A resource constraint based security protection method and device

Abstract

This application discloses a security protection method and apparatus based on resource constraints, belonging to the field of edge computing security technology. Under security resource constraints, it obtains resource cost characteristic information and protection capability information for various security attributes across multiple resource dimensions for each security mechanism, and determines the security resource budget by combining the real-time resource status and business resource occupancy of the edge computing node. Then, it determines the security protection requirements based on the flow status and attribute information of the target data, and matches the security atomic operations corresponding to multiple security mechanisms under resource constraints and executes the optimal combination of security atomic operations. This achieves adaptive optimization of security protection for edge computing nodes under resource-constrained conditions, providing differentiated optimal security protection for data in different flow states while ensuring the normal operation of the main business, effectively improving resource utilization efficiency and security protection flexibility.

Description

Technical Field

[0001] This application belongs to the field of edge computing security technology, specifically relating to a security protection method, device, electronic device, and storage medium based on resource constraints. Background Technology

[0002] With the increasing intelligence of urban infrastructure, edge computing architecture is widely adopted in monitoring systems for critical facilities such as bridges and pipelines. In this architecture, edge computing nodes deployed on-site undertake the core tasks of data acquisition, preprocessing, and real-time response. However, edge computing nodes typically face resource constraints such as low CPU computing power, small memory capacity, limited energy supply, and narrow communication bandwidth, while security protection mechanisms such as data encryption, identity authentication, and integrity verification consume significant computing, storage, and network resources. This contradiction makes it difficult for edge computing nodes to effectively deploy and implement sufficient security protection measures in resource-constrained environments.

[0003] To address the aforementioned issues, current technologies have proposed various solutions. Some solutions employ lightweight cryptographic algorithms to reduce the resource consumption of individual security mechanisms, but they fail to solve the problem of how to dynamically adapt to real-time resource conditions among multiple optional security mechanisms; the selection of security mechanisms is often statically configured. Some solutions propose adaptive frameworks that dynamically adjust security policies based on threat levels, but their adaptive drive comes solely from changes in external threat levels, failing to incorporate the real-time resource status of the edge computing nodes themselves into the decision-making process. When the threat level demands high-strength security protection but the node resources are insufficient to support it, there is a lack of effective response mechanisms. Summary of the Invention

[0004] The purpose of this application is to provide a security protection method and device based on resource constraints, which can solve the problems that existing edge computing nodes are difficult to effectively deploy security protection mechanisms due to resource constraints, the static configuration of security mechanisms cannot adapt to real-time resource status changes, and the fixed protection strategies during data flow cannot match dynamic security requirements.

[0005] To solve the above-mentioned technical problems, this application is implemented as follows: In a first aspect, embodiments of this application provide a resource-constrained security protection method applied to an edge computing node, wherein the edge computing node includes multiple security mechanisms, and the method includes: For each security mechanism, acquire resource cost characteristics across multiple resource dimensions, as well as protection capabilities against various security attributes; Obtain the current resource status information and service resource occupancy information of the edge computing node, and determine the security resource budget information of the edge computing node based on the current resource status information and the service resource occupancy information; Obtain the current flow status information of the target data, and determine the security protection requirements of the target data based on the attribute information of the target data and the current flow status information; Based on the security resource budget information, the security protection requirement information, the resource cost characteristic information, and the protection capability information, a target security atomic operation combination that meets the preset security resource constraints is determined from the security atomic operations corresponding to the various security mechanisms, the security policy of the edge computing node is obtained, and the security policy is executed.

[0006] Optionally, for each security mechanism, resource cost characteristic information across multiple resource dimensions and protection capability information for multiple security attributes are obtained, including: For each security mechanism, at least one security atomic operation corresponding to the security mechanism is determined; wherein, the security atomic operation is the smallest unit for implementing a single security function; For each secure atomic operation, the resource consumption information of the secure atomic operation on the edge computing node in multiple resource dimensions is obtained as the corresponding resource cost feature information; For each secure atomic operation, the matching degree value of the secure atomic operation with multiple security attributes is obtained as the corresponding protection capability information.

[0007] Optionally, obtaining the current resource status information and service resource occupancy information of the edge computing node, and determining the security resource budget information of the edge computing node based on the current resource status information and the service resource occupancy information, includes: Obtain the current utilization information of the edge computing node across multiple resource dimensions, as well as the preset business resource reservation ratio information; Based on the current utilization information of the multiple resource dimensions and the preset business resource reservation ratio information, the remaining ratio of resources used for security protection in the multiple resource dimensions is calculated respectively to obtain the security resource budget information.

[0008] Optionally, the step of obtaining the current flow status information of the target data and determining the security protection requirements of the target data based on the attribute information of the target data and the current flow status information includes: Obtain the sensitivity level information and current flow status information of the target data; Based on the sensitivity level information and the current flow status information, the demand intensity value of the target data for the multiple security attributes is determined, and the security protection demand information is obtained.

[0009] Optionally, it also includes: The flow status of the target data is monitored, and if the flow status of the target data changes, new security protection requirements for the target data are determined. Based on the new security protection requirements, the security strategy is adjusted.

[0010] Optionally, the preset security resource constraints include at least one of the following: Mutual exclusion constraints, dependency constraints, budgeted resource constraints, and minimum safety constraints; The mutual exclusion constraint condition is that mutually exclusive safe atomic operations cannot be selected simultaneously; The dependency constraint condition is that other safe atomic operations on which the selected safe atomic operation depends are also selected. The budget value resource constraint is that the total resource consumption of the selected safe atomic operation combination across the multiple resource dimensions does not exceed the budget value of the corresponding resource dimension in the safe resource budget information; The minimum security constraint condition is that the protection capability of the selected combination of secure atomic operations against the multiple security attributes is not lower than a preset proportion of the corresponding requirement strength value in the security protection requirement information.

[0011] Optionally, after executing the security policy, the following steps are also included: During the execution of the security policy, information on resource status changes of the edge computing node is obtained, and the security policy is adjusted based on the information on resource status changes.

[0012] Optionally, adjusting the security policy based on the resource status change information includes: Based on the budget values ​​of the security resource budget information across the multiple resource dimensions, the security resource adequacy is determined; wherein, the security resource adequacy is the minimum value among the budget values ​​across the multiple resource dimensions. When the security resource sufficiency is lower than a preset degradation threshold, a security degradation operation is triggered. The security degradation operation is used to reduce the security protection strength step by step according to the preset degradation level.

[0013] Secondly, embodiments of this application provide a resource-constrained security protection device applied to an edge computing node, wherein the edge computing node includes multiple security mechanisms, and the device includes: The security feature acquisition module is used to acquire resource cost feature information across multiple resource dimensions and protection capability information for various security attributes for each security mechanism. The budget information acquisition module is used to acquire the current resource status information and business resource occupancy information of the edge computing node, and determine the security resource budget information of the edge computing node based on the current resource status information and the business resource occupancy information. The requirement information determination module is used to obtain the current flow status information of the target data, and determine the security protection requirement information required by the target data based on the attribute information of the target data and the current flow status information. The strategy determination module is used to determine the target security atomic operation combination that meets the preset security resource constraints from the security atomic operations corresponding to the multiple security mechanisms based on the security resource budget information, the security protection requirement information, the resource cost characteristic information, and the protection capability information, to obtain the security policy of the edge computing node, and to execute the security policy.

[0014] Thirdly, embodiments of this application provide an electronic device including a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the method described in the first aspect.

[0015] Fourthly, embodiments of this application provide a readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps of the method described in the first aspect.

