavailable resources, and the number of unavailable resources and the corresponding number of missing links are counted. But not belonging to Resources that are not included in the count are recorded as newly added observation resources. If the denominator has execution control edges or state dependency edges with the closed-loop resource group, it is included in the number of abnormally added edges. And based on whether its isolation domain, resource role and control source are compliant Determine whether to write to the execution residual observation set.

[0021] Configuring actuator fence tokens around closed-loop resource groups involves writing closed-loop resource group identifiers, isolation domain identifiers, and closed-loop topology versions to the closed-loop resource groups, and configuring actuator fence tokens for the execution resources related to valve actuators, fan actuators, and warning actuators. Each actuator fence token includes a token identifier, token generation version, token holder, token validity status, token transfer status, control command sequence number level, and allowed control range. The token holder records the device or task instance currently allowed to output control commands to the execution resource; the token generation version records the takeover round to which the current control authority belongs; the control command sequence number level records the highest control command sequence number received by the execution resource; and the allowed control range records the valve opening, fan speed, and warning trigger range that the current token holder can issue. In one embodiment, the closed-loop resource group includes Each execution resource, and , No. Each execution resource is denoted as . No. Each execution resource at the sampling time The corresponding actuator fence token includes a token identifier. Token Generation Version Token holder Token validity status Token transfer status Control command sequence number water level Set of in-transit command serial numbers and allowed control range . Record the sequence number of the highest consecutive command that has received confirmation and whose execution has converged. Record the sequence number of the control command that has passed token access verification but has not yet been archived. This indicates that the token is valid. This indicates that the token is invalid; Indicates that the transfer is stable. Indicating authorization transfer, This indicates a transfer error. After the authorized transfer request passes verification, the token transfer status is updated from 0 to 1; after the target token holder completes token reception, the original holder's token becomes invalid, the residual execution relationship is empty, and the token generation version verification passes, the token transfer status is updated from 1 to 0; if the transfer time exceeds [a certain threshold], the status is updated from 1 to 0. If the target holder is inconsistent, there is a token generation conflict, or the original holder's token has not expired, the token transfer status is updated from 1 to 2. After the abnormal reason is cleared and re-verification is successful, the status is restored to 0 or re-entered into 1 according to the security policy. If multiple execution resources share the same token, the token is registered as a group token, and the set of execution resources covered by the group token is recorded. Execution resources within the scope of the group token share the same token identifier, token generation version, and token holder, and the control command sequence number level, the set of in-transit command sequence numbers, and the allowed control scope are recorded respectively.

[0022] For example, when an inspection drone detects a leak in a pipe gallery and generates an initial handling command, the token holder of the actuator fence token is the task instance corresponding to that inspection drone. If communication link fluctuations cause the edge computing device to take over the handling task, the token holder is updated according to the closed-loop topology version and the token generation version. The old task instance is restricted from continuing to output control commands to the valve execution device through the token validity status, token transfer status, and control command sequence number level, thereby avoiding the same execution resource being affected by control commands from different sources during the takeover period.

[0023] Execution resources Receive control commands Token access verification is performed at any time, and the access identifier is recorded as follows. And determine it according to the following formula: in, This indicates the token identifier carried by the command. This indicates the generational version of the token carried by the command. Indicates the source of command control. Indicates the command sequence number. Indicates control parameters, Indicates the first The allowed sequence number advances the span of each execution resource, and ; This indicates that the value is 1 if the condition within the parentheses is true, and 0 if the condition is false. If Execution resources Upon receiving the control command, Write Not updated immediately When the feedback confirmation flag for the control command is... And the convergence flag is executed. At that time, since Remove; if it exists after removal Starting from the sequence number of commands that continuously complete feedback confirmation and execution convergence, then... Update to the highest command number in this consecutive sequence. If Execution resources The control command is rejected and written to the execution residual observation set. Command number Control commands are recorded as repeated commands or old commands, command sequence number. Newly arrived control commands are recorded as in-transit duplicate commands, command sequence number. The control command is denoted as the abnormal jump command.

[0024] Step 2: Obtain the closed-loop operation observation set corresponding to the closed-loop resource group and the execution residual observation set corresponding to the actuator fence token. Based on the closed-loop operation observation set, the execution residual observation set, and the closed-loop consistency baseline, determine the current resource binding relationship of the closed-loop resource group and the residual execution relationship of the execution resources. The execution residual observation set includes at least the token validity status, token generation version status, and token transfer status. The closed-loop operation observation set reflects the resource ownership, resource connection, time status, and link status of the closed-loop resource group at the current moment; the execution residual observation set reflects the control residuals, execution convergence, feedback confirmation, and token changes related to the actuator fence token. By comparing the above observations with the closed-loop consistency baseline, it is possible to identify whether the binding of closed-loop resource groups in the current operating state deviates from expectations, and also to determine whether there are still residual execution relationships that are not released, not confirmed, or have sources of conflict. The token validity status, token generation version status, and token transfer status are included in the execution residual observation set, which helps to distinguish between normal control continuation, old generation control residuals, and abnormal token transfers.

