Multi-tenant isolated computing resource scheduling method and device, electronic equipment and medium

Abstract

The present application relates to the technical field of information security, and particularly relates to a kind of computing power resource scheduling method and device of multi-tenant isolation, electronic equipment and medium, method includes: in response to receiving the task running request of user, determine the initial trust score of current task;Based on initial trust score, determine the security isolation level of current task;According to the isolation layer of security isolation level determination current task, and the heterogeneous computing resource corresponding to isolation layer is used to process current task, whereby, solve the related art in vehicle heterogeneous computing power multi-tenant isolation level solidification, GPU and NPU heterogeneous unit lack matching data zeroing mechanism, isolation scheduling cannot satisfy the vehicle hard real-time constraint, tenant risk and protection intensity mismatching Problem, improve the dynamic adaptation capability of vehicle multi-tenant computing power scheduling, data residual protection level and vehicle business real-time operation stability.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a method, apparatus, electronic device and medium for scheduling computing resources with multi-tenant isolation. Background Technology

[0002] With the rapid development of intelligent connected vehicle technology, the computing power of in-vehicle heterogeneous computing platforms continues to increase. Automakers are gradually opening up in-vehicle computing resources to support third-party application services, and the application scenarios of multi-tenant sharing of in-vehicle computing power are constantly expanding. In this scenario, computing power security isolation technology is the core foundation for ensuring tenant data security and avoiding mutual interference between business processes.

[0003] Among related technologies, computing power isolation solutions mainly include three categories: (i) data center-level heavy virtualization solutions, which allocate independent virtual machines to each tenant through virtual machine monitors and achieve strong isolation based on hardware-assisted virtualization technology; (ii) container-level isolation solutions, which achieve process-level isolation through namespaces and resource control groups and have lightweight characteristics; (iii) vehicle-mounted fixed partitioning solutions, which divide the chip into a fixed number of secure domains and non-secure domains through vehicle-mounted virtualization management programs to meet automotive-grade functional safety requirements.

[0004] However, Solution (1) has high resource consumption and memory usage, making it difficult to adapt to the hardware conditions of vehicle chips with limited memory and power consumption, and cannot be directly deployed in the vehicle edge computing environment. Solution (2) lacks a unified isolation mechanism for vehicle heterogeneous computing units such as GPU, NPU, and DSP, which can easily lead to security risks such as cross-tenant side-channel attacks, data residue and task interference. Solution (3) cannot adjust the number of partitions and isolation strength after system startup, making it difficult to adapt to the differentiated security requirements in multi-tenant scenarios, and unable to dynamically balance the security protection strength and computing power operation efficiency according to the tenant risk level. These issues urgently need to be addressed. Summary of the Invention

[0005] This invention provides a multi-tenant isolated computing resource scheduling method, device, electronic device, and medium to solve the problems in related technologies, such as the fixed isolation level of multi-tenant computing power in vehicles, the lack of a matching data clearing mechanism for heterogeneous GPU and NPU units, the inability of isolation scheduling to meet the hard real-time constraints of vehicles, and the mismatch between tenant risk and protection strength. It improves the dynamic adaptability of multi-tenant computing power scheduling in vehicles, the level of data residue protection, and the real-time operational stability of vehicle services.

[0006] To achieve the above objectives, a first aspect of the present invention provides a method for scheduling computing resources with multi-tenant isolation, comprising the following steps: in response to receiving a user's task execution request, determining an initial trust score for the current task; determining a security isolation level for the current task based on the initial trust score; determining an isolation layer for the current task according to the security isolation level, and processing the current task using heterogeneous computing resources corresponding to the isolation layer.

[0007] Furthermore, in some embodiments, after processing the current task using the heterogeneous computing resources corresponding to the isolation layer, the method further includes: in response to the completion of the current task execution, determining the security isolation level corresponding to the isolation layer; determining the target zeroing strategy of the isolation layer according to the security isolation level corresponding to the isolation layer; and performing zeroing processing on the isolation layer according to the target zeroing strategy.

[0008] Furthermore, in some embodiments, the security isolation level corresponding to the isolation layer is the first level. The step of determining the target zeroing strategy of the isolation layer according to the security isolation level of the isolation layer, and performing zeroing processing on the isolation layer according to the target zeroing strategy, includes: allocating a preset independent hardware security domain, an encrypted memory partition, a GPU independent video memory address mapping space, an independent interrupt routing channel, and a fixed CPU time slice budget to the isolation layer; performing three overwrite operations of all 0s, all 1s, and random values ​​on the encrypted memory partition in the isolation layer, and performing filling and zeroing processing on the GPU independent video memory address mapping space and the NPU independent cache partition.

[0009] Furthermore, in some embodiments, the security isolation level corresponding to the isolation layer is the second level. The step of determining the target zeroing strategy for the isolation layer according to the security isolation level and performing zeroing processing on the isolation layer according to the target zeroing strategy includes: allocating a preset independent process namespace, computing resource quota, system call whitelist permission, independent GPU computing instance, and independent NPU computing context to the isolation layer; performing a single all-zero write operation on the memory in the independent process namespace in the isolation layer, cleaning up the independent process namespace, and performing filling zeroing processing on the independent GPU computing instance and the independent NPU computing context.

