Edge server-based method and apparatus for scheduling network request, cluster, and medium

Abstract

The present disclosure relates to the technical field of edge clouds, and discloses an edge server-based method and apparatus for scheduling a network request, a cluster, and a medium. The edge server-based method for scheduling a network request comprises: acquiring a network request sent by a client; in a trusted execution environment, according to a preset scheduling policy, forwarding the network request to a target application server among a plurality of preset application servers; and receiving a response result of the target application server for the network request, and forwarding the response result to the client.

Description

Edge server-based network request scheduling method, device, cluster, and medium

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on March 21, 2024, with application number 202410330034.0 and invention name “Network request scheduling method, device, cluster and medium based on edge server”, the entire contents of which are incorporated by reference into this application. Technical Field

[0003] The present disclosure relates to the field of edge cloud technology, and in particular to a network request scheduling method, device, cluster, and medium based on an edge server. Background Art

[0004] With the development of edge cloud technology, the number of edge data centers and the edge servers deployed within them has increased significantly. Unlike central data centers in central cloud technology scenarios, edge servers within edge data centers are vulnerable to malware or attackers, and their security performance is often not guaranteed. Once attacked, malicious attacks can affect the normal operation of edge servers. Summary of the Invention

[0005] In view of this, the present disclosure provides a network request scheduling method, device, cluster and medium based on an edge server to solve the problem that an edge server under malicious attack in an edge computer room has difficulty in scheduling network requests.

[0006] In a first aspect, the present disclosure provides a network request scheduling method based on an edge server. The network request scheduling method based on the edge server is applied to an edge server configured with a trusted execution environment. The operating system and application program running space on the edge server are isolated from the trusted execution environment. The network request scheduling method based on the edge server includes:

[0007] Get the network request sent by the client;

[0008] In a trusted execution environment, the network request is forwarded to a target application server among a plurality of preset application servers according to a preset scheduling policy;

[0009] Receive the target application server's response to the network request and forward the response to the client.

[0010] The present disclosure can schedule network requests according to a preset scheduling policy in a trusted execution environment in an edge server, and forward the response results of the target application server to the network request to the client; compared with related technologies, the solution provided by the present disclosure is not affected even if the edge server is attacked by malicious attacks. The present disclosure can still ensure the normal scheduling of network requests based on a trusted execution environment isolated from the operating system and application programs.

[0011] In a second aspect, the present disclosure provides an edge server-based network request scheduling device, which is deployed on an edge server configured with a trusted execution environment. The operating system and application program execution space on the edge server are isolated from the trusted execution environment. The edge server-based network request scheduling device includes:

[0012] Request acquisition module, used to obtain network requests sent by the client;

[0013] A request scheduling module is used to forward the network request to a target application server among multiple preset application servers according to a preset scheduling policy in a trusted execution environment;

[0014] The request response module is used to receive the response result of the target application server to the network request and to forward the response result to the client.

[0015] In a third aspect, the present disclosure provides a cluster comprising an edge server and multiple preset application servers, wherein the multiple preset application servers are respectively communicatively connected to the edge server; the edge server comprises a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to execute the network request scheduling method based on the edge server according to the first aspect or any corresponding embodiment thereof.

[0016] In a fourth aspect, the present disclosure provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the edge server-based network request scheduling method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the specific embodiments of the present disclosure or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0018] FIG1 is a flow chart of a network request scheduling method based on an edge server according to an embodiment of the present disclosure;

[0019] FIG2 is a flow chart of another method for scheduling network requests based on an edge server according to an embodiment of the present disclosure;

[0020] FIG3 is a flow chart of another method for scheduling network requests based on an edge server according to an embodiment of the present disclosure;

[0021] FIG4 is a flow chart of another method for scheduling network requests based on an edge server according to an embodiment of the present disclosure;

[0022] FIG5 is a structural block diagram of a network request scheduling device based on an edge server according to an embodiment of the present disclosure;

[0023] FIG6 is a schematic diagram of the hardware structure of the edge server according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0024] To make the purpose, technical solutions, and advantages of the embodiments of the present disclosure more clear, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making creative efforts shall fall within the scope of protection of the present disclosure.

[0025] In edge cloud scenarios, edge servers are servers located closer to user devices, typically at the edge of the network, and are used for data processing, storage, and transmission. Compared to traditional central cloud servers, edge servers offer lower latency and higher processing speeds. The use of edge servers allows for more flexible configuration of computing resources, better meeting the needs of real-time applications.