[0025] A closed-loop operation observation set is collected for the actual state of the closed-loop resource group during the operation of the target task, and an execution residue observation set is collected for the control residue associated with the actuator fence token. The closed-loop operation observation set includes resource status observation, migration takeover observation, time spectrum observation, and closed-loop link observation. Among them, resource status observation records the resource ownership, resource role, and resource availability status of sensing resources, computing resources, communication resources, execution resources, and state resources; migration takeover observation records the takeover initiator, takeover confirmation, and takeover stage position when the target task takes over between different devices or task instances; time spectrum observation records the resource time base status and state resource version status; and closed-loop link observation records the link connectivity between input acquisition, computing processing, data transmission, control output, and state maintenance. The execution residual observation set includes command residual observation, execution convergence observation, feedback confirmation observation, token status observation, and control source observation. Command residual observation records control commands that have been issued but not yet confirmed. Execution convergence observation records the proximity between the action results of the execution resource and the target control range. Feedback confirmation observation records the confirmation information returned by the execution resource. Token status observation includes token validity status, token generation version status, and token transfer status. Control source observation records the device or task instance from which the control command comes. The closed-loop operation observation set and the execution residual observation set are verified against the closed-loop consistency baseline. Based on the resource topology baseline, isolation domain baseline, resource role baseline, time base baseline, state spectrum baseline, migration phase baseline and execution control baseline, the current resource binding relationship of the closed-loop resource group and the residual execution relationship of the execution resource are determined. The current resource binding relationship records the resource ownership, isolation domain, resource role, and availability status of the currently observed and baseline resources. The current resource ownership, isolation domain, resource role, and availability status of a resource are verified; if any of these deviates from the closed-loop consistency baseline, the resource is recorded as a binding deviation resource; if a resource is unavailable, the number of unavailable resources is recorded. For execution resources... control commands The token identifier carried by the command, the command sequence number, the generational version of the token carried by the command, the control source, the control parameters, the feedback confirmation identifier, the execution convergence identifier, the command issuance time, and the access approval identifier are respectively denoted as follows: and ; This indicates that the feedback has been confirmed. This indicates that the feedback has not been confirmed. This indicates that the execution has converged. This indicates that the execution has not converged; This indicates that the control command has passed token access verification upon receipt. This indicates that the control command failed token access verification upon reception. When the feedback status is inconsistent with the control objective, the execution convergence flag of the corresponding control command is recorded as 0. If the command passed token access verification upon reception and... and satisfy or satisfy Control commands are recorded as normal in-transit commands. If a control command fails token access verification upon receipt and exhibits at least one of the following: inconsistent token identifier, inconsistent token generation / version, inconsistent control source, command sequence number lower than or equal to the control command sequence number level, command sequence number belonging to the in-transit command sequence number set, command sequence number exceeding the allowed sequence number advancement span, control parameters exceeding the allowed control range, invalid token, or abnormal token transfer, a residual execution relationship is written. If a control command passes token access verification upon receipt, but the feedback confirmation time exceeds [a certain limit], a residual execution relationship is written. At that time, residual execution relationships are written; the control command has passed token admission verification upon receipt, but the execution non-convergence time exceeds [time limit missing]. When necessary, residual execution relationships are written. A residual execution relationship consists of the aforementioned control command and its token identifier, command sequence number, token generation version, control source, control parameters, feedback confirmation identifier, and execution convergence identifier. Commands in transit are not recorded as residual execution relationships during the feedback confirmation timeout window or execution convergence timeout window.

[0026] For example, in a pipeline leak handling scenario, when an edge computing device takes over a target task initiated by an inspection drone, if the gas concentration sensing resource still belongs to the original inspection drone task instance, while the valve actuator has already received the control command from the edge computing device, resource status observation and migration takeover observation will show that there is an inconsistency in resource ownership within the closed-loop resource group. Combining the resource topology baseline and the isolation domain baseline, the current resource binding relationship can be obtained. If the valve actuator still retains the closing command under the old token generation version, and the feedback confirmation observation has not yet confirmed the completion of the closing command, while the token transfer status shows that control authority is being transferred, then based on command residue observation, execution convergence observation, token status observation, and control source observation, it can be determined that there is a residual execution relationship in the execution resource. This determination result provides clear data basis for the subsequent calculation of closed-loop split degree and execution dangling degree.