[0010] Furthermore, in some embodiments, the security isolation level corresponding to the isolation layer is the third level. The step of determining the target zeroing strategy of the isolation layer according to the security isolation level corresponding to the isolation layer, and performing zeroing processing on the isolation layer according to the target zeroing strategy, includes: allocating preset CPU time slice scheduling permissions and shared memory pool access permissions to the isolation layer; and releasing the memory pointer corresponding to the shared memory pool in the isolation layer.

[0011] Furthermore, in some embodiments, determining the initial trust score for the current task includes: determining the identity information of the currently running task and the user based on the task execution request; calculating an identity trust score, a behavior compliance score, a data security score, and an environment trust score based on the currently running task and the identity information; and obtaining the initial trust score based on the identity trust score, the behavior compliance score, the data security score, and the environment trust score.

[0012] The multi-tenant isolated computing resource scheduling method provided by the present invention, after receiving a task execution request issued by a user, first calculates the initial trust score corresponding to the current task, determines the security isolation level matched by the task based on the score, then allocates heterogeneous computing resources corresponding to the isolation layer according to the security isolation level, and calls the allocated heterogeneous computing resources to complete the execution of the current task. This solves the problems in related technologies such as the fixed isolation level of multi-tenant heterogeneous computing power in vehicles, the lack of a supporting data clearing mechanism for GPU and NPU heterogeneous units, the inability of isolation scheduling to meet the hard real-time constraints of vehicles, and the mismatch between tenant risk and protection strength. It improves the dynamic adaptation capability of multi-tenant computing power scheduling in vehicles, the level of data residue protection, and the real-time operation stability of vehicle services.

[0013] To achieve the above objectives, a second aspect of the present invention provides a multi-tenant isolated computing resource scheduling device, comprising: a determining module, configured to determine an initial trust score of a current task in response to receiving a user's task execution request; a discriminating module, configured to determine a security isolation level of the current task based on the initial trust score; and an execution module, configured to determine an isolation layer of the current task according to the security isolation level, and process the current task using heterogeneous computing resources corresponding to the isolation layer.

[0014] Furthermore, in some embodiments, after processing the current task using the heterogeneous computing resources corresponding to the isolation layer, the execution module is specifically configured to: determine the security isolation level corresponding to the isolation layer in response to the end of the current task execution; determine the target zeroing strategy of the isolation layer according to the security isolation level corresponding to the isolation layer; and perform zeroing processing on the isolation layer according to the target zeroing strategy.

[0015] Furthermore, in some embodiments, the execution module is also used to: allocate a preset independent hardware security domain, an encrypted memory partition, a GPU independent video memory address mapping space, an independent interrupt routing channel, and a fixed CPU time slice budget to the isolation layer; perform three overwrite operations on the encrypted memory partition in the isolation layer: all 0s, all 1s, and random values; and perform fill and zeroing processing on the GPU independent video memory address mapping space and the NPU independent cache partition.

[0016] Furthermore, in some embodiments, the execution module is also configured to: allocate a preset independent process namespace, computing resource quota, system call whitelist permission, independent GPU computing instance and independent NPU computing context to the isolation layer; perform a single all-zero write operation on the memory in the independent process namespace in the isolation layer, and clean up the independent process namespace, and perform fill and zeroing processing on the independent GPU computing instance and the independent NPU computing context.

[0017] Furthermore, in some embodiments, the execution module is also configured to: allocate preset CPU time slice scheduling permissions and shared memory pool access permissions to the isolation layer; and release the memory pointer corresponding to the shared memory pool in the isolation layer.

[0018] Furthermore, in some embodiments, the determining module is specifically used to: determine the identity information of the currently running task and the user based on the task running request; calculate the identity credibility score, behavior compliance score, data security score, and environment credibility score based on the currently running task and the identity information; and obtain the initial trust score based on the identity credibility score, the behavior compliance score, the data security score, and the environment credibility score.

[0019] The multi-tenant isolated computing resource scheduling device provided in this embodiment of the invention, after receiving a task execution request issued by a user, first calculates the initial trust score corresponding to the current task, determines the security isolation level matched by the task based on the score, then allocates heterogeneous computing resources corresponding to the isolation layer according to the security isolation level, and calls the allocated heterogeneous computing resources to complete the execution of the current task. This solves the problems in related technologies such as the fixed isolation level of multi-tenant isolation of vehicle heterogeneous computing power, the lack of a supporting data clearing mechanism for GPU and NPU heterogeneous units, the inability of isolation scheduling to meet the hard real-time constraints of vehicles, and the mismatch between tenant risk and protection strength. It improves the dynamic adaptation capability of vehicle multi-tenant computing power scheduling, the level of data residue protection, and the real-time operation stability of vehicle services.

[0020] To achieve the above objectives, a third aspect of the present invention provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the multi-tenant isolated computing resource scheduling method as described in the above embodiments.