[0016] In this embodiment, for each security mechanism, resource cost characteristic information across multiple resource dimensions and protection capability information for multiple security attributes are obtained. The current resource status information and business resource occupancy information of the edge computing node are also obtained. Based on the current resource status information and business resource occupancy information, the security resource budget information of the edge computing node is determined. The current flow status information of the target data is obtained. Based on the attribute information and current flow status information of the target data, the required security protection information for the target data is determined. Based on the security resource budget information, the security protection requirement information, the resource cost characteristic information, and the protection capability information, a target security atomic operation combination that meets preset security resource constraints is determined from the security atomic operations corresponding to the multiple security mechanisms. This yields the security policy of the edge computing node, which is then executed. This achieves the matching and execution of the optimal security mechanism combination for the edge computing node under security resource constraints. Thus, while ensuring the normal operation of the main business, differentiated optimal security protection is provided for data in different flow states, improving the edge computing node's security protection adaptability and resource utilization efficiency under resource constraints. Attached Figure Description

[0017] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the description of the present invention will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating the steps of a resource-constrained security protection method provided in some embodiments of the present invention; Figure 2 This is a structural block diagram of a resource-constrained security protection device provided in some embodiments of the present invention; Figure 3 This is a schematic diagram of the hardware structure of an electronic device provided in some embodiments of the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0020] Current technologies attempt to offload computationally intensive tasks from edge computing nodes to the cloud to optimize latency and energy consumption. However, these optimizations primarily target computing performance rather than security features and fail to consider new risks such as key transmission exposure that may be introduced during secure computing offloading. While industry security standards define static security levels, these levels are fixed once determined and cannot be dynamically adjusted based on the real-time resource status of edge computing nodes. Furthermore, they fail to provide a mechanism for coordinating resource competition between security features and core business operations. The Security-as-a-Service (SAFS) model virtualizes security features as cloud services for edge computing nodes to access, but virtualization itself consumes additional resources, making it difficult to implement on resource-constrained edge computing nodes.

[0021] In this application, each security mechanism acquires its resource cost characteristics across multiple resource dimensions and its protection capabilities against various security attributes. It then combines the current resource status information of edge computing nodes with business resource occupancy information to determine security resource budget information. Furthermore, it determines security protection requirements based on the current flow status and attribute information of the target data. At the security atomic operation level, it matches the optimal combination of security atomic operations with preset security resource constraints as a security strategy and executes it. Simultaneously, during execution, it adjusts the security strategy based on changes in resource status. Specifically, when the security resource sufficiency falls below a preset threshold, it triggers a security degradation operation to progressively reduce the security protection strength. When the processing capacity of edge computing nodes is insufficient, it sends some security protection tasks to the cloud for collaborative processing. This addresses the technical problems in current technologies, such as the lack of quantitative modeling of security mechanism resource costs, resulting in the inability to select the optimal security mechanism under resource constraints; the failure to consider the real-time resource status of edge computing nodes, leading to a mismatch between the strategy and actual available resources; the static and fixed protection strategies during data flow, failing to adapt to differentiated security needs under different flow states; the lack of a systematic collaborative mechanism between edge and cloud security functions; and the lack of a formalized security guarantee degradation path when resources are insufficient.

[0022] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0023] The following description, in conjunction with the accompanying drawings, details a resource-constrained security protection method provided by the embodiments of this application through specific examples and application scenarios.

[0024] Reference Figure 1 The diagram illustrates a flowchart of a resource-constrained security protection method according to some embodiments of the present invention. This method can be applied to edge computing nodes, which include various security mechanisms. Specifically, it may include the following steps: Step 101: For each security mechanism, obtain resource cost characteristic information across multiple resource dimensions, as well as protection capability information for multiple security attributes.

[0025] In step 101, the method of this application can be used on an edge computing node, which includes multiple types of security mechanisms. For each security mechanism, resource cost characteristic information of the security mechanism across multiple resource dimensions, as well as protection capability information for multiple security attributes, can be obtained first.

[0026] In some embodiments of this application, for each security mechanism, resource cost characteristic information across multiple resource dimensions and protection capability information for multiple security attributes are obtained, including: Sub-step 11: For each security mechanism, determine at least one security atomic operation corresponding to the security mechanism; wherein, the security atomic operation is the smallest unit for implementing a single security function.

[0027] In sub-step 11, for each security mechanism, the complex security protection mechanism can first be decomposed into indivisible Security Atomic Operations (SAOs), that is, at least one security atomic operation corresponding to the security mechanism is identified. Each SAO implements a single, well-defined security function; that is, the security atomic operation is the smallest unit to implement a single security function and has independent resource cost characteristics. Examples include AES-128-GCM encryption, HMAC-SHA256 integrity verification, and token authentication.

[0028] As an example, SAO can be divided into six categories: confidentiality protection (Category A), integrity protection (Category B), authentication operations (Category C), access control operations (Category D), audit log operations (Category E), and secure transport operations (Category F). Each category contains various specific algorithms or mechanisms, as shown in Table 1-6 below: Category A (Table 1): Confidentiality Protection Operations

[0029] Category B (Table 2): Integrity Protection Operations

[0030] Category C (Table 3): Authentication Operations

[0031] Class D (Table 4): Access Control Operations

[0032] Category E (Table 5): Audit Log Operations

[0033] Category F (Table 6): Secure Transmission Operations

[0034] Among them, TLS 1.2 tunnel establishment is Transport Layer Security 1.2 Tunnel Establishment, DTLS tunnel establishment is Datagram Transport Layer Security Tunnel Establishment, and GM / T SSL tunnel establishment is GM / T SSL Tunnel Establishment.

[0035] Sub-step 12: For each secure atomic operation, obtain the resource consumption information of the secure atomic operation on the edge computing node in multiple resource dimensions, as the corresponding resource cost feature information.

[0036] In sub-step 12, for each secure atomic operation, resource consumption information across multiple resource dimensions on the edge computing node can be obtained as corresponding resource cost feature information. Specifically, a multi-dimensional resource cost profile is created for each SAO. This can be achieved by actually measuring the resource consumption data per megabyte of data processed by each SAO on a typical target edge hardware platform (such as an ARM Cortex-A53 processor, 2GB of memory, and a 4G network module), across five dimensions: 1. CPU (Central Processing Unit) overhead: expressed as the number of CPU cycles consumed per megabyte (cycles / MB), reflecting computational intensity.

[0037] 2. Memory usage: expressed in kilobytes (KB), reflecting the memory space required during runtime.

[0038] 3. Energy consumption: expressed in millijoules per megabyte (mJ / MB), which is particularly critical for battery-powered devices.

[0039] 4. Delay overhead: expressed in milliseconds (ms), reflecting the impact on real-time performance.

[0040] 5. Bandwidth overhead: expressed as the number of extra bytes transmitted per megabyte of data (bytes / MB), reflecting overhead such as protocol headers.

[0041] For each SAO, a multi-dimensional resource cost profile is created, measuring its resource consumption on the target edge computing node. For operation s of SAO, its resource cost vector, i.e., resource cost feature information, is as follows: Cost(s) = (c_cpu(s), c_mem(s), c_energy(s), c_latency(s), c_bw(s)) (1) Where c_cpu(s) is the CPU overhead, c_mem(s) is the memory usage, c_energy(s) is the energy consumption overhead, c_latency(s) is the latency overhead, and c_bw(s) is the bandwidth overhead.

[0042] As an example, the resource cost profile of a typical SAO is shown in Table 7 below (measured on an ARM Cortex-A53@1.2GHz platform): Table 7

[0043] In one example, for AES-256-GCM encryption, the CPU overhead is approximately 2100 cycles / MB, memory usage is 4KB, power consumption is 1.4 mJ / MB, latency is 0.8ms, and bandwidth overhead is 16 bytes / MB. For the lightweight ASCON-AEAD encryption, the corresponding values ​​are 600 cycles / MB, 1KB, 0.4 mJ / MB, 0.25ms, and 8 bytes / MB, respectively. These data were obtained through actual testing and can be calibrated for different hardware platforms.

[0044] Sub-step 13: For each secure atomic operation, obtain the matching degree value of the secure atomic operation with multiple security attributes, as the corresponding protection capability information.

[0045] In sub-step 13, for each secure atomic operation, the matching degree value of the secure atomic operation with multiple security attributes can be obtained as the corresponding protection capability information. Specifically, a security attribute coverage vector is established for each SAO, including five attributes: confidentiality (C), integrity (I), authentication (A), non-repudiation (NR), and availability (AV). The coverage value of each attribute is [0,1], where 0 indicates that the SAO does not provide the attribute, and 1 indicates that it is fully provided.

[0046] For each SAO, define its coverage of the five security attributes, i.e., protection capability information: SP(s) = (sp_C(s), sp_I(s), sp_A(s), sp_NR(s), sp_AV(s)) (2) The design logic for security attribute coverage is as follows: 1. The authentication encryption class SAO (A1~A5) provides both confidentiality and integrity, but with different strengths.

[0047] 2. HMAC (Hash-based Message Authentication Code) class SAO (B1~B2) provides integrity and partial authentication (implicit authentication through shared keys).

