CDN service orchestration method and apparatus in multi-cloud environment, device, and storage medium

Abstract

The present disclosure provides a content delivery network (CDN) service orchestration method and apparatus in a multi-cloud environment, a device, and a storage medium. The method comprises: receiving a first orchestration script, wherein the first orchestration script is used for orchestrating CDN services provided by a plurality of target objects; performing verification and attestation on the first orchestration script in a trusted execution environment; generating, in the trusted execution environment, a unique verification code corresponding to a second orchestration script, wherein the second orchestration script is an orchestration script, which is successfully verified, from among the first orchestration script; transmitting the second orchestration script to a specified target object, and receiving an orchestration execution result returned by the specified target object; and transmitting the orchestration execution result and the unique verification code to the sender of the first orchestration script.

Description

CDN service orchestration method, device, equipment and storage medium in a multi-cloud environment

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to Chinese patent application number 202410330258.1, filed on March 21, 2024, entitled “CDN service orchestration method, apparatus, device and storage medium in a multi-cloud environment”, the entire contents of which are incorporated herein by reference. Technical Field

[0003] The present disclosure relates to the field of cloud computing, and in particular to a CDN service orchestration method, apparatus, device, and storage medium in a multi-cloud environment. Background Art

[0004] With the development of internet technology, Content Delivery Network (CDN) technology has become a key technology for improving network performance. Currently, when using CDN services, users typically choose a multi-cloud solution, using CDN services from multiple cloud providers. This allows users to indirectly orchestrate CDN services from multiple cloud providers. Summary of the Invention

[0005] In view of this, one or more embodiments of the present disclosure provide a CDN service orchestration method, apparatus, device, and storage medium in a multi-cloud environment, which can improve the transparency and credibility of the CDN service orchestration process.

[0006] The present disclosure provides a CDN service orchestration method in a multi-cloud environment, the method comprising:

[0007] Receive a first orchestration script, where the first orchestration script is used to orchestrate a content delivery network (CDN) service provided by a plurality of target objects;

[0008] Verifying and storing the first orchestration script in a trusted execution environment;

[0009] Generating a unique verification code corresponding to a second orchestration script in the trusted execution environment; wherein the second orchestration script is an orchestration script that has been successfully verified in the first orchestration script;

[0010] transmitting the second orchestration script to a designated target object, and receiving an orchestration execution result returned by the designated target object;

[0011] The orchestration execution result and the unique verification code are transmitted to the sender of the first orchestration script.

[0012] Another aspect of the present disclosure provides a CDN service orchestration device in a multi-cloud environment, characterized in that the device includes:

[0013] A first receiving module is configured to receive a first orchestration script, where the first orchestration script is configured to orchestrate a content delivery network (CDN) service provided by a plurality of target objects;

[0014] A verification module, configured to verify and store the first orchestration script in a trusted execution environment;

[0015] a code generation module, configured to generate a unique verification code corresponding to a second orchestration script in the trusted execution environment; wherein the second orchestration script is an orchestration script that has been successfully verified among the first orchestration scripts;

[0016] A first sending module, configured to transmit the second orchestration script to a designated target object;

[0017] A second receiving module is configured to receive the orchestration execution result returned by the specified target object;

[0018] The second sending module is configured to transmit the orchestration execution result and the unique verification code to a sender of the first orchestration script.

[0019] On the other hand, the present disclosure further provides an electronic device, which includes a memory and a processor, wherein the memory is used to store a computer program, and when the computer program is executed by the processor, the CDN service orchestration method in the multi-cloud environment is implemented.

[0020] On the other hand, the present disclosure further provides a computer-readable storage medium for storing a computer program. When the computer program is executed by a processor, the computer program implements the above-mentioned CDN service orchestration method in a multi-cloud environment.