[0021] To achieve the above objectives, a fourth aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which is executed by a processor to implement the multi-tenant isolated computing resource scheduling method as described in the above embodiments.

[0022] A fifth aspect of the present invention provides a computer program product, including a computer program that is executed to implement the multi-tenant isolated computing resource scheduling method as described in the above embodiments.

[0023] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0024] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 A flowchart of a multi-tenant isolated computing resource scheduling method provided in an embodiment of the present invention; Figure 2 This is a flowchart illustrating a multi-tenant isolated computing resource scheduling method according to a specific embodiment of the present invention. Figure 3 This is a block diagram of a multi-tenant isolated computing resource scheduling device according to an embodiment of the present invention; Figure 4 This is a schematic diagram of the structure of an electronic device provided according to an embodiment of the present invention. Detailed Implementation

[0025] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0026] The following describes a multi-tenant isolated computing resource scheduling method, apparatus, electronic device, and medium according to embodiments of the present invention with reference to the accompanying drawings. First, the multi-tenant isolated computing resource scheduling method according to embodiments of the present invention will be described with reference to the accompanying drawings.

[0027] Figure 1 This is a flowchart of a multi-tenant isolated computing resource scheduling method provided according to an embodiment of the present invention.

[0028] like Figure 1 As shown, the multi-tenant isolated computing resource scheduling method includes the following steps: In step S101, in response to receiving a user's task execution request, the initial trust score for the current task is determined.

[0029] Furthermore, in some embodiments, determining the initial trust score for the current task includes: determining the identity information of the currently running task and the user based on the task execution request; calculating the identity trust score, behavior compliance score, data security score, and environment trust score based on the currently running task and the identity information; and obtaining the initial trust score based on the identity trust score, behavior compliance score, data security score, and environment trust score.

[0030] Specifically, in this embodiment of the invention, the Seccomp interceptor and EventDigest module of the Unified Isolation Control Platform (UICP) complete real-time data collection, generating only encrypted behavior digests (single event ≤ 1KB), which are cached in the TEE secure ring buffer. The edge-side CPU overhead is <0.3%, and complex model inference and scoring calculations are not performed. Upon receiving a user's task execution request, the request message is parsed, and the tenant identity certificate and task attribute information are extracted. Simultaneously, the vehicle-side system module is linked to collect basic status data of the current vehicle operating environment. Then, the tenant trust level is quantified from four dimensions: identity, behavior, data, and environment. Table 1 is a schematic table of a multi-dimensional trust scoring index system provided according to a specific embodiment of the invention. Table 1

[0031] After the cloud-based trust verification engine retrieves the encrypted digest uploaded by the vehicle, it completes PKI certificate verification, rule matching, and anomaly verification. According to preset quantitative rules, it maps the raw data for each dimension to standardized sub-scores within the [0,1] range. For the identity trust dimension, valid certificates, complete signatures, and officially registered tenants receive high scores, while expired certificates and lack of valid signatures receive low scores. For the behavior compliance dimension, no historical violations receive high scores, while unauthorized or excessive behavior results in point deductions based on the number of instances. For the data security dimension, data access scope consistent with authorization and no abnormal data transmission history receive high scores, while unauthorized access to sensitive data records results in point deductions. For the environment trust dimension, the vehicle's intranet environment, no... Abnormal external devices receive high scores, while public network exposure and unknown external devices result in point deductions. Finally, the scores for each of the four dimensions are weighted and summed according to the following weights: identity credibility (25%), behavior compliance (35%), data security (25%), and environment credibility (15%), resulting in an initial trust score T_score in the range [0, 1]. When unauthorized access or abnormal access is detected for the first time, only the event is recorded, a trust score of 0.1 is deducted, and a cloud alert is issued. If there are 3 or more violations, the tenant's trust score will be forcibly reduced to below 0.3, the L1 strong isolation layer will be locked, and an administrator alert will be pushed. After the tenant completes the security audit and rectification, the trust score and corresponding isolation permissions can be restored.

[0032] In step S102, the security isolation level of the current task is determined based on the initial trust score.

[0033] If the initial trust score T_score of the current task is less than 0.6, the security isolation level of the current task is determined to be high. If the initial trust score T_score of the current task is greater than or equal to 0.6 and less than 0.85, the security isolation level of the current task is determined to be medium. If the initial trust score T_score of the current task is greater than or equal to 0.85, the security isolation level of the current task is determined to be low.

[0034] In step S103, the isolation layer of the current task is determined according to the security isolation level, and the heterogeneous computing resources corresponding to the isolation layer are used to process the current task.

[0035] Furthermore, in some embodiments, after processing the current task using the heterogeneous computing resources corresponding to the isolation layer, the method further includes: in response to the end of the current task execution, determining the security isolation level corresponding to the isolation layer; determining the target zeroing strategy of the isolation layer according to the security isolation level corresponding to the isolation layer; and zeroing the isolation layer according to the target zeroing strategy.