[0026] With the development of private cloud and edge computing, and the trend toward multi-cloud deployment, more and more application load balancing services need to be deployed in data centers or even edge data centers outside of the autonomous and controllable central cloud. Central cloud servers deployed in central data centers in central cloud scenarios are generally equipped with high-performance security protection systems, making them resilient to attacks from malware or attackers. However, edge servers deployed in edge data centers in edge cloud scenarios often have average or even poor network security to reduce deployment costs. Once an edge server is attacked, it often struggles to function properly, and in severe cases, the entire edge data center can even be paralyzed, severely impacting functions such as network request scheduling.

[0027] According to an embodiment of the present disclosure, an embodiment of a network request scheduling method based on an edge server is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0028] This embodiment provides an edge server-based network request scheduling method to address the difficulty of scheduling network requests for edge servers in edge data centers that are under malicious attack. This edge server-based network request scheduling method is applied to edge servers configured with a trusted execution environment (TEE). The operating system and application runtime on the edge server are isolated from the TEE.

[0029] Trusted Execution Environment (TEE), or trusted computing, is used in this embodiment to protect the traffic scheduling engine described below, maintaining its security and integrity even in an unsafe or attacked environment. Specifically, TEE is based on hardware security mechanisms and loads the code and data involved in the calculation into a trusted environment protected by the CPU (Central Processing Unit), providing protection in terms of confidentiality and integrity. Compared with the operating system, TEE provides a higher level of security, so TEE is more suitable for processing sensitive data.

[0030] FIG1 is a flow chart of a network request scheduling method based on an edge server according to an embodiment of the present disclosure. As shown in FIG1 , the process includes the following steps:

[0031] Step S101: Obtain a network request sent by a client.

[0032] Among them, the edge server can be connected to multiple clients, and a client can send multiple network requests to the connected edge server. For the edge server, it will receive a large number of network requests from the clients and bear the traffic brought by a large number of network requests, so load balancing traffic scheduling is required. The type of network request of the embodiment of the present disclosure is, for example, one or more of HTTP (Hypertext Transfer Protocol, Hypertext Transfer Protocol) / HTTPS (Hypertext Transfer Protocol Secure, Hypertext Transfer Secure Protocol), WebSocket (two-way network communication). It can be seen that the solution provided by the present disclosure can serve a variety of application needs. Specifically, the network request can be a request to obtain a web page, data, API (Application Programming Interface, Application Programming Interface) access or any other type of service.

[0033] In the embodiments of the present disclosure, the client involved may include but is not limited to an application client and / or a web page (web terminal) set up on an electronic device, such as a mobile application or other types of client software on an electronic device such as a smartphone, tablet computer or desktop computer, which can communicate with the edge server.

[0034] In some optional implementations, before step S101, the edge server-based network request scheduling method further includes but is not limited to the following steps a1 to a4.

[0035] Step a1: Create a trusted execution environment on the application load balancer in the edge server.

[0036] An Application Load Balancer (ALB) is a cloud service that provides automatic traffic distribution to optimize resource utilization, maximize throughput, reduce latency, and ensure fault tolerance. ALB is a key component in cloud computing services, especially in enterprise-level applications that require high availability, scalability, and security. This embodiment creates a TEE on the ALB. The TEE is a secure execution space isolated from the host operating system and other applications, protecting the programs running within it from external threats.

[0037] Step a2: verify the signature of the execution code corresponding to the preset scheduling strategy.

[0038] Among them, the signature of the execution code can be a digital signature; more specifically, the signature can be a certificate chain, from a root certificate to the final code signing certificate. TEE can be used to verify the entire certificate chain to ensure that the signature of the execution code is credible.

[0039] In this embodiment, before the executable code is deployed to the TEE, it can be signed with a secure digital signature, which usually involves using a trusted signing key (usually controlled by the software publisher or organization).

[0040] When the execution code is loaded into the TEE, the TEE startup process can include verifying the digital signature of the execution code. Only when the digital signature verification is successful will the execution code be allowed to run, which ensures that only authorized code can run.

[0041] In step a3, if the signature of the execution code passes the verification, the execution code is run in the trusted execution environment.