[0048] 3. CRC (Cyclic Redundancy Check) type SAO (B3) only provides error detection capability, does not prevent tampering, and has extremely low integrity coverage.

[0049] 4. Token authentication (C1) has weak security and low coverage; two-way certificate authentication (C4) has strong security and high coverage.

[0050] 5. Tamper-proof logs (E3) provide integrity and non-repudiation through hash chains.

[0051] Examples of attribute coverage (i.e., matching degree values) for some SAOs are shown in Table 8 below: Table 8

[0052] As an example, AES-256-GCM has a confidentiality coverage of 0.95 and an integrity coverage of 0.8; while CRC32 cyclic redundancy check has an integrity coverage of only 0.2 (it can only detect errors, not prevent tampering) and an authentication capability of 0. This quantitative expression of security benefits allows different security mechanisms to be compared and combined within a unified framework.

[0053] Ultimately, the resource cost vectors and security attribute coverage vectors (i.e., resource cost feature information and protection capability information) of all SAOs can be combined to form a queryable and computable security mechanism resource cost matrix, namely SMRCM = {(s, Cost(s), SP(s)) | s ∈ SAO set}. This matrix is ​​the basic data for all subsequent optimization decisions. Among them, SMRCM (Security Mechanism Resource Cost Matrix) is the security mechanism resource cost matrix.

[0054] Step 102: Obtain the current resource status information and business resource occupancy information of the edge computing node, and determine the security resource budget information of the edge computing node based on the current resource status information and the business resource occupancy information.

[0055] In step 102, the current resource status information and business resource occupancy information of the edge computing node can be obtained, and the security resource budget information of the edge computing node can be determined based on the current resource status information and business resource occupancy information.

[0056] A lightweight resource monitoring module can reside on the edge computing node to collect four-dimensional resource utilization data at 5-second intervals (which can be dynamically adjusted): CPU utilization, memory utilization, remaining power ratio, and network bandwidth utilization.

[0057] In some embodiments of this application, obtaining the current resource status information and service resource occupancy information of the edge computing node, and determining the security resource budget information of the edge computing node based on the current resource status information and the service resource occupancy information, includes: Sub-step 21: Obtain the current utilization information of the edge computing node in the multiple resource dimensions, as well as the preset business resource reservation ratio information.

[0058] In sub-step 21, the current utilization information of the edge computing node in the multiple resource dimensions and the preset business resource reservation ratio information are obtained.

[0059] For edge computing node n, the following four-dimensional resource status can be monitored in real time through the resource monitoring module: 1. CPU utilization U_cpu(n,t): Current CPU utilization, with values ​​[0,1].

[0060] 2. Memory utilization rate U_mem(n,t): Current memory utilization rate, with values ​​[0,1].

[0061] 3. Remaining power percentage U_energy(n,t): The percentage of the current remaining power relative to the total power, with a value of [0,1].

[0062] 4. Bandwidth utilization rate U_bw(n,t): Current network bandwidth utilization rate, with a value of [0,1].

[0063] The monitoring cycle is set to 5 seconds by default, but can be dynamically adjusted according to the node load. For example, it can be shortened to 1 second under high load and extended to 30 seconds under low load.

[0064] For example, at a certain moment, the CPU utilization is 45%, the memory utilization is 55%, the remaining power is 60%, and the bandwidth utilization is 30%.

[0065] Meanwhile, a preset allocation ratio of primary business resources can be set for each edge computing node. Typical recommended values ​​are 60% CPU reservation, 50% memory reservation, 70% power consumption reservation (for battery-powered nodes), and 50% bandwidth reservation. For mains-powered nodes, the power consumption reservation can be reduced to 40%; for high-priority monitoring nodes, the CPU reservation can be increased to 70%. The allocation ratio can also be dynamically adjusted based on operational experience.

[0066] For edge computing node n, the main business resource reservation vector is: Reserve(n) = (r_cpu(n), r_mem(n), r_energy(n), r_bw(n))(3) Where r_cpu(n): CPU reservation ratio for main business, with a value of [0,1], and 0.6 is recommended; r_mem(n): The proportion of memory reserved for the main business, with a value of [0,1], and 0.5 is recommended; r_energy(n): The energy consumption reserve ratio for main business, with a value of [0,1], and 0.7 is recommended (higher reserve is required for battery-powered nodes); r_bw(n): Main service bandwidth reservation ratio, with a value of [0,1], and 0.5 is recommended.

[0067] Sub-step 22: Based on the current utilization information of the multiple resource dimensions and the preset business resource reservation ratio information, calculate the remaining ratio of resources used for security protection in the multiple resource dimensions respectively, and obtain the security resource budget information.

[0068] In sub-step 22, the remaining proportion of resources used for security protection can be calculated based on the current utilization information of multiple resource dimensions and the preset business resource reservation ratio information, so as to obtain the security resource budget information.

[0069] Specifically, the security resource budget is calculated using a principle of first reserving and then taking the remaining resources. Based on resource status and primary service reservations, the security resource budget information for edge computing node n at time t is calculated as follows: SRB(n,t) = (b_cpu(n,t), b_mem(n,t), b_energy(n,t), b_bw(n,t))(4) The calculation methods for each component (i.e., security resource budget information) are as follows: b_cpu(n,t) = max(0, (1 - r_cpu(n)) - max(0, U_cpu(n,t) - r_cpu(n))); b_mem(n,t) = max(0, (1 - r_mem(n)) - max(0, U_mem(n,t) - r_mem(n))); b_energy(n,t) = U_energy(n,t) × (1 - r_energy(n)); b_bw(n,t) = max(0, (1 - r_bw(n)) - max(0, U_bw(n,t) - r_bw(n))).

[0070] As an example, for the CPU dimension, we can first calculate (1 - reserved percentage) = 0.4, and then calculate the portion of the current utilization exceeding the reserved percentage. For example, if 45% is less than 60%, it does not exceed the limit, and the actual excess is 0. Therefore, b_cpu = 0.4 - 0 = 0.4, meaning 40% of the CPU capacity is available for safe use. If the current utilization exceeds the reserved percentage, for example, if the CPU utilization reaches 85% while the reserved percentage is 60%, then it exceeds the limit by 25%, and b_cpu = 0.4 - 0.25 = 0.15, meaning only 15% is available. For the energy consumption dimension, since the remaining power is limited, b_energy = remaining power percentage × (1 - energy consumption reserved percentage), for example, 0.6 × 0.3 = 0.18.

[0071] Furthermore, the comprehensive index of security resource budget, i.e., security resource adequacy, is calculated by taking the minimum value of the budget across the four dimensions: SRB_index(n,t) = min(b_cpu(n,t), b_mem(n,t), b_energy(n,t), b_bw(n,t))(5) The security resource sufficiency level ranges from 0 to 1, intuitively reflecting the sufficiency of security resources: close to 0 indicates extreme tension, and close to 1 indicates sufficiency. In the example above, min(0.4, 0.45, 0.18, 0.5) = 0.18, indicating a tense state.

[0072] The classification of security resource adequacy levels is shown in Table 9 below: Table 9

[0073] To avoid frequent policy switching, a short-term prediction mechanism can be introduced. This employs an exponentially weighted moving average method, predicting resource status within the next 60 seconds based on data from several past periods, thereby calculating the predicted safe resource budget. If the prediction indicates resource scarcity, policy adjustments can be triggered in advance, achieving proactive policy adjustment rather than reactive response. The short-term prediction mechanism is used to anticipate future resource trends during policy selection and adjust the policy cache in advance; actual degradation is still triggered when the actual SRB_index is below a threshold for three consecutive monitoring periods. The two mechanisms complement each other.

[0074] Step 103: Obtain the current flow status information of the target data, and determine the security protection requirements of the target data based on the attribute information of the target data and the current flow status information.

[0075] In step 103, the current flow status information of the target data can be obtained, and the security protection requirements of the target data can be determined based on the attribute information and the current flow status information of the target data.

[0076] In some embodiments of this application, obtaining the current flow status information of the target data and determining the security protection requirements of the target data based on the attribute information of the target data and the current flow status information includes: Sub-step 31: Obtain the sensitivity level information and current flow status information of the target data.