[0036] In some embodiments, the security isolation level corresponding to the isolation layer is the first level. The target zeroing strategy of the isolation layer is determined according to the security isolation level of the isolation layer, and the isolation layer is zeroed according to the target zeroing strategy. This includes: allocating a preset independent hardware security domain, an encrypted memory partition, a GPU independent video memory address mapping space, an independent interrupt routing channel, and a fixed CPU time slice budget to the isolation layer; performing three overwrite operations of all 0s, all 1s, and random values ​​on the encrypted memory partition in the isolation layer; and performing filling and zeroing processing on the GPU independent video memory address mapping space and the NPU independent cache partition.

[0037] Specifically, the embodiments of the present invention represent the first level, namely, a high-level allocation of a strong isolation layer (i.e., a dedicated layer for high-risk unverified tenants). First, based on ARMv8-A / v9-A TrustZone technology, the Secure World and Normal World domains are divided, or through RISC-V... The PMP physical memory protection mechanism allocates independent and dedicated security domains to high-risk tenants, physically isolating them from the system's core business and other tenant businesses. Secondly, it configures physical memory protection rules through the MMU / MPU to prohibit tenants from accessing the memory address space across partitions. It relies on the IOMMU / SMMU to achieve independent address mapping isolation of GPU memory, preventing data sharing and leakage. Through the vehicle-side HSM hardware security module's AES-256 encryption engine, it performs in-situ hardware encryption storage of tenant core data. Finally, it configures independent interrupt vectors and routing rules through the GIC general interrupt controller to block cross-tenant interrupt preemption and DoS attacks. It also configures fixed CPU time slice budgets for tenants to prevent malicious preemption of computing resources. Thus, it can employ hardware-level full-domain isolation for high-risk tenants such as unverified third-party applications and unauthorized computing power borrowing, completely preventing unauthorized access and side-channel attacks. This achieves secure isolation in high-risk scenarios such as third-party AI inference SaaS computing power calls, smart city roadside collaborative computing power borrowing, and uncertified developer application operation.

[0038] Furthermore, in some embodiments, the security isolation level corresponding to the isolation layer is the second level. The target zeroing strategy of the isolation layer is determined according to the security isolation level of the isolation layer, and the isolation layer is zeroed according to the target zeroing strategy, including: allocating a preset independent process namespace, computing resource quota, system call whitelist permission, independent GPU computing instance and independent NPU computing context to the isolation layer; performing a single all-zero write operation on the memory in the independent process namespace in the isolation layer, cleaning up the independent process namespace, and performing filling zeroing processing on the independent GPU computing instance and independent NPU computing context.

[0039] Specifically, this embodiment of the invention is the second level, namely the medium-level allocation of the medium isolation layer (i.e., the exclusive isolation layer for authorized compliant tenants). First, it achieves complete isolation of PID, file system, network, and user namespace based on Linux Namespace. It relies on Cgroups v2 to implement dual hardware and software quota limits for CPU, memory, and IO resources to prevent excessive resource consumption. Second, it builds a system call whitelist based on the Seccomp-BPF mechanism to completely block high-risk system calls such as ptrace and process_vm_readv that steal process data, and eliminates illegal data reading between processes. It utilizes GPU MIG multi-instance technology to allocate independent GPU computing queues, memory shares, and inference contexts for tenants. The GPU task contexts of different tenants are completely isolated and cannot be accessed by each other. Thus, it can adopt a medium-level isolation mode combining software and hardware for officially authorized ecosystem partner tenants of car manufacturers, balancing security protection and operational efficiency, and achieving secure isolation in authorized compliant businesses such as map service provider data preprocessing, AI service provider automatic labeling, and insurance UBI driving behavior analysis.

[0040] Furthermore, in some embodiments, the security isolation level corresponding to the isolation layer is the third level. The target zeroing strategy of the isolation layer is determined according to the security isolation level of the isolation layer, and the isolation layer is zeroed according to the target zeroing strategy, including: allocating preset CPU time slice scheduling permissions and shared memory pool access permissions to the isolation layer; and releasing the memory pointer corresponding to the shared memory pool in the isolation layer.

[0041] Specifically, the embodiment of this invention is the second level, namely the low-level allocation shared lightweight isolation layer (i.e., the exclusive layer for OEM's own trusted tenants). First, CPU time slice isolation is achieved through the CFS Fully Fair Scheduler, and trusted tasks at the same level share a memory pool. Data access control is achieved only through upper-layer application identity authentication and permission verification. Thus, for trusted core applications pre-installed by car manufacturers and officially developed by them, it can achieve the effect of no additional sandbox and virtualization overhead, reduce computing power consumption, and adapt to high-frequency real-time interaction scenarios in vehicles, such as in-vehicle voice assistants, cockpit emotion recognition, dashcam AI scene analysis, autonomous driving perception and reasoning, and other OEM core businesses.

[0042] To enable those skilled in the art to better understand the multi-tenant isolated computing resource scheduling method of the present invention, the following explanation and specific embodiments are provided.