[0042] Specifically, this embodiment can load and run the execution code if the execution code passes security verification, that is, load the traffic scheduling logic in the TEE in the edge server. The scheduling logic is a program specifically used to decide how to allocate and forward inbound traffic to different preset application servers.

[0043] In step a4, if the signature of the execution code fails to pass the verification, the execution code is denied from running in the trusted execution environment.

[0044] This embodiment further ensures that the code or program running in the TEE in the edge server is secure by performing signature verification on the code used to implement the traffic scheduling function, thereby improving the security of traffic scheduling.

[0045] Step S102 : forwarding the network request to a target application server among a plurality of preset application servers in a trusted execution environment according to a preset scheduling policy.

[0046] Wherein, a plurality of preset application servers are respectively communicated and connected with the edge server, and the preset scheduling strategy is a load balancing strategy.

[0047] The preset scheduling strategy of this embodiment may include one or more network request scheduling methods, so as to distribute the traffic brought by a large number of network requests to the corresponding preset application server, and specifically forward it to an instance of the preset application server (such as a container or cloud service, etc.).

[0048] In some optional embodiments, the preset scheduling strategy includes at least one of a round-robin method, a minimum number of connections method, a scheduling method based on application server resources, a hash calculation method, a path hash method, and a domain name hash method. The above step S102 includes: scheduling the network request through at least one of a round-robin method, a minimum number of connections (Least Connections) method, a scheduling method based on application server resources (Resource-Based Scheduling), a hash calculation method, a path hash method, and a domain name hash method, thereby scheduling the network request to the target application server.

[0049] Specifically, the polling method includes at least one of the average polling method and the weighted polling method, the minimum connection number method includes at least one of the average minimum connection number method and the weighted minimum connection number method, and the hash calculation method includes at least one of the source Internet interconnection protocol hash method, the request path hash method, and the session information hash method.

[0050] In the process of scheduling network requests by polling, the traffic scheduling engine in the trusted execution environment allocates the current network request to the next preset application server (i.e., the target application server) in the preset application server list; if the end of the preset application server list is reached, the network request is allocated again from the preset application server at the beginning of the preset application server list, and the preset application server list is used to record the above-mentioned multiple preset application servers; the above-mentioned polling method can be called average polling, which is suitable for scenarios where all preset application servers have the same configuration and roughly the same processing power. On this basis, this embodiment may schedule network requests by weighted polling, including: setting a weight for each preset application server in the preset application server list, and the weight is used to reflect the processing power of the preset application server; for example, when the response of a preset application server slows down, the weight of the preset application server can be dynamically reduced, and more network requests can be allocated to the preset application server with a higher weight. Among them, weighted polling is more suitable for scenarios where there are performance differences between multiple preset application servers in the back end. The traffic scheduling engine of this embodiment can monitor the performance indicators of each preset application server in the backend in real time. The performance indicators may include but are not limited to response time, CPU usage, memory usage, and number of active connections. These performance indicators are crucial for implementing traffic scheduling and health checks.

[0051] In the process of scheduling network requests through the minimum number of connections, the traffic scheduling engine sends the new network request to the preset application server with the least number of currently active connections; the above-mentioned minimum number of connections method can be called the average minimum number of connections method, which is particularly suitable for processing network requests with uncertain processing time. This method can ensure that no preset application server will become overloaded due to several long-running processes. On this basis, this embodiment may schedule network requests through the weighted minimum number of connections method, including: setting weights for the above-mentioned multiple preset application servers respectively, and allocating the current network request to the target application server according to the set weights and the current number of active connections. By taking the weight factor into account, a more intelligent load distribution can be achieved, so that the target application server receives an appropriate number of connections and network requests according to its actual processing capacity.

[0052] In the process of scheduling network requests based on application server resources, the traffic scheduling engine obtains the current resource usage of the above-mentioned multiple preset application servers, and allocates the current network request to the preset application server with the lowest current resource utilization based on the current resource usage to prevent certain preset application servers from being overloaded; among which, the current resource usage in this embodiment includes CPU usage and memory usage, etc.

[0053] During the process of scheduling network requests using a hash calculation method, the traffic scheduling engine obtains specific parameters, which may include the client IP address, request path, or session information, and then sends the network request to the corresponding preset application server based on a hash algorithm based on the specific parameters. The specific process of the hash algorithm can be selected from related technologies and will not be described in detail in this embodiment. The network request scheduling scheme based on the hash calculation method can ensure that network requests issued by the same client are always sent to the same preset application server. This scheme is suitable for applications with session persistence.