[0021] One or more embodiments of the present disclosure provide a technical solution whereby a multi-cloud service can verify and store evidence of a first orchestration script within a trusted execution environment, ensuring the credibility of the first orchestration script. The multi-cloud service can also generate a unique verification code corresponding to a second orchestration script within the trusted execution environment, ensuring the credibility of the unique verification code. The unique verification code can serve as evidence to ensure the credibility of the second orchestration script. The stored evidence includes the results and the content of the unique verification code. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The features and advantages of the various embodiments of the present disclosure will be more clearly understood by referring to the accompanying drawings, which are schematic and should not be construed as limiting the present disclosure in any way. In the accompanying drawings:

[0023] FIG1 is a schematic diagram showing the steps of a CDN service orchestration method in a multi-cloud environment in one embodiment of the present disclosure;

[0024] FIG2 shows a flowchart of verifying and storing a first orchestration script in one embodiment of the present disclosure;

[0025] FIG3 shows a flowchart of generating a unique verification code corresponding to a second orchestration script by using a user access key in one embodiment of the present disclosure;

[0026] FIG4 shows a schematic diagram of functional modules of a CDN service orchestration device in a multi-cloud environment in one embodiment of the present disclosure;

[0027] FIG5 shows a schematic structural diagram of a computer device in one embodiment of the present disclosure. DETAILED DESCRIPTION

[0028] To make the purpose, technical solutions, and advantages of the embodiments of the present disclosure more clear, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making any creative efforts shall fall within the scope of protection of the present disclosure.

[0029] Existing methods for orchestrating CDN services across multiple cloud services suffer from low transparency and limited reliability. This makes it difficult for users to audit the orchestration of multiple cloud services. When CDN services don't perform as expected, users struggle to determine whether the issue lies with the cloud service provider or the multiple cloud services.

[0030] In view of this, a more transparent and trustworthy CDN service orchestration method in a multi-cloud environment is currently needed. The technical solution provided by one or more embodiments of the present disclosure can ensure that the orchestration behavior of the multi-cloud service is trustworthy and transparent when users use the multi-cloud service to orchestrate content distribution network services provided by multiple cloud service providers.

[0031] Referring to FIG. 1 , an embodiment of the present disclosure provides a CDN service orchestration method in a multi-cloud environment, which may include the following steps.

[0032] S1: Receive a first orchestration script, where the first orchestration script is used to orchestrate a content delivery network service provided by multiple target objects.

[0033] In this embodiment, the multiple target objects refer to multiple cloud service providers, which may also be referred to as public Infrastructure as a Service (IaaS) providers. Orchestrating a content delivery network service may be a process of using automated tools to manage and configure content delivery network resources.

[0034] Orchestration scripts are executable files used to automate the configuration, management, and coordination of computer systems, applications, and services. In cloud service environments, developers and system administrators can use orchestration scripts to automate complex tasks, such as deploying and managing content delivery network services. Orchestration scripts can also be declarative, specifying the desired end state of the orchestrated object.

[0035] Specifically, cloud service providers offer open application programming interfaces (APIs), enabling users to programmatically control and manage cloud resources. Users can use Infrastructure as Code (IaC) tools to write orchestration scripts and define the required cloud resources. IaC tools read these orchestration scripts and convert them into application programming interfaces (APIs) for invocation, creating and managing cloud resources at the cloud service provider. These cloud resources can include content delivery network resources.

[0036] In a practical application example, the first orchestration script can be implemented using the IaC tool Terraform. Users can use the declarative configuration language HCL (HashiCorp Configuration Language) to define and manage various cloud services and cloud resources to achieve automated deployment and management of cloud infrastructure. The first orchestration script can define the cloud resources provided by a cloud service provider, including its origin, caching behavior, pricing policy, and geographical restrictions. When the first orchestration script is run, Terraform ensures that the configuration of cloud resources in each cloud service provider matches the state defined in the script. If the current state of a cloud resource is inconsistent with the state defined in the script, Terraform can perform the necessary operations to bring it to the state defined in the script.

[0037] In this embodiment, the user service can complete the editing of the first orchestration script, and the multi-cloud service can receive the first orchestration script sent by the user service and perform subsequent steps.