[0043] Figure 2 This is a flowchart illustrating a multi-tenant isolated computing resource scheduling method according to a specific embodiment of the present invention, as shown below. Figure 2As shown, after a tenant task finishes execution, the system first checks and determines the isolation level corresponding to the task. If the task belongs to the L1 strong isolation level, a G1 deep zeroing is performed, which follows the DoD5220.22-M standard to complete three memory overwrites: all 0s, all 1s, and random values. At the same time, the GPU memory is cleared using cudaMemset, and the NPU cache is cleared using clEnqueueFillBuffer. The overall execution latency does not exceed 500ms. If the task belongs to the L2 medium isolation level, a G2 medium zeroing is performed, which completes a single all-zero memory write using memset, and simultaneously clears the GPU memory and the tenant namespace. The execution latency does not exceed 50ms. If the task belongs to the L3 shared level, a G3 shallow zeroing is performed, which only releases the memory pointer and relies on the operating system to complete the clearing through subsequent memory overwriting. The execution latency does not exceed 1ms. After all three types of zeroing operations are completed, a zeroing integrity verification is performed. The corresponding memory areas are randomly checked to confirm the zeroing effect. After the verification is passed, the computing resources are released and the tenant container is destroyed, forming a complete data security closed loop in the task end-of-life stage.

[0044] To verify the effectiveness of the multi-tenant isolation computing resource scheduling method of the present invention, the following comparative description is provided in conjunction with specific embodiments.

[0045] Table 2 is a detailed comparison table of computing resource scheduling schemes provided according to a specific embodiment of the present invention. As shown in Table 2, firstly, the KVM / VMware data center virtualization method allocates an independent virtual machine (VM) to each tenant on an x86 server through a hypervisor. It achieves strong isolation between VMs by leveraging technologies such as Intel VT-x / AMD-V hardware-assisted virtualization, IOMMU device passthrough, and SR-IOV network card virtualization. This scheme suffers from CPU virtualization overhead of 5-15% and memory overhead per VM >2GB, making it completely undeployable on in-vehicle ARM architecture low-power chips (8-32GB memory). Secondly, the Docker / Kata container isolation scheme achieves process / network / file system / user namespace isolation through Linux Namespace and CPU / memory resource limitation through Cgroups. However, this scheme is optimized for x86 servers and has severely insufficient isolation capabilities for in-vehicle heterogeneous accelerators such as GPUs / NPUs. That is, it cannot defend against risks such as GPU memory side-channel attacks and NPU inference result theft. Finally, the in-vehicle ASIL-DH hypervisor scheme integrates the in-vehicle SoC... The system is divided into safety-critical domains (ASIL-D autonomous driving) and non-safety-critical domains (ASIL-B cockpit entertainment). Spatial and temporal isolation is achieved through an ASIL-D certified Type-1 Hypervisor. However, the resource partitions in this solution are fixed at system startup and do not support dynamic adjustment at runtime. It only supports 2-3 fixed partitions, cannot be extended to multi-tenant (10+) scenarios, and lacks a dynamic safety level adjustment mechanism based on tenant behavior reputation. All partitions adopt a uniform isolation strength.

[0046] In summary, the multi-tenant isolation computing resource scheduling method of this invention reduces resource overhead by more than 80% compared to the KVM data center solution. It can be natively deployed on mainstream automotive-grade chips such as Qualcomm 8295, Orin-X, and S32N without custom hardware. It incorporates GPU / NPU into a unified isolation framework, filling the technical gap in side-channel attack protection for heterogeneous accelerators in automotive multi-tenant scenarios. The TEE dynamic trust assessment engine breaks through the static isolation mode of traditional hypervisors, adaptively adjusting the security strength according to the real-time behavior of tenants. This allows low-risk tenants to enjoy lightweight isolation, while high-risk tenants receive strong isolation. Through a progressive mechanism, it achieves the optimal balance between security and availability, providing a secure and compliant foundation for automakers' open computing platforms.

[0047] Table 2

[0048] Furthermore, this embodiment of the invention also provides a comparative analysis of the isolation architectures of a pure hardware isolation method based on RISC-V PMP physical memory protection, an ultra-lightweight virtualization method based on MicroVM (Firecracker / Cloud Hypervisor), and a programmable kernel-level isolation method based on eBPF / Seccomp.