[0077] In sub-step 31, the sensitivity level information and current flow status information of the target data can be obtained. Specifically, firstly, six flow states of the data can be defined: 1. S0 Acquisition State: The sensor is acquiring data, but it has not yet been persisted, and the dwell time is extremely short (milliseconds to seconds).

[0078] 2. S1 Edge Temporary Storage State: Data has been written to the local storage of the edge computing node and may be waiting to be uploaded or processed. The residence time varies from seconds to hours.

[0079] 3. S2 Edge Processing State: The edge computing node is preprocessing or analyzing data, with a short dwell time (milliseconds to seconds).

[0080] 4. S3 Transmission State: Data is being transmitted between edge computing nodes and the cloud via the network, with a dwell time of hundreds of milliseconds to seconds.

[0081] 5. S4 Cloud Status: The data has arrived in the cloud and is in storage or deep processing, with a long residence time (hours to permanent).

[0082] 6. S5 Deployment Mode: The cloud sends control commands or analysis results to edge computing nodes, with a dwell time of hundreds of milliseconds to seconds.

[0083] The transition between states is triggered by events, with a total of 8 transitions. Each transition has different security concerns, and the 8 transitions are shown in Table 10 below: Table 10

[0084] The sensitivity level L(d) of the data is determined when the data is generated (collection state S0) and is carried as a meta-attribute of the data throughout its flow. The determination rule can be based on the data source and content, and is divided into four levels from L1 to L4, with L4 being the highest, as shown in Table 11 below: Table 11

[0085] Threat modeling can be performed for each transition state to identify the most likely attack types in that state: S0 acquisition state: physical tampering with sensors, side-channel attacks; S1 edge temporary state: local storage theft, physical extraction of storage media; S2 edge processing state: memory theft, processing tampering, container escape; S3 transmission state: link eavesdropping, man-in-the-middle attack, replay attack; S4 Cloud Status: Internal personnel abusing their privileges and launching cross-tenant attacks; S5-based states: instruction tampering, instruction forgery, instruction replay.

[0086] Sub-step 32: Based on the sensitivity level information and the current flow status information, determine the demand intensity value of the target data for the multiple security attributes, and obtain the security protection demand information.

[0087] In sub-step 32, the demand intensity values ​​of the target data for the various security attributes can be determined based on the sensitivity level information and the current flow status information, thus obtaining security protection demand information. Specifically, for data with a sensitivity level of L, the security attribute demand vector under flow status S_i, i.e., the security protection demand information, is as follows: R(L, S_i) = (r_C(L, S_i), r_I(L, S_i), r_A(L, S_i), r_NR(L, S_i), r_AV(L, S_i)) (6) Each component takes a value of [0,1], where 0 indicates that the attribute is not needed and 1 indicates that the attribute with the highest strength is needed.

[0088] The rules for deriving security attribute requirements are as follows: Rule 1: Confidentiality requirement r_C can be determined by both data sensitivity and exposure risk: r_C(L, S_i) = S_level(L) × Exposure(S_i) (7) Where S_level(L) is the sensitivity level mapping (L1=0.2, L2=0.5, L3=0.8, L4=1.0), and Exposure(S_i) is the state exposure coefficient, as shown in Table 12 below: Table 12

[0089] Rule 2: Integrity requirement r_I can be determined by both data sensitivity and the impact of tampering: r_I(L, S_i) = S_level(L) × TamperImpact(S_i)(8) Wherein, TamperImpact(S_i) is the tampering impact coefficient, as shown in Table 13 below: Table 13

[0090] Rule 3: The authentication requirement r_A can be determined by the communication scenario: r_A(L, S_i) = S_level(L) × CommNeed(S_i) (9) Wherein, CommNeed(S_i) is the communication authentication requirement coefficient, as shown in Table 14 below: Table 14

[0091] Rule 4: The non-repudiation requirement r_NR can be determined by audit requirements: r_NR(L, S_i) = S_level(L) × AuditNeed(S_i) (10) Where AuditNeed(S_i) is the audit requirement coefficient, as shown in Table 15 below: Table 15

[0092] Rule 5: Availability requirement r_AV is determined by business continuity requirements: r_AV(L, S_i) = S_level(L) × BusinessContinuity(S_i)(11) Wherein, BusinessContinuity(S_i) is the business continuity coefficient, as shown in Table 16 below: Table 16

[0093] As an example, for L3 sensitive target data, in the transmission state, the confidentiality requirement r_C = 0.8 × 1.0 = 0.80, the integrity requirement r_I = 0.8 × 0.9 = 0.72, and the authentication requirement r_A = 0.8 × 1.0 = 0.80, all of which are at a relatively high level; while in the edge temporary storage state, the authentication requirement is only 0.16, because the local storage stage has very low requirements for communication authentication.

[0094] Step 104: Based on the security resource budget information, the security protection requirement information, the resource cost characteristic information, and the protection capability information, determine the target security atomic operation combination that satisfies the preset security resource constraints from the security atomic operations corresponding to the multiple security mechanisms, obtain the security policy of the edge computing node, and execute the security policy.

[0095] In step 104, based on security resource budget information, security protection requirement information, resource cost characteristic information, and the protection capability information, a target security atomic operation combination that satisfies preset security resource constraints can be determined from the security atomic operations corresponding to various security mechanisms to obtain the security policy of the edge computing node, and the security policy is executed.

[0096] In some embodiments of this application, the preset security resource constraints include at least one of the following: Mutual exclusion constraints, dependency constraints, budgeted resource constraints, and minimum safety constraints; The mutual exclusion constraint condition is that mutually exclusive safe atomic operations cannot be selected simultaneously; The dependency constraint condition is that other secure atomic operations on which the selected secure atomic operation depends are also selected; the budget value resource constraint condition is that the total resource consumption of the selected secure atomic operation combination across the multiple resource dimensions does not exceed the budget value of the corresponding resource dimension in the secure resource budget information; the minimum security constraint condition is that the protection capability of the selected secure atomic operation combination against the multiple security attributes is not lower than a preset proportion of the corresponding demand intensity value in the security protection demand information.

[0097] Specifically, the preset security resource constraints should include at least one of the following: mutual exclusion constraints, dependency constraints, budgeted resource constraints, and minimum security constraints. 1. Mutual Exclusion Constraints: Mutually exclusive secure atomic operations cannot be selected simultaneously. For example: A1 and A2 are mutually exclusive, i.e., encryption of the same type with different key lengths; A1 and A4 are mutually exclusive, i.e., encryption of the same type with different algorithms; C3 and C4 are mutually exclusive, i.e., one-way and two-way authentication cannot coexist; F1 and F2 are mutually exclusive, i.e., different TLS versions cannot coexist.

[0098] 2. Dependency Constraints: Other secure atomic operations that a selected secure atomic operation depends on must also be selected. For example: E3 depends on B1 or B2, meaning the tamper-proof log requires a hash base; F1~F4 depend on C3 or C4, meaning the TLS channel requires certificate authentication; D3 depends on C2, C3, or C4, meaning ABAC requires an identity authentication base.

[0099] 3. Budget Value Resource Constraint: The total resource consumption of the selected safe atomic operation combination across the multiple resource dimensions does not exceed the budget value for the corresponding resource dimension in the safe resource budget information. Specifically, Σ {s∈S} c_cpu(s)×V_data≤b_cpu(n,t)×C_total(n); Σ {s∈S} c_mem(s)≤b_mem(n,t)×M_total(n); Σ {s∈S} c_energy(s)×V_data≤b_energy(n,t)×E_total(n); Σ {s∈S}}c_bw(s)×V_data≤b_bw(n,t)×B_total(n).

[0100] Where V_data is the amount of data to be processed (MB), and C_total, M_total, E_total, and B_total are the total resources of the edge computing node in multiple resource dimensions, namely CPU utilization, memory utilization, remaining power ratio, and bandwidth utilization, respectively.

[0101] 4. Minimum security constraint: The protection capability of the selected combination of secure atomic operations against the multiple security attributes is not less than a preset proportion of the corresponding requirement strength value in the security protection requirement information. Specifically, Coverage_X(S) ≥ r_X × θ_X, X∈{C,I,A,NR,AV}. Where θ_X is the minimum guarantee coefficient, and it is recommended that θ_C=0.3, θ_I=0.5, θ_A=0.3, θ_NR=0.1, and θ_AV=0.2.