[0027] Step 3: Determine the closed-loop split degree corresponding to the target task based on the current resource binding relationship, and determine the execution dangling degree corresponding to the target task based on the residual execution relationship of the executing resources. The current resource binding relationship reflects whether various resources within the closed-loop resource group are still under the same closed-loop constraint as required by the target task. The closed-loop split degree reflects the degree to which resource dispersion, binding offset, or incomplete link has occurred in the closed-loop resource group. The residual execution relationship of the executing resources reflects whether there are still unclosed states between control commands, execution actions, feedback confirmations, and token control. The execution dangling degree reflects the degree to which the executing resources have escaped effective control constraints or have residual control influence. Through the closed-loop split degree and execution dangling degree, the complex multi-device operating status is transformed into two relatively clear scheduling judgment criteria.

[0028] Resource status observations are compared with resource topology baselines, isolation domain baselines, and resource role baselines to obtain resource status deviation. This deviation reflects the degree of offset in ownership, role, and availability of sensing resources, computational resources for computational processing, communication resources for data transmission, execution resources for control output, and state maintenance resources. Migration takeover observations and time spectrum observations are compared with migration phase baselines, time reference baselines, and state spectrum baselines to obtain migration timing deviation. This deviation reflects the degree of offset of the target task in the takeover phase, time alignment relationship, and state resource version inheritance relationship. Closed-loop link observations are compared with resource topology baselines and execution control baselines to obtain link closure deviation. This deviation reflects the degree of closure integrity between input acquisition, computational processing, data transmission, control output, and state maintenance. Resource status deviation, migration timing deviation, and link closure deviation are combined to form a closed-loop splitting feature vector, which is then aggregated according to preset closed-loop splitting weights and closed-loop topology versions to obtain the closed-loop splitting degree. The degree of closed-loop splitting is denoted as Its value ranges from 0 to 1. The closed-loop split degree is determined by the following formula: in, This indicates the deviation of the resource status. Indicates the migration timeline deviation. Indicates the deviation of the link closure; and These represent the weights of resource status deviation, migration timing deviation, and link closure deviation, respectively, with each weight being normalized and non-negative. Determine by the following formula: in, Indicates the first The current topology version participating in the closed-loop split degree calculation for each sampling period; before baseline transfer is completed. Pick After the baseline is established, Take the closed-loop topology version after acceptance; Indicates the baseline closed-loop topology version. This indicates the preset maximum version deviation, and , This represents the topology version deviation coefficient. The resource status deviation is determined by the following formula: in, These represent the number of resource ownership deviations, isolation domain deviations, resource role deviations, and unavailable resources, respectively, with normalized and non-negative weights for each. When multiple deviations exist for the same resource simultaneously, they are counted separately for their respective deviation quantities. The migration time-series deviation is determined by the following formula: in, Indicates the amount of migration phase deviation. Indicates time deviation is greater than The quantity of resources, This indicates the number of forks or lags in the state hierarchy version, with all weights normalized and non-negative. The current resource's state hierarchy version is lower than the baseline state hierarchy version. If there are two or more unmerged state lineage versions, the resource is considered to have a state lineage version lag or fork, and this is recorded. The link closure deviation is determined by the following formula: in, , Represents the current set of topological edges. , This indicates the number of missing edges in the baseline topology. This indicates the number of abnormal edges in the current topology that are newly added relative to the baseline topology and do not conform to the execution control baseline. and Normalized and non-negative. Belongs to But it did not appear Resources included ; connected to and belonging to this resource topological edges included .belong But not belonging to Newly added observation resources are not included If the newly added observation resource forms a topology edge that does not conform to the execution control baseline, then the corresponding topology edge is counted. .