[0049] Specifically, the pure hardware isolation method based on RISC-V PMP physical memory protection achieves pure hardware-level isolation based on the RISC-V PMP (Physical Memory Protection) physical memory protection mechanism. All isolation is enforced by the CPU hardware, with no software attack surface. However, the RISC-V ecosystem maturity in the automotive chip field is far lower than that of ARM (market share <5%), and pure hardware isolation has poor flexibility—changing the isolation configuration requires modifying the PMP registers and restarting the CPU core, which cannot achieve the dynamic layered switching described in this paper. Furthermore, the industrial migration cost of switching from ARM architecture to RISC-V is high, making it unsuitable. The ultra-lightweight virtualization method based on MicroVM (Firecracker / CloudHypervisor) deploys ultra-lightweight MicroVMs such as Firecracker or CloudHypervisor on the vehicle side (memory overhead per VM <100MB, startup time <125ms), allocating an independent MicroVM to each tenant. This solution has higher isolation strength than containers and lower resource overhead than traditional KVM, and has been widely verified in x86 cloud environments. However, on automotive ARM architectures, MicroVM's ARM adaptation is still immature (e.g., the ARM version of the GPU / NPU passthrough driver is missing), and MicroVM's fast startup depends on the KVM kernel module (requiring ARMv8.1VHE virtualization extension support), which most automotive-grade chips (such as Cortex-R52) lack. The eBPF / Seccomp programmable kernel-level isolation method does not introduce a Hypervisor or container; it directly uses eBPF+Seccomp to programmably filter system calls and network packets at the kernel level, achieving lightweight kernel-based isolation. This solution has extremely low resource overhead (almost zero additional overhead), but eBPF has limitations within the GPU / NPU driver. The lack of visibility and control over the data flow in the system makes it impossible to prevent GPU memory side-channel attacks. Furthermore, the execution of eBPF in the kernel space requires root privileges, while vehicle systems typically do not expose kernel programming interfaces due to security and compliance requirements. The method in this embodiment of the invention adopts a hybrid architecture of TrustZoneL1+NamespaceL2+CFSL3, taking into account the actual hardware capabilities of the automotive ARM chip (TrustZone 100% support, Namespace 100% usable), the current status of GPU / NPU driver isolation adaptation (MIG is in mass production, IOMMU is mature), and the compatibility with automotive-grade safety certifications (TrustZone already has ISO26262 certification cases). Therefore, it is superior to existing solutions.

[0050] Furthermore, this embodiment of the invention also conducts a comparative analysis of trust assessment mechanisms for a one-time access assessment method based on a static whitelist, a cloud-based centralized threat detection method based on third-party security vendors, and a hardware trust root method based on TPM remote verification.

[0051] Specifically, the one-time access assessment method based on static whitelists only performs qualification review and code signature verification during tenant registration. After passing the review, fixed-level isolation permissions are permanently granted, but runtime behavior monitoring is not performed. This method cannot defend against attack patterns where compliance registration precedes malicious behavior. Attackers can first obtain L2 / L3 permissions by passing all static reviews and then launch side-channel attacks at runtime. In the multi-tenant open scenario of vehicles, the security guarantee of static whitelists cannot meet the UN R155 requirements for continuous security monitoring. The cloud-based centralized threat detection method based on third-party security vendors does not deploy a scoring agent on the vehicle. Instead, it uploads all tenant behavior logs in real time to the third-party security vendor's cloud SIEM (Security Information and Event Management) platform for centralized threat detection. However, this solution consumes a large amount of 5G uplink bandwidth (up to several GB per vehicle per day) when uploading behavior logs in real time, resulting in extremely high operating costs. The round-trip latency of cloud detection (usually 200ms-2s) is much greater than that of local detection on the vehicle (≤5ms). Attacks may be successfully carried out before detection is completed, and the behavior logs contain the vehicle's internal system call sequence, posing a privacy risk. The method exposes risks (such as restrictions on cross-border data transmission between China and Europe); the hardware trust root method based on TPM remote proof uses the TPM (TrustedPlatformModule) remote proof mechanism to verify the integrity of the vehicle-side software stack (trusted startup + IMA integrity measurement), and only allows tenants that have passed the integrity verification to run. This scheme can prevent tenant code from being tampered with, but it cannot prevent tenants from launching side-channel attacks within the scope of legitimate authorization (such as normal calls to GPU driver APIs) - side-channel attacks exploit the physical characteristics of hardware shared resources (cache, video memory bandwidth) rather than software vulnerabilities; the method of this embodiment adopts a collaborative architecture of "vehicle-side TEE local real-time detection + cloud federated learning offline model update" which takes into account the detection real-time performance (≤ 5ms), bandwidth efficiency (only uploading de-identified abnormal features), privacy protection (data does not leave the vehicle), and continuous model evolution (federated learning), and is therefore superior to the existing technology.

[0052] Furthermore, this embodiment of the invention also compares and analyzes data clearing strategies for hardware clearing methods based on physical memory power failure, key destruction schemes based on full-disk encryption (FDE), and unified deep clearing schemes that do not distinguish between levels.