[0102] As an example, we solve for the optimal combination S_opt of safe atomic operations. SAO can be based on: the sensitivity level L(d) of data d and the current flow state S_i; Security attribute requirement vector R(L(d), S_i) = (r_C, r_I, r_A, r_NR, r_AV); The security resource budget SRB(n,t) for edge computing node n; Security Mechanism Resource Cost Matrix (SMRCM)

[0103] Objective function: Maximize the coverage of security attributes and the degree of matching with requirements.

[0104] Constraints: Budgetary resource constraints, minimum security constraints, mutual exclusion constraints, and dependency constraints.

[0105] A greedy approximation algorithm based on security attribute priority can be used. The key to this algorithm is that the order of the greedy operations is not arbitrary, but rather dynamically determined based on the threat model of the current data flow state. For example: In transport state S3, authentication is the most critical, followed by integrity, confidentiality, non-repudiation, and availability. In the edge temporary state S1, confidentiality is the most critical, followed by integrity, availability, authentication, and non-repudiation; In the context of S5 deployment, integrity and authentication are equally critical. In cloud-based S4, non-repudiation and authentication are the most critical. In edge processing state S2, integrity is the most critical, followed by confidentiality, availability, authentication, and non-repudiation; In the acquisition state S0, integrity is the most critical factor, followed by confidentiality, authentication, availability, and non-repudiation.

[0106] The specific process of the algorithm is as follows: 1. Initialization: S_opt= (Empty set), calculate the gap_X = r_X - Coverage_X(S_opt) for each security attribute.

[0107] 2. Determine attribute priority: Based on the threat model of the current flow status, determine the priority order of security attributes.

[0108] 3. Greedy Selection: Based on attribute priority from high to low, for each attribute X: if Gap_X≤0, skip; otherwise, select the SAO from the SMRCM that maximizes the coverage increment of attribute X and satisfies the resource constraints. The selection criterion is to add the SAO that maximizes (sp_X(s) / ResourceCost(s)) to S_opt. Where ResourceCost(s) = Σ {dim∈{cpu,mem,energy,bw}}λ_dim×c_dim(s) / b_dim(n,t), where λ_dim is determined by the dimension with the most scarce resource and has the highest weight.

[0109] 4. Resource Constraint Relaxation: If there are still attribute gaps that are not satisfied after step 3 (due to resource constraints), implement the relaxation strategy: try to replace the SAO in S_opt with a lighter SAO, such as A2→A1→A4→A5, to release resources for the gap attribute; if it still cannot be satisfied, mark the unsatisfied attribute gap as "requires cloud compensation".

[0110] 5. Output the optimal security policy S_opt and the coverage vector of each attribute.

[0111] To improve efficiency, a policy cache table was also implemented: the most recent optimal result is cached for each sensitivity level, transition state, and SRB interval combination. The SRB interval is divided into four intervals: extremely tense, tense, normal, and ample. When the SRB changes slightly within the same interval, only incremental fine-tuning of the policy is performed, such as replacing individual SAOs, instead of resolving, which significantly reduces computational overhead.

[0112] Finally, after determining the target safe atomic operation combination that satisfies the preset safe resource constraints from the safe atomic operations corresponding to various safety mechanisms, and obtaining the safety policy of the edge computing node, the safety policy can be executed.

[0113] In this embodiment, for each security mechanism, resource cost characteristic information across multiple resource dimensions and protection capability information for multiple security attributes are obtained. The current resource status information and business resource occupancy information of the edge computing node are also obtained. Based on the current resource status information and business resource occupancy information, the security resource budget information of the edge computing node is determined. The current flow status information of the target data is obtained. Based on the attribute information and current flow status information of the target data, the required security protection information for the target data is determined. Based on the security resource budget information, the security protection requirement information, the resource cost characteristic information, and the protection capability information, a target security atomic operation combination that meets preset security resource constraints is determined from the security atomic operations corresponding to the multiple security mechanisms. This yields the security policy of the edge computing node, which is then executed. This achieves the matching and execution of the optimal security mechanism combination for the edge computing node under security resource constraints. Thus, while ensuring the normal operation of the main business, differentiated optimal security protection is provided for data in different flow states, improving the edge computing node's security protection adaptability and resource utilization efficiency under resource constraints.

[0114] In some embodiments of this application, it also includes: The flow status of the target data is monitored, and if the flow status of the target data changes, new security protection requirements for the target data are determined; based on the new security protection requirements, the security strategy is adjusted.

[0115] Specifically, the flow status of target data can be monitored. When the flow status of target data changes, new security protection requirements for the target data can be determined. Based on the new security protection requirements, security strategies can be adjusted.

[0116] When data undergoes a state transition, the new security protection requirements for the target data can be determined. The system can then automatically compare the differences between the requirement vectors (i.e., security protection requirement information) of the two transition states, identifying attributes of increased or decreased requirements. Specifically, this includes: 1. Security attribute requirement change detection: Compare R(L,S_i) and R(L,S_j) to identify attributes whose requirements are enhanced or weakened.

[0117] 2. Security Mechanism Supplement: For enhanced attributes, the corresponding SAO needs to be selected from the Security Mechanism Resource Cost Matrix (SMRCM) and added to the security policy.

[0118] 3. Safety mechanism release: For weakened attributes, the relevant SAO can be released to save resources.

[0119] 4. Transition process protection: The state transition itself is a security-critical event. The system will record transition logs, verify data consistency, and establish an end-to-end secure channel in advance when cross-node transmission is involved.

[0120] In some embodiments of this application, after executing the security policy, the method further includes: During the execution of the security policy, information on resource status changes of the edge computing node is obtained, and the security policy is adjusted based on the information on resource status changes.

[0121] Specifically, during the execution of security policies, edge computing nodes continuously monitor changes in resource dimensions such as CPU, memory, power, and bandwidth. When resource status changes, corresponding adjustment mechanisms can be triggered, including four aspects of processing: security degradation, cloud collaboration, tiered verification, and closed-loop feedback. These are explained in detail below.

[0122] In some embodiments of this application, adjusting the security policy based on the resource state change information includes: Sub-step 41: Determine the security resource adequacy based on the budget values ​​of the security resource budget information across the multiple resource dimensions; wherein the security resource adequacy is the minimum value among the budget values ​​across the multiple resource dimensions.

[0123] In sub-step 41, the security resource budget information includes budget values ​​for four dimensions: CPU, memory, energy consumption, and bandwidth: b_cpu(n,t), b_mem(n,t), b_energy(n,t), and b_bw(n,t). The minimum value among these four budget values ​​can be taken as the security resource adequacy, i.e., Security Resource Adequacy SRB = min(b_cpu, b_mem, b_energy, b_bw). This value is between 0 and 1 and represents the overall adequacy of current security resources. The closer the value is to 0, the more strained the resources are; the closer it is to 1, the more abundant the resources are.

[0124] Sub-step 42: If the security resource sufficiency is lower than the preset degradation threshold, a security degradation operation is triggered. The security degradation operation is used to reduce the security protection strength step by step according to the preset degradation level.

[0125] In sub-step 42, if the security resource sufficiency is lower than the preset degradation threshold, a security degradation operation will be triggered. The security degradation operation is used to reduce the security protection strength step by step according to the preset degradation level.

[0126] Specifically, to avoid frequent policy switching due to instantaneous fluctuations in resource status, a delayed confirmation mechanism is implemented for both degradation triggering and recovery. The degradation trigger condition is that the security resource sufficiency level falls below the lower limit of the threshold range corresponding to the current degradation level (i.e., the preset degradation threshold) for multiple consecutive monitoring periods; the recovery condition is that the security resource sufficiency level rises above the upper limit of the threshold range corresponding to the current degradation level for multiple consecutive monitoring periods. When the degradation trigger condition is met, the system performs a tiered degradation; when the recovery condition is met, the system performs a step-by-step recovery. As an example, the multiple monitoring periods corresponding to degradation can be three consecutive monitoring periods, each lasting 5 seconds, for a total of 15 seconds; the multiple monitoring periods corresponding to recovery can be six consecutive monitoring periods, each lasting 5 seconds, for a total of 30 seconds.