[0029] For example, during the handling of leaks in pipe corridors, if the gas concentration sensing resources remain on the inspection drone side, the computing resources for computation have been transferred to the edge computing device side, and the valve actuator is in another isolated domain, the resource status deviation will increase; if the status resource version is earlier than the current takeover stage, the migration timing deviation will increase accordingly; if the execution control link lacks feedback closure, the link closure deviation will increase accordingly, and after aggregation, a high degree of closed-loop splitting will be formed. Command execution deviation is obtained by processing command residual observations, execution convergence observations, and control command sequence level. This deviation reflects whether the control command is unconfirmed, unconverged, or exceeds the current control command sequence level. Feedback closure deviation is obtained based on feedback confirmation observations, reflecting whether a closed confirmation is formed between the action feedback of the execution resource and the control command. Token control deviation is obtained based on token status observations, control source observations, token holder, and token generation version, reflecting whether there are conflicts between the token validity status, token generation version status, token transfer status, and control source. Command execution deviation, feedback closure deviation, and token control deviation are combined to form an execution suspend feature vector, which is then aggregated according to preset execution safety weights, control command sequence level, and token generation version to obtain the execution suspend degree. The degree of levitation is recorded as Its value ranges from 0 to 1. The degree of levitation is determined by the following formula: in, This indicates the deviation from command execution. This indicates the deviation of the feedback closure. Indicates the deviation of token control; and These represent the weights of command execution deviation, feedback closure deviation, and token control deviation, respectively, with each weight being normalized and non-negative. Determine using the following formula: in, This represents the intergenerational conflict coefficient of the token. This indicates the number of commands whose token generation version is inconsistent with the current token generation version. This represents the number of control commands observed, and When no control command is observed in the current sampling period, This is used only as a normalization denominator and does not indicate the existence of a control command. The command execution deviation is determined by the following formula: in, This indicates the number of unacknowledged commands that have entered into the residual execution relationship. This indicates the number of convergence timeout commands executed. This indicates that the control command received does not meet the requirements. The number of commands, with all weights normalized and non-negative. The feedback closure deviation is determined by the following formula: in, This indicates the number of timeout commands. This indicates the number of missing commands. This represents the number of commands whose feedback state is inconsistent with the control objective. All weights are normalized and non-negative. The token control deviation is determined by the following formula: in, Indicates the percentage of invalid tokens. Indicates the proportion of intergenerational conflict in token distribution. Indicates the percentage of abnormal token transfers. This indicates a discrepancy between the source of control and the token holder. This indicates the proportion by which control parameters exceed the allowed control range; all weights are normalized and non-negative. The number of resources executed when a token is invalid is denoted as... The number of resources required for abnormal token transfer execution is recorded as follows. The number of commands whose source of control is inconsistent with the token holder is recorded as follows: The number of commands that cause control parameters to exceed limits is recorded as follows: ,but If the same control command has multiple instances of being unacknowledged, having a convergence timeout, having an abnormal sequence number, having a token generational conflict, or having an abnormal feedback, each instance will be counted in the corresponding command count.

[0030] For example, the valve actuator has received the closing command under the old token generation version, but the feedback confirmation observation has not yet returned the closing completion information, and the new token holder has been changed to the task instance corresponding to the edge computing device. At this time, the command execution deviation, feedback closure deviation and token control deviation all increase, and after aggregation, a high execution dangling degree is obtained.

[0031] Step 4: Based on the closed-loop split degree, execution dangling degree, and the token validity status, token generation version status, and token transfer status in the execution residual observation set, determine the joint isolation control level and token fence status of the target task. Relying solely on the closed-loop split degree is insufficient to accurately reflect whether execution resources are still affected by old control instructions; relying solely on the execution dangling degree is also insufficient to indicate whether resource binding splits have occurred in the closed-loop resource group. The token validity status, token generation version status, and token transfer status further supplement the validity, generational consistency, and transfer security of execution control permissions. The resulting joint isolation control level reflects the isolation scheduling intensity required for the target task; the token fence status reflects the control status of the actuator fence token, indicating whether it should be maintained, frozen, invalidated, prohibited from transfer, or allowed to transfer.