[0054] In the process of scheduling network requests by using a path hashing method, the traffic scheduling engine can specifically hash the path of the network request to determine the route of the network request, thereby allocating the network request to the corresponding preset application server, and directing different URLs (Uniform Resource Locators) to specific preset application servers. In the process of scheduling network requests by using a domain name hashing method, the traffic scheduling engine can specifically hash the domain name of the network request to determine the route of the network request, thereby allocating the network request to the corresponding preset application server, and directing different domain names to specific preset application servers. Of course, based on this embodiment, the network request scheduling algorithm can also be customized to meet specific business needs. For the above-mentioned multiple network request scheduling methods, this embodiment allows users to select the most appropriate scheduling method based on actual needs and the characteristics of the preset application server at the back end.

[0055] In this embodiment, the scheduling behavior of ALB can be configured through the management interface or API, specifically adjusting weights, defining health check parameters, setting session stickiness, etc.

[0056] For critical operations such as network request scheduling, the embodiments of the present disclosure provide a secure computing environment through TEE, and critical operations including network request scheduling will not be interfered with by external malware or attackers.

[0057] In some optional implementations, network requests are scheduled by at least one of polling, minimum connection number, application server resource-based scheduling, hash calculation, path hash, and domain name hash, including but not limited to the following steps b1 and b2.

[0058] Step b1: Acquire response history information and current network status information of multiple preset application servers.

[0059] The response history information may indicate the response of the preset application server to the network request in the past period of time, and the current network status information may indicate the network connection status between the edge server and the preset application server.

[0060] Step b2, according to the response history information and the current network status information, select one or more of the polling method, minimum connection number method, application server resource-based scheduling method, hash calculation method, path hash method, and domain name hash method to schedule the network request.

[0061] For example, if the historical response results of each preset application server to network requests are consistent, the minimum connection number method can be used according to the network conditions of the preset application servers; if the network conditions of the preset application servers are consistent, the polling method can be used; if the performance of different preset application servers varies greatly, the scheduling method based on application server resources can be used on the basis of the minimum connection number or polling method; if the network request contains specific parameters such as the client IP address, request path or session information, one or more of the hash calculation method, path hash method, and domain name hash method can be used on the basis of the minimum connection number or polling method.

[0062] The disclosed embodiments can use historical response information and current network status information as the basis for selecting various scheduling methods. This approach enables dynamic adjustment of traffic scheduling strategies to optimize traffic distribution. This demonstrates that the present embodiment can dynamically adjust traffic based on current network conditions and server load, achieving intelligent traffic distribution. Furthermore, the processing mechanism designed for high-traffic situations allows rapid adjustments to sudden traffic increases, ensuring network stability.

[0063] In some optional implementations, forwarding the network request to a target application server among multiple preset application servers according to a preset scheduling policy includes: encrypting the network request, and sending the encrypted network request to the target application server according to the preset scheduling policy.

[0064] In this embodiment, the network request can be encrypted by a dedicated hardware accelerator configured on the edge server.

[0065] In a trusted execution environment, this embodiment can encrypt relevant sensitive data including network requests and ensure the integrity of the code. Therefore, based on the solution provided by this embodiment, data security can be maintained even when data is transmitted in an unsafe environment.

[0066] Step S103: receiving a response result of the target application server to the network request, and forwarding the response result to the client.

[0067] The target application server is used to respond to the network request. The preset application server in this embodiment can respond to the received network request in the form of a service pool or instance, obtain a response result, and send the response result back to the edge server.

[0068] In some optional implementations, forwarding the response result to the client includes: encrypting the response result, and sending the encrypted response result to the client.

[0069] It can be seen that this embodiment can further process the response result. The further processing process includes the above-mentioned encryption processing process, and may also include processing processes such as response header modification and compression, and then send the response result after the above-mentioned further processing to the client.

[0070] By encrypting the response results, the present disclosure can further improve the security of data transmission between the edge server and the client.