[0053] Specifically, the hardware zeroing method based on physical memory power-off involves powering off and then powering on the DRAM physical memory area allocated to the tenant after the tenant's task ends, leveraging the volatility of DRAM to achieve hardware-level zeroing. However, this requires the SoC to support independent power gating for specific memory areas. Current automotive SoCs typically only support power domain control for the entire chip or die, not independent power-off of fine-grained memory areas, resulting in poor applicability. In the key destruction scheme based on full-disk encryption (FDE), all tenant data is encrypted with an independent key when written to memory and storage. Destroying the key after the task ends is equivalent to zeroing out the data. However, the key in this scheme must reside in memory during task execution for decryption, making it vulnerable to side-channel attacks. Furthermore, even if the key is destroyed, the encrypted ciphertext data remains in memory / display. The storage presents long-term security risks in the face of future attack methods such as quantum computing. The unified deep zeroing scheme that does not distinguish between levels performs G1 deep zeroing (i.e., DoD three-time overwrite) on all tenants of L1 / L2 / L3. However, the execution latency of this scheme is too large. It requires a wait of 500ms after each task is completed. In the scenario of intensive scheduling of batch short tasks (such as lightweight AI inference, with a single task of 2-3 seconds), the zeroing latency of 500ms will occupy an additional 15-25% of computing time, which will seriously affect the system throughput. Therefore, the method of the present invention is superior to the solution of the prior art.

[0054] The multi-tenant isolated computing resource scheduling method provided by the present invention, after receiving a task execution request issued by a user, first calculates the initial trust score corresponding to the current task, determines the security isolation level matched by the task based on the score, then allocates heterogeneous computing resources corresponding to the isolation layer according to the security isolation level, and calls the allocated heterogeneous computing resources to complete the execution of the current task. This solves the problems in related technologies such as the fixed isolation level of multi-tenant heterogeneous computing power in vehicles, the lack of a supporting data clearing mechanism for GPU and NPU heterogeneous units, the inability of isolation scheduling to meet the hard real-time constraints of vehicles, and the mismatch between tenant risk and protection strength. It improves the dynamic adaptation capability of multi-tenant computing power scheduling in vehicles, the level of data residue protection, and the real-time operation stability of vehicle services.

[0055] Next, referring to the accompanying drawings, a multi-tenant isolated computing resource scheduling device according to an embodiment of the present invention is described.

[0056] Figure 3 This is a block diagram of a multi-tenant isolated computing resource scheduling device provided according to an embodiment of the present invention.

[0057] like Figure 3 As shown, the multi-tenant isolated computing resource scheduling device 10 includes: a determination module 100, a discrimination module 200, and an execution module 300.

[0058] The determination module 100 is used to determine the initial trust score of the current task in response to receiving a task execution request from the user; the discrimination module 200 is used to determine the security isolation level of the current task based on the initial trust score; and the execution module 300 is used to determine the isolation layer of the current task according to the security isolation level and use the heterogeneous computing resources corresponding to the isolation layer to process the current task.

[0059] Furthermore, in some embodiments, after processing the current task using the heterogeneous computing resources corresponding to the isolation layer, the execution module 300 is specifically used to: determine the security isolation level corresponding to the isolation layer in response to the end of the current task execution; determine the target zeroing strategy of the isolation layer according to the security isolation level corresponding to the isolation layer, and perform zeroing processing on the isolation layer according to the target zeroing strategy.

[0060] Furthermore, in some embodiments, the execution module 300 is also used to: allocate a preset independent hardware security domain, an encrypted memory partition, a GPU independent video memory address mapping space, an independent interrupt routing channel, and a fixed CPU time slice budget to the isolation layer; perform three overwrite operations on the encrypted memory partition in the isolation layer: all 0s, all 1s, and random values; and perform filling and zeroing processing on the GPU independent video memory address mapping space and the NPU independent cache partition.

[0061] Furthermore, in some embodiments, the execution module 300 is also used to: allocate a preset independent process namespace, computing resource quota, system call whitelist permission, independent GPU computing instance and independent NPU computing context to the isolation layer; perform a single all-zero write operation on the memory in the independent process namespace in the isolation layer, clean up the independent process namespace, and perform filling and zeroing processing on the independent GPU computing instance and independent NPU computing context.

[0062] Furthermore, in some embodiments, the execution module 300 is also used to: allocate preset CPU time slice scheduling permissions and shared memory pool access permissions to the isolation layer; and release the memory pointer corresponding to the shared memory pool in the isolation layer.

[0063] Furthermore, in some embodiments, the determining module 100 is specifically used to: determine the identity information of the currently running task and the user based on the task running request; calculate the identity trust score, behavior compliance score, data security score and environment trust score based on the currently running task and identity information; and obtain an initial trust score based on the identity trust score, behavior compliance score, data security score and environment trust score.

[0064] It should be noted that the explanation of the above-described embodiment of the multi-tenant isolated computing resource scheduling method also applies to the multi-tenant isolated computing resource scheduling device of this embodiment, and will not be repeated here.

[0065] The multi-tenant isolated computing resource scheduling device provided in this embodiment of the invention, after receiving a task execution request issued by a user, first calculates the initial trust score corresponding to the current task, determines the security isolation level matched by the task based on the score, then allocates heterogeneous computing resources corresponding to the isolation layer according to the security isolation level, and calls the allocated heterogeneous computing resources to complete the execution of the current task. This solves the problems in related technologies such as the fixed isolation level of multi-tenant isolation of vehicle heterogeneous computing power, the lack of a supporting data clearing mechanism for GPU and NPU heterogeneous units, the inability of isolation scheduling to meet the hard real-time constraints of vehicles, and the mismatch between tenant risk and protection strength. It improves the dynamic adaptation capability of vehicle multi-tenant computing power scheduling, the level of data residue protection, and the real-time operation stability of vehicle services.