[0032] A joint judgment process is established based on the closed-loop split degree and execution suspend degree obtained for the target task. The closed-loop split degree is compared with the first preset closed-loop split threshold and the second preset closed-loop split threshold, respectively. The execution suspend degree is also compared with the first preset execution suspend threshold and the second preset execution suspend threshold, respectively. The first preset closed-loop split threshold is lower than the second preset closed-loop split threshold, and the first preset execution suspend threshold is lower than the second preset execution suspend threshold. When the closed-loop split degree does not reach the first preset closed-loop split threshold and the execution suspend degree does not reach the first preset execution suspend threshold, the closed-loop resource group is determined to be in a state of stable resource binding and closed execution control. When the closed-loop split degree reaches the first preset closed-loop split threshold but does not reach the second preset closed-loop split threshold, the target task is determined to have resource binding offset. When the execution suspend degree reaches the first preset execution suspend threshold but does not reach the second preset execution suspend threshold, the execution resource is determined to have control residue or unclosed feedback. When the closed-loop split degree reaches the second preset closed-loop split threshold or the execution suspend degree reaches the second preset execution suspend threshold, the target task is determined to have a high isolation risk. By combining the token validity status, token generation version status, and token transfer status in the execution residual observation set, the joint isolation control level and token fence status are further determined. The authorization transfer list is based on the baseline execution control relationship in the closed-loop consistency baseline. The authorization relationship of task instances and security policies are jointly determined, recording the task instances, control terminals, and execution resources allowed to receive token transfers. An authorized transfer is considered complete when the token transfer request object, the approval object, and the target holder are all in the authorized transfer list; an unauthorized transfer is considered complete when any object is not in the authorized transfer list; and no unauthorized transfer is considered complete when no token transfer request exists. A generational rollback is considered when the token generation version of any execution resource is lower than the token generation version corresponding to the previous valid sampling period. A token generation conflict is considered when the token generation version of any control command is inconsistent with the current token generation version of the corresponding execution resource; no token generation conflict is considered complete when no control command is observed in the current sampling period. "Closed-loop topology version pending update" refers to the closed-loop topology version update status caused by changes in token holders, overall migration requests, overall migration completion, or baseline acceptance completion. Resource rebinding, replacement resource registration, or abnormally added edge isolation registration of a new current topology edge set are also considered. And the corresponding running topology version; if the second preset closed-loop split threshold is not reached and there is no change in the token holder, the overall migration will not be triggered individually. The running topology version represents the current set of topology edges. The corresponding temporary topology version does not replace the baseline closed-loop topology version. Upon completion of baseline transfer, the running topology version that meets the transfer criteria will be registered as the new closed-loop topology version. The running topology version is denoted as... When baseline connection is not completed, the formula for calculating the closed-loop split degree... Pick After the baseline is established, Take the closed-loop topology version after acceptance. A successful overall migration request means that a task instance, control terminal, or security policy generates an overall migration request, and this overall migration request is executed through the baseline execution control relationship. Verification of task instance authorization relationships and security policies. A complete migration is considered triggered when at least one of the following conditions is met: the closed-loop split degree reaches the second preset closed-loop split threshold; the execution dangling degree reaches the second preset execution dangling threshold and there is a token generational conflict; the token holder has changed without completing baseline inheritance; or a complete migration application is established. If none of the above conditions exist, a complete migration is considered not triggered. Token fence states include token holding state, token transfer prohibited state, token frozen state, token invalid state, and token transferable state. When a token is invalid, transferred without authorization, or undergoes generational rollback, it is determined to be in a token invalid state. If the conditions for a token invalid state are not met, but a global migration has been triggered and residual execution relationships or generational conflicts exist, it is determined to be in a token-prohibited-transfer state. If the conditions for both token invalid and token-prohibited-transfer states are not met, but a global migration has been triggered, residual execution relationships are empty, there are no generational conflicts, and the migration target has passed authorization verification, it is determined to be in a token-transferable state. If the conditions for token invalid, token-prohibited-transfer, and token-transferable states are not met, but residual execution relationships exist, it is determined to be in a token-frozen state. All other situations are determined to be in a token-holding state. The joint isolation control levels include closed-loop hold level, closed-loop rebinding level, execution convergence level, global migration level, and security degradation level. When the token is in an invalid state, it is determined to be a security degradation level; when it is not in an invalid state and the overall migration has been triggered, it is determined to be an overall migration level; when the overall migration level has not been reached and the execution dangling degree has reached the first preset execution dangling threshold, it is determined to be an execution convergence level; when the overall migration level and the execution convergence level have not been reached and the closed-loop splitting degree has reached the first preset closed-loop splitting threshold, it is determined to be a closed-loop rebinding level; when the closed-loop splitting degree is lower than the first preset closed-loop splitting threshold, the execution dangling degree is lower than the first preset execution dangling threshold, and the token is in a token holding state, it is determined to be a closed-loop holding level.

[0033] For example, in a pipe gallery leak handling scenario, if both the closed-loop split degree and execution dangling degree are in a low range, the token validity state is valid, the token generation version state is consistent with the current token holder, and the token transfer state is stable, then the joint isolation control level is determined to be the closed-loop maintenance level, and the token fence state is determined to be the token maintenance state; if the closed-loop split degree increases but the execution dangling degree is low, and the token validity state remains valid, then the joint isolation control level is determined to be the closed-loop rebinding level, and the token transferable state or the token prohibition transfer state is determined based on the token transfer state; if the execution dangling degree increases... If the feedback confirmation observation shows that the old control command has not yet been closed, then the joint isolation control level is determined to be the execution convergence level, and the token fence state is determined to be the token frozen state; if the closed-loop split degree and execution dangling degree both reach a high range, and the token generation version state shows an intersection of the old generation and the new generation, then the joint isolation control level is determined to be the overall migration level, and the token fence state is determined to be the token transfer prohibited state; if the token validity state is abnormal or there is an unauthorized change in the token transfer state, then the joint isolation control level is determined to be the security degradation level, and the token fence state is determined to be the token invalid state.