[0071] The edge server-based network request scheduling method provided in this embodiment provides a secure execution environment based on TEE technology to isolate sensitive computing tasks. The execution environment is independent of the edge server host operating system and can prevent external attackers from accessing or modifying the code and data being executed. This embodiment schedules network requests according to a preset scheduling policy in the trusted execution environment in the edge server, and forwards the response results of the target application server to the network request to the client. Compared with related technologies, the solution provided by this embodiment is not affected even if the edge server is attacked maliciously. This embodiment can still ensure the normal scheduling of network requests based on the trusted execution environment isolated from the operating system and application. In addition, this embodiment can also use TEE technology to help ensure compliance, because operations performed in the TEE can be more strictly audited.

[0072] In this embodiment, a network request scheduling method based on an edge server is provided. The network request scheduling method based on an edge server is applied to an edge server configured with a trusted execution environment. The operating system and application program execution space on the edge server are isolated from the trusted execution environment. FIG2 is a flow chart of the network request scheduling method based on an edge server according to an embodiment of the present disclosure. As shown in FIG2 , the process includes the following steps:

[0073] Step S201: Obtain a network request sent by a client. Please refer to step S101 of the embodiment shown in FIG1 for details, which will not be repeated here.

[0074] Step S202: In the trusted execution environment, the network request is forwarded to a target application server among the plurality of preset application servers according to a preset scheduling policy. For details, please refer to step S102 of the embodiment shown in FIG1 , which will not be described in detail here.

[0075] Step S203: Receive the response result of the target application server to the network request and forward the response result to the client. Please refer to step S103 of the embodiment shown in Figure 1 for details, which will not be repeated here.

[0076] Step S204: Record the process of scheduling the network request in the trusted execution environment as a log file, and store the log file.

[0077] For example, this embodiment records key operations in a trusted execution environment in an edge server, records the key operations in a log file, and stores the log file.

[0078] The edge server-based network request scheduling method provided in this embodiment also records the process of scheduling network requests in a trusted execution environment as a log, which is crucial for subsequent analysis, auditing, and monitoring.

[0079] In this embodiment, a network request scheduling method based on an edge server is provided. The network request scheduling method based on an edge server is applied to an edge server configured with a trusted execution environment. The operating system and application program execution space on the edge server are isolated from the trusted execution environment. FIG3 is a flow chart of the network request scheduling method based on an edge server according to an embodiment of the present disclosure. As shown in FIG3 , the process includes the following steps:

[0080] Step S301: Obtain a network request sent by a client.

[0081] Specifically, the edge server includes an application load balancing gateway and a traffic scheduling engine deployed in a trusted execution environment. The traffic scheduling engine provided in this embodiment is highly flexible and intelligent, capable of handling a large number of concurrent network requests while ensuring high availability and performance of the network request scheduling service. This traffic scheduling engine ensures low latency when processing a large number of requests while also ensuring high throughput, meeting the requirements of large-scale deployments.

[0082] More specifically, the above step S301 includes:

[0083] In step S3011, when a network request sent by a client reaches an application load balancing gateway in a trusted execution environment, the application load balancing gateway parses and performs a security check on the network request to obtain a preliminary processing result of the request.

[0084] In this embodiment, the edge server is used to parse the network request based on the URL path or request type to obtain a corresponding parsing result; and can also perform a security check on the network request to obtain a security check result. The preliminary processing result includes the parsing result and the security check result.

[0085] Step S3012: Determine whether the preliminary processing result of the request is a legal result.

[0086] The edge server determines whether the preliminary processing result of the request is a legal result. If the network request can be successfully parsed and the security check result is safe, it means that the preliminary processing result of the request is a legal result. Otherwise, the preliminary processing result of the request is an illegal result.

[0087] Step S3013: If the preliminary processing result of the request is a legal result, the network request is forwarded to the traffic scheduling engine in the trusted execution environment, so that the network request is scheduled by the traffic scheduling engine according to a preset scheduling policy.

[0088] For example, if the network request can be successfully parsed and the security check result is safe, the network request can be forwarded to the traffic scheduling engine in the trusted execution environment.

[0089] Step S3014: If the preliminary processing result of the request is an illegal result, the network request is discarded.

[0090] For example, if the network request fails to be parsed, and / or the security check result is unsafe, the network request is discarded and the corresponding client may be notified.

[0091] The disclosed embodiment performs preliminary processing on the network request, and only proceeds to the next processing step when the processing result of the network request is the above-mentioned legal result. Based on this method, the embodiment can further improve the security and reliability of the traffic scheduling process.