[0127] In one example, four degradation levels can be defined, arranged from highest to lowest security protection strength as follows: DL0 Full Protection: When SRB_index continuously falls within the ample range [0.5, 1.0], it is DL0 full protection, guaranteeing all 5 security attributes; DL1 Priority Protection: When SRB_index continuously falls within the normal range [0.3, 0.5), DL1 degradation is triggered to ensure confidentiality, integrity, and authentication, while relaxing non-repudiation and availability. DL2 core protection: When SRB_index continuously falls into the stress range [0.15, 0.3), DL2 degradation is triggered to ensure integrity and authentication, and confidentiality is downgraded, such as by using lightweight encryption or CRC, while sacrificing non-repudiation and availability. DL3 Emergency Protection: When SRB_index continuously falls into the extremely stressful range [0, 0.15), DL3 degradation is triggered, ensuring only integrity, such as using CRC32 verification, while all other attributes are abandoned.

[0128] It should be added that security downgrades follow strict rules: 1. Degradation must be done step by step, and skipping levels is not allowed: Degradation can only be done step by step from DL0 to DL1 to DL2 to DL3, and cannot be done directly from DL0 to DL3; 2. Restore step by step: Restore step by step from DL3→DL2→DL1→DL0, and do not skip levels; 3. Special protection for sensitive data: For target data with a sensitivity level of L3 or above, the level can only be reduced to DL1 at the lowest; for target data of level L4, downgrading is not allowed and DL0 must be maintained. 4. Handling extreme cases: If resources are insufficient to maintain the DL0 of L4 target data, special measures will be taken, namely, offloading part of the security computation of L4 target data to the cloud, and at the same time downgrading low-sensitivity data to release resources.

[0129] Each downgrade event is logged in detail, including the time, downgrade level, triggering reason, affected data range, and risk assessment, and reported to the cloud in real time. This security downgrade mechanism ensures that core security attributes are protected even when resources are scarce, and the downgrade process is predictable, recoverable, and traceable. It overcomes the problems of existing technologies that lack a guaranteed security downgrade path and pose a security protection vacuum when resources are insufficient.

[0130] In some embodiments of this application, adjusting the security policy based on the resource state change information includes: Sub-step 51: If the budget values ​​of the multiple resource dimensions in the security resource budget information are lower than a preset threshold, determine the security protection tasks in the security policy that exceed the processing capacity of the edge computing node.

[0131] In sub-step 51, when the security resource budget of the edge computing node in one or more resource dimensions is lower than the preset threshold, security protection tasks that exceed the processing capacity of the edge computing node can be identified from the current security policy. These tasks typically include: complete certificate chain verification, abnormal behavior detection, and full audit log correlation analysis.

[0132] Among them, a security resource budget below a preset threshold may be due to insufficient CPU or memory budget to support certain computationally intensive security operations. For example, a complete certificate chain verification requires thousands of CPU cycles and a large amount of memory, while abnormal behavior detection requires a large amount of historical data and complex model inference.

[0133] Sub-step 52: Send the security protection task to the cloud so that the cloud can execute the security protection task and return the execution result.

[0134] In sub-step 52, the security protection task can be sent to the cloud so that the cloud can execute the security protection task and return the execution result. Specifically, the cloud can provide the following three core supplementary capabilities: (1) Secure computation unloading Edge computing nodes can send resource-intensive operations, such as full certificate chain verification and anomaly detection digests, to the cloud. The cloud completes the computation and returns the result, while the edge node only verifies the result. For example, when an edge computing node receives a TLS certificate, it does not perform a full verification locally because this would require thousands of CPU cycles and a large amount of memory. Instead, it sends the certificate hash to the cloud, which returns the certificate validity within one second. The edge computing node then decides whether to accept the certificate based on this information.

[0135] (2) Security Verification Token (SVT) The cloud pre-generates a set of authorization tokens for edge computing nodes. Each token contains the authorization subject, authorized operation scope, validity period, and cloud signature, and is 128 bytes in size. When the edge computing node is offline, it directly checks whether the access request matches a locally cached SVT (Service Token). If they match, the request is allowed; otherwise, it is rejected. After the network is restored, the edge node uploads the SVT usage log to the cloud for in-depth auditing. Under typical configuration, valid tokens for 24 hours can cover more than 80% of offline access scenarios.

[0136] (3) Strategy cloud backup and recovery The cloud can store the complete security policy for each edge computing node. When a node restarts or the policy is lost unexpectedly, the latest security policy can be retrieved from the cloud. The cloud can also proactively push security policy updates based on the global threat situation.

[0137] As can be seen, the cloud-based collaboration mechanism enables edge computing nodes to maintain security resilience even in resource-constrained and offline scenarios, achieving effective collaboration between edge and cloud security functions and overcoming the problems of independent design and lack of collaboration mechanism in existing technologies.

[0138] In some embodiments of this application, it also includes: During the execution of the security policy, a hierarchical verification operation is performed on the incoming data operation request; wherein the hierarchical verification operation verifies the data operation request step by step according to multiple preset verification levels.

[0139] Specifically, four verification levels can be defined, from V1 to V4, with each level progressively increasing in verification depth, execution location, resource consumption, and response time. All operation requests first undergo V1 verification, and the decision to escalate to a higher verification level is based on the verification results and the sensitivity level of the data involved in the operation. The four verification levels are as follows: V1 Fast Verification: Local on the edge computing node, only data hash verification and SVT matching are performed, with extremely low resource consumption and a response time of <1ms; V2 Standard Verification: Locally performed on the edge computing node, HMAC integrity verification and ACL / RBAC access control checks are performed with low resource consumption and a response time of <10ms. V3 Deep Verification: Executed in the cloud, including complete certificate chain verification, anomaly detection model, etc., with high resource consumption and a response time of 100ms~1s; V4 forensic verification: Executed in the cloud, with full audit log correlation analysis and source tracing, consuming extremely high resources and having a response time in the minute range.

[0140] As an example, the progressive validation process can be as follows: All operation requests first undergo V1 quick verification. If V1 verification passes and the sensitivity level of the target data being operated on is not higher than L2, then execution is allowed directly.

[0141] If V1 verification passes but the sensitivity level of the target data being manipulated reaches L3, then it is upgraded to V2 standard verification. Once V2 verification passes, execution is allowed, but the operation log is marked as pending audit.

[0142] If V2 verification detects abnormal indicators, such as access patterns deviating from the baseline, it will be upgraded to V3 deep verification, where the cloud will perform full certificate chain verification and abnormal behavior analysis.

[0143] If V3 confirms a security incident, it will be upgraded to V4 forensic verification, performing full audit log correlation analysis and tracing, and triggering an alarm.

[0144] In addition, for edge offline scenarios, when the edge node is offline, V3 / V4 verification is temporarily suspended. The operation is allowed to be executed after V2 passes, but it is marked as "pending deep verification". Verification is performed after the network is restored.

[0145] For verification result caching, cloud verification results are cached at edge nodes for 5 minutes. Operations of the same pattern can directly hit the cache, avoiding repeated requests for verification from the cloud.

[0146] As can be seen, the above-mentioned hierarchical verification mechanism strikes a balance between security and efficiency. Low-level verification quickly processes regular requests, while high-level verification deeply analyzes suspicious requests, thus ensuring security while avoiding unnecessary resource consumption.

[0147] In some embodiments of this application, it also includes: Obtain security effect feedback information and resource consumption feedback information during the execution of the security policy; adjust the security configuration parameters of the edge computing node based on the security effect feedback information and the resource consumption feedback information.

[0148] Specifically, it can obtain security effect feedback information and resource consumption feedback information during the execution of security policies, that is, continuously collect two types of feedback data: Category 1: Safety and effectiveness feedback information, including but not limited to: 1. Incident incidence rate at each downgrade level; 2. The discrepancy between the actual coverage of security attributes and the information on security protection requirements; 3. The frequency and average duration of downgrade events; 4. Progressive validation upgrade rate, such as the upgrade ratio from V1 to V2, V2 to V3, and V3 to V4.

[0149] The second category: resource consumption feedback information, including but not limited to: 1. The deviation between the actual resource consumption of each secure atomic operation and the estimated cost in the resource cost matrix of the security mechanism; 2. Unused idle resources in the security resource budget information; 3. Are there bottlenecks in each resource dimension? Furthermore, based on the feedback information regarding safety effectiveness and resource consumption, the following five closed-loop adjustments can be implemented: 1. Security mechanism resource cost calibration Based on the actual measured resource consumption of secure atomic operations, the corresponding entries in the security mechanism resource cost matrix are updated. For example, if the actual CPU consumption of ChaCha20 on a certain platform is 15% higher than the estimated value, the c_cpu value is automatically corrected, and more accurate data is used for subsequent optimizations.