[0034] Step 5: Based on the joint isolation control level and token fence status, perform dynamic isolation scheduling on the closed-loop resource group to ensure consistent isolation of resources within the group. The joint isolation control level determines the closed-loop resource group's current operating state and whether it adopts a closed-loop maintain, closed-loop rebinding, execution convergence, overall migration, or security degradation strategy. The token fence status determines the execution resource's current operating state and whether it adopts a token maintain, token transfer prohibited, token frozen, token invalidated, or token transferable strategy.

[0035] Dynamic isolation scheduling revolves around closed-loop resource groups, taking into account both resource binding relationships and execution control relationships. This avoids situations such as mixed control sources, unresolved residual actions in execution resources, and inconsistencies in closed-loop links during resource migration, task takeover, or device switching. After this processing, resources within the closed-loop resource group maintain consistent isolation in multi-device collaborative operation scenarios, and the operational boundaries and execution control boundaries of the target task remain matched.

[0036] Based on the joint isolation control level and token fence status of the target task, dynamic isolation scheduling is performed on the sensing resources, computing resources for computing processing, communication resources for data transmission, execution resources for control output, and state resources for state maintenance within the closed-loop resource group. Dynamic isolation scheduling includes command rejection, command convergence waiting, resource rebinding, overall migration, and security location constraints. Control commands with inconsistent token identifiers, inconsistent token versions, inconsistent control sources, command sequence numbers lower than or equal to the control command sequence number threshold, command sequence numbers belonging to the in-transit command sequence number set, command sequence numbers exceeding the allowed sequence number advancement span, control parameters exceeding the allowed control range, invalid tokens, or abnormal token transfers are recorded as old commands or abnormal commands and rejected by the execution resource. Commands that have passed token access verification upon receipt and whose feedback non-acknowledgment time has not exceeded [a certain period] are also rejected. The control command is denoted as a waiting-for-feedback command; upon receipt, it has passed token access verification, the feedback has been confirmed, the execution has not converged, and the non-convergence time has not exceeded [a certain threshold]. The control command is recorded as a waiting-for-convergence command. The unacknowledged feedback time exceeds [a certain period]. The control command, or feedback that has been confirmed, or the execution non-convergence time exceeds [time limit]. The control command, denoted as the timeout convergence command, triggers the safe convergence command. The safe convergence command carries the currently valid token identifier. Current token generation version Current token holder and adopt a value greater than No more than And does not belong to The smallest unused command number; if no command number meets the condition, the token is frozen and the security degradation level is entered. The control parameters of the security convergence command are taken at a safe position. or towards The limit change value. If the current execution state is below the safe position, it increases towards the safe position by a single-cycle safe step size; if the current execution state is above the safe position, it decreases towards the safe position by a single-cycle safe step size; after reaching the safe position, it remains at the safe position. The single-cycle safe step size is registered by the execution resource safety policy and matched with the maximum allowable rate of change, safe response time, and control parameter type of the corresponding execution resource. Discrete control quantities generate safe convergence commands according to the safe levels registered in the safety policy; When the joint isolation control level is the closed-loop maintenance level and the token fence state is the token maintenance state, the existing resource binding relationship of the closed-loop resource group is maintained, and the resource topology, isolation domain, resource role, time base, state spectrum, migration phase and execution control relationship are verified according to the closed-loop consistency baseline; when the joint isolation control level is the closed-loop rebinding level, resources that deviate from the isolation domain or resource role are re-merged according to the closed-loop topology version, and the input acquisition, calculation processing, data transmission, control output and state maintenance relationship that are disconnected in the closed-loop link observation are closed-loop correction. Under the closed-loop rebinding level, for resources with binding deviations, the corresponding isolation domain, resource role, and topology edge are restored according to the baseline isolation domain, baseline resource role, and baseline topology edge in the closed-loop consistency baseline. If the current availability state of the resource is unavailable, a replacement resource with the same resource role and available status is selected within the same isolation domain, and the replacement resource is registered to the current resource binding relationship. When multiple candidate replacement resources exist, priority is given to the resource with the smallest topology distance from the original resource, the smallest time synchronization deviation, or the highest historical availability; if all of the above conditions are met, the priority is determined according to the security policy registration. After the replacement resource is registered, the current topology edge set is updated according to the connection relationship between the replacement resource and adjacent resources. The corresponding running topology version is registered. If there is no alternative resource that meets the conditions within the same isolation domain, the isolation status of the topology edge corresponding to the resource is maintained, and the resource is written into the number of unavailable resources and the number of missing links in the closed-loop split degree.