[0038] In this embodiment, during the process of the multi-cloud service receiving the first orchestration script sent by the user service, the method of transmitting the first orchestration script includes but is not limited to application program interface calls, using command line tools, using continuous integration / continuous deployment tools, direct file transfer, using infrastructure as code tools, using version control systems, through cloud management platforms, etc.

[0039] Optionally, when transmitting the first orchestration script via an application programming interface (API) call, the user service may upload the orchestration script using an API provided by the multi-cloud service. This process may be accomplished via an HTTPS request using a RESTful API or a specific software development kit (SDK).

[0040] Optionally, when the first orchestration script is transmitted using a command line tool, the user service may use the command line tool to execute the first orchestration script and communicate with an application program interface provided by the multi-cloud service.

[0041] Optionally, when using a continuous integration / continuous deployment tool to transmit the first orchestration script, the user service may use a continuous integration / continuous deployment tool such as Jenkins, GitLab CI, or GitHub Actions to automatically upload the first orchestration script.

[0042] Optionally, when the first orchestration script is transferred by direct file transfer, the user service may use a standard file transfer protocol such as SFTP or SCP to securely upload the first orchestration script to the multi-cloud service.

[0043] Optionally, when the first orchestration script is transferred using an infrastructure as a code tool, the user service may use an IaC tool such as Terraform or Ansible to directly transfer the first orchestration script from a local or version control system.

[0044] Optionally, when using a version control system to transmit the first orchestration script, the user service may use a version control system such as Git or SVN to store and version the first orchestration script, and the multi-cloud service may directly pull the latest version of the script from these version control systems.

[0045] Optionally, when the first orchestration script is transmitted through a cloud management platform, some enterprise-level cloud management platforms support multi-cloud management, and users can deploy and manage orchestration scripts through a unified interface.

[0046] In this embodiment, the process of deploying and managing content delivery network resources is automated and efficient through the first orchestration script. In a multi-cloud environment, users can combine services from multiple cloud service providers, improving the flexibility and reliability of the content delivery network.

[0047] S2: Verify and store the first orchestration script in a trusted execution environment.

[0048] In this embodiment, the Trusted Execution Environment (TEE) can load the code and data involved in the calculation into a trusted environment protected by the CPU based on the hardware security mechanism, providing protection in terms of confidentiality and integrity. The TEE can have a higher level of security than the operating system and can process sensitive data. The TEE in this embodiment can be based on the X86 instruction set architecture or the ARM instruction set architecture. In this embodiment, because the TEE provides a secure environment, the execution security of the first orchestration script can be guaranteed even on an untrusted operating system.

[0049] In this embodiment, verifying and documenting the first orchestration script may be performing identity authentication on the first orchestration script and recording the process and result of the identity authentication.

[0050] Authenticating the first orchestration script may check whether the first orchestration script is issued by a trusted source, and may be implemented by verifying a digital signature.

[0051] Specifically, the sender of the first orchestration script can sign the first orchestration script using a private signature key before sending it. The recipient of the first orchestration script can use the corresponding public signature key to verify the validity of the signature. Successful signature verification indicates successful authentication of the first orchestration script, proving that the first orchestration script has not been tampered with. The process and results of authenticating the first orchestration script can be recorded and stored in the trusted execution environment. The process and results of authenticating the first orchestration script can include the process and results of verifying the digital signature.

[0052] If the first orchestration script fails to pass authentication, a specific reason for the authentication failure may be recorded in the trusted execution environment.

[0053] In this embodiment, verifying and documenting the first orchestration script may be performing a security audit on the first orchestration script and recording the process and results of the security audit.

[0054] A security audit is performed on the first orchestration script to check whether the first orchestration script contains malicious code or operations. This can be implemented through static code analysis, dependency checking, and runtime behavior monitoring.

[0055] Specifically, a series of security checks can be performed directly on the first orchestration script, while recording the details and results of these checks, such as the results of static code analysis, dependency checking, and any security issues found. The first orchestration script can also be executed as a test, with detailed records of the execution process, including the time execution began, the specific steps executed, any exceptions or errors that occurred, and the time execution completed. If, after performing the security check using the above method, no security issues are found in the first orchestration script, or if the number and severity of security issues do not reach a preset upper limit, the first orchestration script can be confirmed to have passed the security audit.