[0150] 2. Adjustment of the safety resource reservation ratio If one resource dimension is found to be idle for an extended period while another is underutilized (e.g., ample CPU budget but tight memory budget), the resource reservation ratio for the main business can be adjusted. For example, the memory reservation ratio can be appropriately reduced to free up more memory for security mechanisms. Conversely, if degradation is detected to be too frequent, such as more than 10 times per day, it indicates that the main business's reservation ratio may be too tight, and the reservation ratio can be appropriately reduced.

[0151] 3. Adjustment of downgrade trigger threshold The trigger threshold is dynamically adjusted based on the frequency and duration of degradation. If degradation occurs too frequently, the threshold is appropriately lowered, such as from 0.15 to 0.12, to reduce unnecessary degradation. If degradation lasts too long, such as averaging more than 5 minutes, the threshold is increased, such as from 0.15 to 0.18, to trigger degradation earlier to avoid resource exhaustion.

[0152] 4. Security attribute optimization weight adjustment Based on security incident analysis, if events related to a certain security attribute occur frequently, such as an increase in integrity breach events, the optimization weight of that attribute in the objective function is increased, making subsequent optimizations prioritize satisfying that attribute. Conversely, if an attribute has no events for a long period, its weight is appropriately reduced, freeing up resources for more pressing attributes.

[0153] 5. Security Authentication Token (SVT) Policy Optimization Based on the usage statistics of security verification tokens, adjust the token generation strategy. If the token hit rate is low, such as below 70%, narrow the authorization scope or shorten the validity period to improve security; if frequent expiration leads to excessive cloud interactions, extend the validity period, such as from 24 hours to 48 hours; if there are insufficient tokens during offline periods, increase the pre-generated quantity.

[0154] As can be seen, through the aforementioned closed-loop feedback adjustments, the entire system can continuously adapt to changes in the operating environment, constantly optimizing itself to achieve the effect of becoming more efficient and secure with use. Security mechanism resource cost calibration makes the cost matrix more accurate, security resource reservation ratio adjustment makes resource allocation more reasonable, degradation trigger threshold adjustment makes degradation decisions more precise, security attribute optimization weight adjustment makes security policies more aligned with actual threat situations, and SVT policy optimization makes access control more efficient in offline scenarios.

[0155] In this embodiment, for each security mechanism, resource cost characteristic information across multiple resource dimensions and protection capability information for multiple security attributes are obtained. The current resource status information and business resource occupancy information of the edge computing node are also obtained. Based on the current resource status information and business resource occupancy information, the security resource budget information of the edge computing node is determined. The current flow status information of the target data is obtained. Based on the attribute information and current flow status information of the target data, the required security protection information for the target data is determined. Based on the security resource budget information, the security protection requirement information, the resource cost characteristic information, and the protection capability information, a target security atomic operation combination that meets preset security resource constraints is determined from the security atomic operations corresponding to the multiple security mechanisms. This yields the security policy of the edge computing node, which is then executed. This achieves the matching and execution of the optimal security mechanism combination for the edge computing node under security resource constraints. Thus, while ensuring the normal operation of the main business, differentiated optimal security protection is provided for data in different flow states, improving the edge computing node's security protection adaptability and resource utilization efficiency under resource constraints.

[0156] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.

[0157] Reference Figure 2 The diagram illustrates a structural schematic of a resource-constrained security protection device according to some embodiments of the present invention, applied to an edge computing node. The edge computing node includes various security mechanisms, specifically including the following modules: The security feature acquisition module 201 is used to acquire resource cost feature information across multiple resource dimensions and protection capability information for multiple security attributes for each security mechanism. The budget information acquisition module 202 is used to acquire the current resource status information and business resource occupancy information of the edge computing node, and determine the security resource budget information of the edge computing node based on the current resource status information and the business resource occupancy information. The requirement information determination module 203 is used to obtain the current flow status information of the target data, and determine the security protection requirement information required by the target data based on the attribute information of the target data and the current flow status information; The strategy determination module 204 is used to determine the target security atomic operation combination that meets the preset security resource constraints from the security atomic operations corresponding to the multiple security mechanisms based on the security resource budget information, the security protection requirement information, the resource cost characteristic information and the protection capability information, to obtain the security policy of the edge computing node, and to execute the security policy.

[0158] In one embodiment of this application, the security feature acquisition module 201 includes: The atomic operation determination submodule is used to determine at least one secure atomic operation corresponding to each security mechanism; wherein, the secure atomic operation is the smallest unit for implementing a single security function; The resource cost acquisition submodule is used to acquire, for each secure atomic operation, the resource consumption information of the secure atomic operation on the edge computing node in multiple resource dimensions, as the corresponding resource cost feature information; The protection capability acquisition submodule is used to acquire the matching degree value of the security atomic operation with multiple security attributes for each security atomic operation, as the corresponding protection capability information.

[0159] In one embodiment of this application, the budget information acquisition module 202 includes: The information acquisition submodule is used to acquire the current utilization information of the edge computing node in the multiple resource dimensions, as well as the preset business resource reservation ratio information; The budget information determination submodule is used to calculate the remaining proportion of resources used for security protection in the multiple resource dimensions based on the current utilization information and the preset business resource reservation ratio information, so as to obtain the security resource budget information.

[0160] In one embodiment of this application, the demand information determination module 203 includes: The circulation status acquisition submodule is used to acquire the sensitivity level information and current circulation status information of the target data; The requirement information determination submodule is used to determine the requirement intensity value of the target data for the multiple security attributes based on the sensitivity level information and the current flow status information, so as to obtain the security protection requirement information.

[0161] In one embodiment of this application, it further includes: The data monitoring module is used to monitor the flow status of the target data and determine the new security protection requirements of the target data when the flow status of the target data changes. The first strategy adjustment module is used to adjust the security strategy based on the new security protection requirements information.

[0162] In one embodiment of this application, the preset security resource constraints include at least one of the following: Mutual exclusion constraints, dependency constraints, budgeted resource constraints, and minimum safety constraints; The mutual exclusion constraint condition is that mutually exclusive safe atomic operations cannot be selected simultaneously; The dependency constraint condition is that other safe atomic operations on which the selected safe atomic operation depends are also selected. The budget value resource constraint is that the total resource consumption of the selected safe atomic operation combination across the multiple resource dimensions does not exceed the budget value of the corresponding resource dimension in the safe resource budget information; The minimum security constraint condition is that the protection capability of the selected combination of secure atomic operations against the multiple security attributes is not lower than a preset proportion of the corresponding requirement strength value in the security protection requirement information.

[0163] In one embodiment of this application, after executing the security policy, the method further includes: The second strategy adjustment module is used to obtain resource status change information of the edge computing node during the execution of the security policy, and adjust the security policy based on the resource status change information.

[0164] In one embodiment of this application, the second strategy adjustment module includes: The adequacy determination submodule is used to determine the security resource adequacy based on the budget values ​​of the security resource budget information across multiple resource dimensions; wherein, the security resource adequacy is the minimum value among the budget values ​​of the multiple resource dimensions; The degradation operation submodule is used to trigger a security degradation operation when the security resource sufficiency is lower than a preset degradation threshold. The security degradation operation is used to reduce the security protection strength step by step according to the preset degradation level.

[0165] In one embodiment of this application, the second policy adjustment module, which adjusts the security policy based on the resource status change information, includes: The task exceeding the limit submodule is used to determine the security protection task in the security policy that exceeds the processing capacity of the edge computing node when the budget value of the multiple resource dimensions in the security resource budget information is lower than a preset threshold. The cloud interaction submodule is used to send the security protection task to the cloud so that the cloud can execute the security protection task and return the execution result.

[0166] In one embodiment of this application, it further includes: The hierarchical verification module is used to perform hierarchical verification operations on incoming data operation requests during the execution of the security policy; wherein the hierarchical verification operation verifies the data operation request step by step according to multiple preset verification levels.

[0167] In one embodiment of this application, it further includes: The feedback information acquisition module is used to acquire security effect feedback information and resource consumption feedback information during the execution of the security policy. The configuration adjustment module is used to adjust the security configuration parameters of the edge computing node based on the security effect feedback information and the resource consumption feedback information.