[0037] When the joint isolation control level is the execution convergence level and the token fence status is the token frozen status, the control sources other than the token holder are suspended from issuing control commands to the execution resources. The old command residues are cleaned up according to the control command sequence level, and feedback is waited to confirm that the observation and execution convergence observation have reached closure. When the joint isolation control level is the overall migration level, the overall migration process is initiated according to the migration phase baseline, and the closed-loop resource group identifier, isolation domain identifier, and running topology version to be effective are registered. The target token holder and the next token generation version; the baseline closed-loop topology version is not updated at the start of the migration phase. Do not update the current valid token generation version. After the overall migration is complete, a closed-loop consistency baseline is established. Baseline establishment conditions include: residual execution relationships are empty, tokens are not in an expired state, and the migration phase is [missing information]. The following conditions must be met: 1. The set of in-transit command sequence numbers for each execution resource is empty; 2. The feedback confirmation flags for control commands received but not yet archived within the current migration window are all 1; 3. The execution convergence flags are all 1. When the above conditions are met, the current resource topology, isolation domain, resource role, time base, state hierarchy, migration phase, and execution control relationship are registered as a new closed-loop consistency baseline. The closed-loop resource group identifier, isolation domain identifier, target token holder, and next token generation version are then made effective. If sequential version numbers are used, the new closed-loop topology version is one version incremented from the previous baseline closed-loop topology version, and the running topology version... This serves as the identifier for the version to be implemented in the new version. Upon completion of baseline implementation, the token generation version for the corresponding execution resource is incremented by one version. The token holder is updated to the migrated task instance, and the control command sequence number is updated to the highest consecutive command sequence number that has been confirmed and converged upon migration completion. If no new command has been confirmed and converged upon migration completion, the control command sequence number remains at the confirmed level before migration. Before baseline implementation, the original closed-loop consistency baseline remains as the verification benchmark; after baseline implementation, the new closed-loop consistency baseline is registered as the new... This will serve as the verification benchmark for the next sampling period.

[0038] When the joint isolation control level is a security downgrade level or the token barrier status is a token invalidation status, the execution resources will be restricted to a safe location within the allowed control range, and unconfirmed control sources will be isolated; No. Allowable control scope of each execution resource Determined by the lower and upper limits of permissible controls. The security policy registers the security baseline value for the corresponding execution resource, and the security location is denoted as... When the safety benchmark value is lower than the allowable lower control limit, the safety position is taken as the allowable lower control limit; when the safety benchmark value is within the allowable control range, the safety position is taken as the safety benchmark value; when the safety benchmark value is higher than the allowable upper control limit, the safety position is taken as the allowable upper control limit. When the control parameter is a multi-dimensional vector, the corresponding safety position is determined for each dimension of the control parameter according to the allowable lower control limit, allowable upper control limit, and safety benchmark value. For discrete control variables, the safety position is the safety level registered by the safety strategy and within the allowable control range; if the safety strategy registration level is not within the allowable control range, the level with the lowest risk level within the allowable control range is selected as the safety position. In the scenario of handling pipe gallery leaks, the safety benchmark value for valve execution resources is the closed position or the preset small opening position, the safety benchmark value for fan execution resources is the safe ventilation level, and the safety benchmark value for alarm execution resources is the alarm trigger state.

[0039] Taking the handling of pipe gallery leaks as an example, if the valve actuator is still receiving the closing command from the old task instance, while the edge computing device has become the new token holder, the old task instance is blocked from continuing to control the valve actuator by freezing the token. The old command is confirmed to have completed convergence based on the control command sequence number level. After the gas concentration sensing resources, communication resources, status resources and execution resources meet the closed-loop consistency baseline again, the resources in the closed-loop resource group maintain consistency isolation.

[0040] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for resource isolation and scheduling of multiple devices, characterized in that, include: Step 1: During the execution of the target task in a multi-device system, construct a closed-loop resource group and a closed-loop consistency baseline corresponding to the target task, and configure actuator fence tokens for the closed-loop resource group; Step 2: Obtain the closed-loop operation observation set corresponding to the closed-loop resource group and the execution residual observation set corresponding to the executor fence token. Based on the closed-loop operation observation set, the execution residual observation set, and the closed-loop consistency baseline, determine the current resource binding relationship of the closed-loop resource group and the residual execution relationship of the execution resources. The execution residual observation set includes at least the token validity status, token generation version status, and token transfer status. Step 3: Determine the closed-loop split degree corresponding to the target task based on the current resource binding relationship, and determine the execution dangling degree corresponding to the target task based on the residual execution relationship of the execution resources; Step 4: Determine the joint isolation control level and token fence status of the target task based on the closed-loop split degree, execution suspend degree, and the token validity status, token generation version status, and token transfer status in the execution residual observation set. Step 5: Based on the joint isolation control level and token fence status, perform dynamic isolation scheduling on the closed-loop resource group to ensure that resources within the closed-loop resource group maintain consistent isolation.