[0056] If the first orchestration script fails the security audit, a specific reason for the security audit failure may be recorded in the trusted execution environment.

[0057] In this embodiment, verifying and documenting the first orchestration script may include performing an executable test on the first orchestration script and recording the process and results of the executable test.

[0058] Performing an executability test on the first orchestration script can check whether the first orchestration script runs according to its design purpose.

[0059] Specifically, the output of the first orchestration script after executing the test can be recorded, including the script's return status, generated data, affected resources, and any output log information. The output results can be compared with the design goals of the first orchestration script to determine whether the first orchestration script has achieved the expected results. System status and environmental information during the execution of the first orchestration script, such as CPU usage, memory usage, and network status, can also be recorded to analyze the efficiency and reliability of the first orchestration script. If the above method is used to perform the executable test, when the various indicators of the test results meet the preset conditions, the first orchestration script is confirmed to have passed the executable test.

[0060] If the first orchestration script fails the executable test, a specific reason for the executable test failure may be recorded in the trusted execution environment.

[0061] In some implementations, the verification and evidence storage of the first orchestration script may include one or more of identity verification, security auditing, and feasibility testing, as well as other verification and evidence storage activities. The rigor and specific steps of the verification process may vary depending on the actual implementation details and security requirements.

[0062] In some implementations, the first orchestration script is verified and stored, and the resulting records can be used to form a continuous audit chain that can be used to prove the legitimacy and security of the first orchestration script. The verification and storage process is performed in a trusted execution environment, ensuring the immutability of the audit chain.

[0063] In some embodiments, referring to FIG2 , the process of verifying the first orchestration script in a trusted execution environment can be automated. Only when the first orchestration script passes the previous verification phase will the next verification phase begin. When all verification phases pass, the subsequent steps are executed. If a verification phase of the first orchestration script fails, execution of the subsequent verification phase or steps of the first orchestration script is interrupted, and a verification report is generated indicating the cause of the verification failure. Optionally, the verification report can be in the form of an indicative error code or text with detailed explanations.

[0064] S3: Generate a unique verification code corresponding to a second orchestration script in the trusted execution environment; wherein the second orchestration script is an orchestration script that has been successfully verified among the first orchestration scripts.

[0065] In this embodiment, after receiving the first orchestration script sent by the user service, the multi-cloud service can verify the first orchestration script in the trusted execution environment, mark the first orchestration script after successful verification as the second orchestration script, and generate a unique verification code corresponding to the second orchestration script in the trusted execution environment. The content and format of the second orchestration script can be the same as the first orchestration script.

[0066] In this embodiment, the unique verification code corresponding to the second orchestration script may include but is not limited to the following: an identity identifier of an access key corresponding to the second orchestration script, a timestamp of creation or execution request of the second orchestration script, a name or identity identifier of the second orchestration script, a hash value of the content of the second orchestration script, and a hash value of the second orchestration script carrying a user signature.

[0067] Specifically, the second orchestrated script can be authenticated and obtain execution permissions in a trusted execution environment using an access key. The unique verification code can include the identity of the access key. The timestamp of the creation or execution request of the second orchestrated script, the name or identity of the second orchestrated script, and other information can help categorize and query the second orchestrated script. These information can be included in the unique verification code. A first hash value of the second orchestrated script content can be used to prove that the second orchestrated script has not been tampered with during transmission. The unique verification code can include the first hash value. The first hash value can be a hash value. Before sending the second orchestrated script, the sender of the second orchestrated script can sign the second orchestrated script using a private signing key. A hash algorithm can be run on the second orchestrated script carrying the user's signature to obtain a second hash value. The second hash value included in the unique verification code can be used to verify the script's source and integrity. The hash algorithm can be a hash algorithm, and the second hash value can be a hash value.

[0068] In one embodiment, generating a unique verification code corresponding to the second orchestration script in the trusted execution environment may be performed using a user's access key.