[0066] Figure 4 This is a schematic diagram of an electronic device provided according to an embodiment of the present invention. The electronic device may include: The memory 401, the processor 402, and the computer program stored on the memory 401 and capable of running on the processor 402.

[0067] When the processor 402 executes the program, it implements the multi-tenant isolation computing resource scheduling method provided in the above embodiments.

[0068] Furthermore, electronic devices also include: Communication interface 403 is used for communication between memory 401 and processor 402.

[0069] The memory 401 is used to store computer programs that can run on the processor 402.

[0070] The memory 401 may include high-speed RAM (Random Access Memory) memory, and may also include non-volatile memory, such as at least one disk storage.

[0071] If the memory 401, processor 402, and communication interface 403 are implemented independently, then the communication interface 403, memory 401, and processor 402 can be interconnected via a bus to complete communication between them. The bus can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 4The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0072] Optionally, in a specific implementation, if the memory 401, processor 402, and communication interface 403 are integrated on a single chip, then the memory 401, processor 402, and communication interface 403 can communicate with each other through an internal interface.

[0073] Processor 402 may be a CPU (Central Processing Unit), an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement embodiments of the present invention.

[0074] In addition, embodiments of the present invention also provide a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the above-described multi-tenant isolated computing resource scheduling method.

[0075] In addition, embodiments of the present invention also provide a computer program product, including a computer program, which is executed to implement the above-described multi-tenant isolation computing resource scheduling method.

[0076] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0077] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0078] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A method for scheduling computing resources with multi-tenant isolation, characterized in that, Includes the following steps: In response to receiving a user's task execution request, determine the initial trust score for the current task; Based on the initial trust score, the security isolation level of the current task is determined; The isolation layer of the current task is determined based on the security isolation level, and the heterogeneous computing resources corresponding to the isolation layer are used to process the current task.

2. The method according to claim 1, characterized in that, After processing the current task using the heterogeneous computing resources corresponding to the isolation layer, the process further includes: In response to the completion of the current task, the security isolation level corresponding to the isolation layer is determined; The target zeroing strategy for the isolation layer is determined based on the security isolation level corresponding to the isolation layer, and the isolation layer is zeroed according to the target zeroing strategy.

3. The method according to claim 2, characterized in that, The security isolation level corresponding to the isolation layer is Level 1. The process of determining a target zeroing strategy for the isolation layer based on its security isolation level, and then zeroing the isolation layer according to the target zeroing strategy, includes: The isolation layer is allocated a preset independent hardware security domain, an encrypted memory partition, a GPU independent video memory address mapping space, an independent interrupt routing channel, and a fixed CPU time slice budget. The encrypted memory partition in the isolation layer is overwritten three times with all 0s, all 1s, and random values. The GPU independent video memory address mapping space and the NPU independent cache partition are filled and cleared.

4. The method according to claim 2, characterized in that, The security isolation level corresponding to the isolation layer is level two. The step of determining the target zeroing strategy for the isolation layer based on its security isolation level, and then zeroing the isolation layer according to the target zeroing strategy, includes: The isolation layer is allocated a preset independent process namespace, computing resource quota, system call whitelist permission, independent GPU computing instance and independent NPU computing context; Perform a single all-zero write operation on the memory within the independent process namespace in the isolation layer, clean up the independent process namespace, and perform fill and zeroing processing on the independent GPU computing instance and the independent NPU computing context.

5. The method according to claim 2, characterized in that, The security isolation level corresponding to the isolation layer is level three. The step of determining the target zeroing strategy for the isolation layer based on its security isolation level, and then zeroing the isolation layer according to the target zeroing strategy, includes: Assign preset CPU time slice scheduling permissions and shared memory pool access permissions to the isolation layer; Release the memory pointer corresponding to the shared memory pool in the isolation layer.

6. The method according to claim 1, characterized in that, Determining the initial trust score for the current task includes: Based on the task execution request, determine the identity information of the currently running task and the user; Based on the currently running task and the identity information, calculate the identity credibility score, behavior compliance score, data security score, and environment credibility score; The initial trust score is obtained based on the identity credibility score, the behavior compliance score, the data security score, and the environment credibility score.

7. A multi-tenant isolated computing resource scheduling device, characterized in that, include: The determination module is used to determine the initial trust score of the current task in response to receiving a task execution request from the user. The discrimination module is used to determine the security isolation level of the current task based on the initial trust score; The execution module is used to determine the isolation layer of the current task according to the security isolation level, and to process the current task using the heterogeneous computing resources corresponding to the isolation layer.

8. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and capable of running on the processor, wherein the processor executes the program to implement the multi-tenant isolated computing resource scheduling method as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, The program is executed by the processor to implement the multi-tenant isolated computing resource scheduling method as described in any one of claims 1-6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the multi-tenant isolation computing resource scheduling method as described in any one of claims 1-6.

Images