2. The multi-device operation resource isolation scheduling method according to claim 1, characterized in that, The construction of closed-loop resource groups and closed-loop consistency baselines includes: based on the resource dependencies, control output relationships, and state feedback relationships of the target task, grouping the sensing resources involved in the acquisition of target task inputs, the computing resources for computational processing, the communication resources for data transmission, the execution resources for control output, and the state resources for state maintenance into closed-loop resource groups; Based on the resource topology, isolation domain, resource role, time base, state spectrum, migration phase, and execution control relationship of the closed-loop resource group, a closed-loop consistency baseline is generated, including resource topology baseline, isolation domain baseline, resource role baseline, time base baseline, state spectrum baseline, migration phase baseline, and execution control baseline.

3. The multi-device operation resource isolation scheduling method according to claim 2, characterized in that, Configure actuator fence tokens for closed-loop resource groups, including: configuring closed-loop resource group identifier, isolation domain identifier, closed-loop topology version, and actuator fence tokens for the closed-loop resource group; wherein, the actuator fence token includes token identifier, token generation version, token holder, token validity status, token transfer status, control command sequence number level, and allowed control range, and the token holder is the device or task instance currently allowed to output control commands to the execution resource.

4. The multi-device operation resource isolation scheduling method according to claim 3, characterized in that, The closed-loop operation observation set includes resource status observation, migration takeover observation, time spectrum observation, and closed-loop link observation; among them, resource status observation is used to characterize resource ownership, resource role, and resource availability status, while time spectrum observation is used to characterize resource time base status and status resource version status. The execution residual observation set includes command residual observations, execution convergence observations, feedback confirmation observations, token state observations, and control source observations; among them, token state observations include token validity status, token generation version status, and token transfer status.

5. The multi-device operation resource isolation scheduling method according to claim 1, characterized in that, Determining the closed-loop split degree corresponding to the target task based on the current resource binding relationship includes: constructing a closed-loop split feature vector based on the current resource binding relationship, which includes resource state deviation, migration timing deviation, and link closure deviation; and aggregating the closed-loop split feature vector according to the preset closed-loop split weight and closed-loop topology version to obtain the closed-loop split degree corresponding to the target task.

6. The multi-device operation resource isolation scheduling method according to claim 5, characterized in that, The resource status deviation is determined based on the degree of deviation of the resource status observation from the resource topology baseline, isolation domain baseline, and resource role baseline; The migration timeline deviation is determined based on the degree of deviation of the migration takeover observations and time spectrum observations from the migration phase baseline, time reference baseline, and state spectrum baseline; The link closure deviation is determined based on the degree of deviation of the closed-loop link observation relative to the resource topology baseline and the execution control baseline.

7. A method for resource isolation and scheduling of multiple devices according to claim 6, characterized in that, The execution suspense degree of the target task is determined based on the residual execution relationship of the execution resources, including: constructing an execution suspense feature vector based on the residual execution relationship of the execution resources, the execution suspense feature vector including command execution deviation, feedback closure deviation and token control deviation; and aggregating the execution suspense feature vector according to the preset execution security weight, control command sequence level and token generation version to obtain the execution suspense degree of the target task.

8. A multi-device operation resource isolation scheduling method according to claim 7, characterized in that, The command execution deviation is determined based on command residual observations, execution convergence observations, and the water level of the control command sequence number. The feedback closure deviation is determined based on feedback confirmation observations; The token control deviation is determined based on token state observation, control source observation, token holder, and token generation version.

9. A multi-device operation resource isolation scheduling method according to any one of claims 1-8, characterized in that, Based on the closed-loop split degree, execution suspend degree, and the token validity state, token generation version state, and token transfer state in the execution residual observation set, the joint isolation control level and token fence state of the target task are determined, including: The closed-loop split degree is compared with the first preset closed-loop split threshold and the second preset closed-loop split threshold, and the execution dangling degree is compared with the first preset execution dangling threshold and the second preset execution dangling threshold; Based on the comparison results and the token validity status, token generation version status, and token transfer status in the residual observation set, the joint isolation control level and token fence status of the target task are determined.

10. A multi-device operation resource isolation scheduling method according to claim 9, characterized in that, The joint isolation control levels include closed-loop maintenance level, closed-loop rebinding level, execution convergence level, overall migration level, and security degradation level; the token fence status includes token holding status, token transfer prohibited status, token frozen status, token invalid status, and token transferable status.

Images