[0069] Specifically, referring to Figure 3, before sending the first orchestration script, the user service can encrypt the first orchestration script using its own private signature key and transmit the encrypted first orchestration script and the access key's identity to the multi-cloud service. In the trusted execution environment, the multi-cloud service can authenticate the first orchestration script and grant execution permissions based on the access key's identity verification and the signature public key stored in the multi-cloud service. Furthermore, the multi-cloud service can decrypt the second orchestration script using the signature public key stored in the multi-cloud service, obtain the specific content of the second orchestration script, and generate a unique verification code corresponding to the second orchestration script based on the specific content of the second orchestration script.

[0070] S4: Transmit the second orchestration script to a designated target object, and receive an orchestration execution result returned by the designated target object.

[0071] In this embodiment, after generating a unique verification code in the trusted execution environment, the multi-cloud service can transmit the second orchestration script to the target objects specified by the second orchestration script. The specified target objects can be multiple cloud service providers. After receiving the second orchestration script, each cloud service provider can execute the second orchestration script, deploy and manage its own content delivery network service, and send the orchestration execution results back to the multi-cloud service.

[0072] In this embodiment, the orchestration execution result returned by the designated target object may have multiple possibilities, including but not limited to successful execution of the second orchestration script, failure to execute the second orchestration script, security issues in the second orchestration script, incompleteness of the second orchestration script, etc.

[0073] In some implementations, when the second orchestration script is successfully executed, the orchestration execution result may include an operation record and resource call information.

[0074] Specifically, the operation record may include the time when the script begins executing, the specific execution steps, and the time when the execution is completed. The operation record may also include the time when the key code in the script begins executing, the specific execution steps, and the time when the execution is completed. The operation record may also include the intermediate output and final output generated after the script is executed. Resource call information may include system resource call information and network resource call information, such as CPU usage, memory usage, network status, etc. Resource call information may include the initial snapshot, intermediate snapshots, and final snapshots of the resource status.

[0075] In some implementations, when the second orchestration script fails to execute, the orchestration execution result may include the failure reason and diagnostic information.

[0076] Specifically, the failure cause may include the time when the script starts executing, the specific steps of execution, the steps that failed to execute, and the timestamp of the failed step. The failure cause may include the time when the key code in the script starts executing, the specific steps of execution, the steps that failed to execute, and the timestamp of the failed step. The failure cause may include the identification information of the failed step and the location information of the failed step in the script. Diagnostic information may be a summary result after script diagnosis, such as "error code, cannot be executed" or "exception description, cannot be identified". Diagnostic information may be a detailed analysis after script diagnosis, such as the statistical number of warnings and errors detected in the script, the meaning of each warning or error, and guidance for each warning or error. Failure causes and diagnostic information can help identify the source of the problem and can be used for troubleshooting.

[0077] In some implementations, if a security or integrity issue occurs during the execution of the second orchestration script, an alarm may be triggered, and the orchestration execution result may include the alarm information.

[0078] Specifically, a security issue may be the discovery of an unauthorized access attempt. An integrity issue may be the discovery of potential data loss in the second orchestration script. When a security alert triggered by a security or integrity issue occurs, the orchestration result may include alert information. The alert information may include the time the alert occurred, the nature of the event represented by the alert, and the severity of the event represented by the alert.

[0079] In some implementations, if the second orchestration script executes and the results do not conform to expected or established business rules, the orchestration execution results may include detailed output results and relevant discrepancy information. Furthermore, a rollback process may be performed based on the orchestration results to restore the CDN resources to a previously stable state.

[0080] In some embodiments, after the second orchestration script is executed, an abnormal usage pattern is formed. The orchestration execution results can record a log of abnormal usage or unusual activities (for example, frequent failed attempts or unusual operation time). Further, the orchestration results can be analyzed in depth, and relevant teams can be notified based on the orchestration results, and the access rights of related keys can be suspended based on the orchestration results.

[0081] S5: Transmit the orchestration execution result and the unique verification code to the sender of the first orchestration script.