[0168] The resource-constrained security protection device in this application embodiment can be a device, or a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. For example, mobile electronic devices can be mobile phones, tablets, laptops, PDAs, in-vehicle electronic devices, wearable devices, ultra-mobile personal computers (UMPCs), netbooks, or personal digital assistants (PDAs), etc., while non-mobile electronic devices can be servers, network-attached storage (NAS), personal computers (PCs), televisions (TVs), ATMs, or self-service machines, etc. This application embodiment does not impose specific limitations.

[0169] The resource-constrained security protection device in this application embodiment can be a device with an operating system. This operating system can be Android, iOS, or other possible operating systems; this application embodiment does not specifically limit it.

[0170] This application provides a resource-constraint-based security protection device that can achieve... Figure 1 The various processes implemented by the resource-constrained security protection method in the method embodiment are not described in detail here to avoid repetition.

[0171] In this embodiment, for each security mechanism, resource cost characteristic information across multiple resource dimensions and protection capability information for multiple security attributes are obtained. The current resource status information and business resource occupancy information of the edge computing node are also obtained. Based on the current resource status information and business resource occupancy information, the security resource budget information of the edge computing node is determined. The current flow status information of the target data is obtained. Based on the attribute information and current flow status information of the target data, the required security protection information for the target data is determined. Based on the security resource budget information, the security protection requirement information, the resource cost characteristic information, and the protection capability information, a target security atomic operation combination that meets preset security resource constraints is determined from the security atomic operations corresponding to the multiple security mechanisms. This yields the security policy of the edge computing node, which is then executed. This achieves the matching and execution of the optimal security mechanism combination for the edge computing node under security resource constraints. Thus, while ensuring the normal operation of the main business, differentiated optimal security protection is provided for data in different flow states, improving the edge computing node's security protection adaptability and resource utilization efficiency under resource constraints.

[0172] Optionally, embodiments of this application also provide an electronic device, as shown in the attached document. Figure 3 The diagram shows a hardware structure of an electronic device, including a processor 310, a memory 309, and a program or instructions stored in the memory 309 that can run on the processor 310. When the program or instructions are executed by the processor 310, they implement the various processes of the above-described resource-constrained security protection method embodiment and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0173] It should be noted that the electronic devices in the embodiments of this application include the mobile electronic devices and non-mobile electronic devices described above.

[0174] The electronic device 300 includes, but is not limited to, components such as: a radio frequency unit 301, a network module 302, an audio output unit 303, an input unit 304, a sensor 305, a display unit 306, a user input unit 307, an interface unit 308, a memory 309, and a processor 310. The user input unit 307 includes a touch panel 3071 and other input devices 3072; the display unit 306 includes a display panel 3061; and the input unit includes a graphics processor 3041 and a microphone 3042.

[0175] Those skilled in the art will understand that the electronic device 300 may also include a power supply (such as a battery) for supplying power to various components. The power supply may be logically connected to the processor 310 through a power management system, thereby enabling functions such as managing charging, discharging, and power consumption through the power management system. Figure 3 The electronic device structure shown does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown, or combine certain components, or have different component arrangements, which will not be elaborated here.

[0176] This application also provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the various processes of the above-described resource-constrained security protection method embodiments and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0177] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0178] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0179] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0180] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0181] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A security protection method based on resource constraints, characterized in that, Applied to edge computing nodes, the edge computing nodes include multiple security mechanisms, and the method includes: For each security mechanism, acquire resource cost characteristics across multiple resource dimensions, as well as protection capabilities against various security attributes; Obtain the current resource status information and service resource occupancy information of the edge computing node, and determine the security resource budget information of the edge computing node based on the current resource status information and the service resource occupancy information; Obtain the current flow status information of the target data, and determine the security protection requirements of the target data based on the attribute information of the target data and the current flow status information; Based on the security resource budget information, the security protection requirement information, the resource cost characteristic information, and the protection capability information, a target security atomic operation combination that meets the preset security resource constraints is determined from the security atomic operations corresponding to the various security mechanisms, the security policy of the edge computing node is obtained, and the security policy is executed.

2. The method according to claim 1, characterized in that, For each security mechanism, resource cost characteristics across multiple resource dimensions and protection capabilities against various security attributes are obtained, including: For each security mechanism, at least one security atomic operation corresponding to the security mechanism is determined; wherein, the security atomic operation is the smallest unit for implementing a single security function; For each secure atomic operation, the resource consumption information of the secure atomic operation on the edge computing node in multiple resource dimensions is obtained as the corresponding resource cost feature information; For each secure atomic operation, the matching degree value of the secure atomic operation with multiple security attributes is obtained as the corresponding protection capability information.

3. The method according to claim 1, characterized in that, The step of obtaining the current resource status information and service resource occupancy information of the edge computing node, and determining the security resource budget information of the edge computing node based on the current resource status information and the service resource occupancy information, includes: Obtain the current utilization information of the edge computing node across multiple resource dimensions, as well as the preset business resource reservation ratio information; Based on the current utilization information of the multiple resource dimensions and the preset business resource reservation ratio information, the remaining ratio of resources used for security protection in the multiple resource dimensions is calculated respectively to obtain the security resource budget information.

4. The method according to claim 1, characterized in that, The process of acquiring the current flow status information of the target data and determining the security protection requirements of the target data based on the attribute information of the target data and the current flow status information includes: Obtain the sensitivity level information and current flow status information of the target data; Based on the sensitivity level information and the current flow status information, the required intensity value of the target data for the multiple security attributes is determined, and the security protection requirement information is obtained.

5. The method according to claim 4, characterized in that, Also includes: The flow status of the target data is monitored, and if the flow status of the target data changes, new security protection requirements for the target data are determined. Based on the new security protection requirements, the security strategy is adjusted.

6. The method according to claim 2, characterized in that, The preset security resource constraints include at least one of the following: Mutual exclusion constraints, dependency constraints, budgeted resource constraints, and minimum safety constraints; The mutual exclusion constraint condition is that mutually exclusive safe atomic operations cannot be selected simultaneously; The dependency constraint condition is that other safe atomic operations on which the selected safe atomic operation depends are also selected. The budget value resource constraint is that the total resource consumption of the selected safe atomic operation combination across the multiple resource dimensions does not exceed the budget value of the corresponding resource dimension in the safe resource budget information; The minimum security constraint condition is that the protection capability of the selected combination of secure atomic operations against the multiple security attributes is not lower than a preset proportion of the corresponding requirement strength value in the security protection requirement information.

7. The method according to claim 1, characterized in that, After implementing the security policy, the following is also included: During the execution of the security policy, information on resource status changes of the edge computing node is obtained, and the security policy is adjusted based on the information on resource status changes.

8. The method according to claim 7, characterized in that, The adjustment of the security policy based on the resource status change information includes: Based on the budget values ​​of the security resource budget information across the multiple resource dimensions, the security resource adequacy is determined; wherein, the security resource adequacy is the minimum value among the budget values ​​across the multiple resource dimensions. When the security resource sufficiency is lower than a preset degradation threshold, a security degradation operation is triggered. The security degradation operation is used to reduce the security protection strength step by step according to the preset degradation level.

9. A security protection device based on resource constraints, characterized in that, Applied to edge computing nodes, the edge computing nodes including multiple security mechanisms, the device includes: The security feature acquisition module is used to acquire resource cost feature information across multiple resource dimensions and protection capability information for various security attributes for each security mechanism. The budget information acquisition module is used to acquire the current resource status information and business resource occupancy information of the edge computing node, and determine the security resource budget information of the edge computing node based on the current resource status information and the business resource occupancy information. The requirement information determination module is used to obtain the current flow status information of the target data, and determine the security protection requirement information required by the target data based on the attribute information of the target data and the current flow status information. The strategy determination module is used to determine the target security atomic operation combination that meets the preset security resource constraints from the security atomic operations corresponding to the multiple security mechanisms based on the security resource budget information, the security protection requirement information, the resource cost characteristic information, and the protection capability information, to obtain the security policy of the edge computing node, and to execute the security policy.

10. An electronic device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements the method as described in any one of claims 1 to 8.

11. A readable storage medium, characterized in that, A computer program is stored on the readable storage medium, which, when executed by a processor, implements the method as described in any one of claims 1 to 8.

Images