[0082] In this embodiment, the multi-cloud service can send the returned second orchestration script execution result and the unique verification code corresponding to the second orchestration script to the user service. The user service can use the orchestration execution result and the unique verification code to audit whether the multi-cloud service effectively processes the orchestration script and whether the cloud service provider provides content network distribution services as required.

[0083] As can be seen from the descriptions of the various implementations above, the technical solutions provided by this disclosure can ensure the credibility and transparency of multi-cloud services when users indirectly orchestrate content delivery network services provided by multiple cloud service providers through multi-cloud services. The technical solutions provided by this disclosure can also audit the orchestration of multi-cloud services. When content delivery network services fail to perform as expected, the technical solutions provided by this disclosure can help identify the cause.

[0084] Referring to FIG4 , an embodiment of the present disclosure further provides a CDN service orchestration device in a multi-cloud environment, the device comprising:

[0085] A first receiving module 100 is configured to receive a first orchestration script, wherein the first orchestration script is configured to orchestrate a content delivery network service provided by a plurality of target objects;

[0086] A verification module 200, configured to verify and store the first orchestration script in a trusted execution environment;

[0087] A code generation module 300 is configured to generate a unique verification code corresponding to a second orchestration script in the trusted execution environment; wherein the second orchestration script is an orchestration script that has been successfully verified in the first orchestration script;

[0088] A first sending module 400 is configured to transmit the second orchestration script to a designated target object;

[0089] The second receiving module 500 is configured to receive the orchestration execution result returned by the designated target object;

[0090] The second sending module 600 is configured to transmit the orchestration execution result and the unique verification code to the sender of the first orchestration script.

[0091] In one embodiment, the verification module 200 is further configured to interrupt execution of the first orchestration script when the first orchestration script fails to be verified, and generate a verification report indicating a reason for the verification failure.

[0092] In one embodiment, the code generation module 300 is further configured to generate a unique verification code corresponding to the second orchestration script after decrypting the second orchestration script using the signature public key in the trusted execution environment; wherein the second orchestration script is encrypted by the sender of the second orchestration script using the signature private key before sending the second orchestration script.

[0093] In one embodiment, the verification module 200 is specifically configured to authenticate the first orchestration script and record the authentication process and results;

[0094] In one embodiment, the verification module 200 is specifically configured to perform a security audit on the first orchestration script and record the process and results of the security audit;

[0095] In one embodiment, the verification module 200 is specifically configured to perform an executable test on the first orchestration script and record the process and results of the executable test.

[0096] In one embodiment, the verification module 200 is specifically configured to perform static code analysis on the first orchestration script; perform dependency checking on the first orchestration script; and perform running behavior monitoring on the first orchestration script.

[0097] In one embodiment, the code generation module 300 is specifically used to generate a unique verification code corresponding to the second orchestration script in the trusted execution environment. The unique verification code may include at least one of the following: an identity identifier of an access key corresponding to the second orchestration script; a timestamp of creation or execution request of the second orchestration script; a name or identity identifier of the second orchestration script; a first hash value of the content of the second orchestration script; and a second hash value of the second orchestration script carrying a user signature. The user signature is created by the sender of the second orchestration script using a signature private key before sending the second orchestration script.

[0098] In one embodiment, the second receiving module 500 is specifically configured to receive the orchestration execution result returned by the specified target object. The orchestration execution result may include at least one of the following: operation records and resource call information corresponding to successful execution of the second orchestration script; failure reasons and diagnostic information corresponding to failure of the second orchestration script; and alarm information triggered when security or integrity issues occur in the second orchestration script.

[0099] Please refer to Figure 5. The present disclosure also provides a computer device, which includes a memory and a processor. The memory is used to store a computer program. When the computer program is executed by the processor, it implements the above-mentioned CDN service orchestration method in a multi-cloud environment.

[0100] The present disclosure also provides a computer-readable storage medium for storing a computer program. When the computer program is executed by a processor, the computer program implements the above-mentioned CDN service orchestration method in a multi-cloud environment.

[0101] The processor may be a central processing unit (CPU). The processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0102] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer executable programs, and modules, such as the program instructions / modules corresponding to the methods in the embodiments of the present disclosure. The processor executes the non-transitory software programs, instructions, and modules stored in the memory to perform various processor functions and data processing, thereby implementing the methods in the aforementioned method embodiments.

[0103] The memory may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created by the processor, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-transitory memory, such as at least one disk storage device, a flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory may optionally include a memory remotely located relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0104] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the above-mentioned embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD), or a solid-state drive (SSD). The storage medium can also include a combination of the above-mentioned types of memory.

[0105] The various embodiments in this specification are described in a progressive manner. Similar portions between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from the other embodiments. In particular, the device and apparatus embodiments are generally similar to the method embodiments, so their descriptions are relatively simplified. For relevant portions, reference can be made to the descriptions of the method embodiments.

[0106] The foregoing is merely an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

[0107] Although the embodiments of the present disclosure have been described with reference to the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present disclosure, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A CDN service orchestration method in a multi-cloud environment, comprising: Receive a first orchestration script, where the first orchestration script is used to orchestrate a content delivery network (CDN) service provided by a plurality of target objects; Verifying and storing the first orchestration script in a trusted execution environment; Generating a unique verification code corresponding to a second orchestration script in the trusted execution environment; wherein the second orchestration script is an orchestration script that has been successfully verified in the first orchestration script; transmitting the second orchestration script to a designated target object, and receiving an orchestration execution result returned by the designated target object; The orchestration execution result and the unique verification code are transmitted to the sender of the first orchestration script.

2. The method according to claim 1, wherein the verifying and storing the first orchestration script comprises at least one of the following: Authenticating the first orchestration script, and recording the authentication process and results; Performing a security audit on the first orchestration script, and recording the process and results of the security audit; Perform an executable test on the first orchestration script, and record the process and results of the executable test.

3. The method according to claim 2, wherein the performing a security audit on the first orchestration script comprises at least one of the following: Performing static code analysis on the first orchestration script; Performing dependency checking on the first orchestration script; The running behavior of the first orchestration script is monitored.

4. The method according to claim 1, wherein verifying and storing the first orchestration script comprises: When the verification of the first orchestration script fails, execution of the first orchestration script is interrupted, and a verification report indicating a reason for the verification failure is generated.

5. The method according to claim 1, wherein generating a unique verification code corresponding to the second orchestration script in the trusted execution environment comprises: The second orchestration script is encrypted by the sender of the second orchestration script using a signature private key before sending the second orchestration script; After decrypting the second orchestration script using the signed public key in the trusted execution environment, a unique verification code corresponding to the second orchestration script is generated.

6. The method according to any one of claims 1 to 5, wherein the unique verification code corresponding to the second orchestration script comprises at least one of the following: The identity of the access key corresponding to the second orchestration script; a timestamp of when the second orchestration script is created or requested to be executed; The name or identity of the second arrangement script; a first hash value of the content of the second orchestration script; A second hash value of the second orchestration script carrying the user's signature; wherein, The user signature is created by the sender of the second orchestration script using a signature private key before sending the second orchestration script.

7. The method according to claim 1, wherein the orchestration execution result comprises at least one of the following: The corresponding operation record and resource call information when the second orchestration script is successfully executed; The failure reason and diagnostic information corresponding to the failure of the second orchestration script execution; Alarm information is triggered when a security or integrity problem occurs in the second orchestration script.

8. A CDN service orchestration device in a multi-cloud environment, comprising: A first receiving module is configured to receive a first orchestration script, where the first orchestration script is configured to orchestrate a content delivery network (CDN) service provided by a plurality of target objects; A verification module, configured to verify and store the first orchestration script in a trusted execution environment; a code generation module, configured to generate a unique verification code corresponding to a second orchestration script in the trusted execution environment; wherein the second orchestration script is an orchestration script that has been successfully verified among the first orchestration scripts; A first sending module, configured to transmit the second orchestration script to a designated target object; A second receiving module is configured to receive the orchestration execution result returned by the specified target object; The second sending module is configured to transmit the orchestration execution result and the unique verification code to a sender of the first orchestration script.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images