[0092] Step S302: In the trusted execution environment, the network request is forwarded to a target application server among the plurality of preset application servers according to a preset scheduling policy. For details, please refer to step S102 of the embodiment shown in FIG1 , which will not be described in detail here.

[0093] Step S303: Receive the response result of the target application server to the network request and forward the response result to the client. Please refer to step S103 of the embodiment shown in Figure 1 for details, which will not be repeated here.

[0094] As shown in Figure 4, the application load balancing gateway, the application load balancing traffic scheduling engine based on the trusted execution environment (i.e., the traffic scheduling engine in the aforementioned embodiment), and the application load balancing log service can all be arranged on the application load balancer of the edge server. The traffic scheduling engine of this embodiment can automatically expand and integrate functions with the edge cloud platform, and dynamically adjust back-end resources according to changes in traffic. The traffic scheduling engine in this embodiment can also perform self-repair. When it detects that the service provided by the preset application server at the back end fails, it automatically reroutes the traffic to ensure the continuous operation of the business. In addition, the traffic scheduling engine can also be integrated with the network application firewall (WAF, Web Application Firewall) to provide traffic monitoring and attack defense at the security level.

[0095] Specifically, the edge server-based network request scheduling method of this embodiment may include the following steps:

[0096] In step S401, the network request sent by the client (e.g., a browser or application on an electronic device) to the edge server first reaches the application load balancing gateway (ALB gateway). That is, the user access service reaches the ALB gateway. The ALB gateway is responsible for receiving these network requests and parsing them according to predefined rules (such as URL path, request type, etc.). The ALB gateway can perform preliminary processing on the network request, such as SSL (Secure Sockets Layer) terminal inspection, request inspection, logging, etc. This stage may also include security checks on the request, such as preventing DDoS (Distributed Denial Of Service attack) and SQL (Structured Query Language) injection, to ensure that only legitimate and safe requests can be further processed.

[0097] Step S402 : The application load balancing gateway forwards traffic to the application load balancing traffic scheduling engine based on the trusted execution environment. That is, the application load balancing gateway forwards the network request to the application load balancing traffic scheduling engine based on the trusted execution environment.

[0098] In step S403, the application load balancing traffic scheduling engine executes the scheduling algorithm in the trusted execution environment, sends the network request to the target application server for processing, receives the response result of the target application server, and feeds back the response result to the corresponding client to complete the network request scheduling.

[0099] In the secure environment of the Trusted Execution Environment, the core functions of the application load balancer, namely the implementation of traffic scheduling logic, can be executed. Even if the edge server host operating system is compromised by malware, the traffic scheduling logic in the Trusted Execution Environment will not be affected.

[0100] Step S404: Based on the application load balancing log service, the application load balancing traffic scheduling engine records the trusted execution environment scheduling log.

[0101] In summary, the present disclosure uses TEE technology to protect the traffic scheduling engine, making it run more securely in a multi-cloud environment including an edge cloud environment, especially in cases where it needs to be deployed in other data centers or edge computer rooms outside the central cloud. The present disclosure can effectively reduce the interference of malware or attackers on the application load balancing (ALB) service. Even if the malware infects the operating system (subject to operating system-level threats), the scheduling decisions provided by the present disclosure are safe and reliable. It can be seen that the present disclosure significantly improves service reliability and security, especially improves the security and reliability of traffic scheduling by edge servers; the present disclosure is suitable for scenarios with extremely high security requirements, such as financial service data, sensitive data processing, etc.

[0102] In this embodiment, a network request scheduling device based on an edge server is also provided. The device is used to implement the above-mentioned embodiments and preferred implementation methods. The details that have been described will not be repeated here. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementation in hardware, or a combination of software and hardware, is also possible and contemplated.

[0103] This embodiment provides an edge server-based network request scheduling device, which is deployed on an edge server configured with a trusted execution environment. The operating system and application program execution space on the edge server are isolated from the trusted execution environment. As shown in FIG5 , the edge server-based network request scheduling device includes:

[0104] The request acquisition module 501 is used to acquire the network request sent by the client.

[0105] The request scheduling module 502 is configured to forward the network request to a target application server among a plurality of preset application servers according to a preset scheduling policy in a trusted execution environment.

[0106] The request response module 503 is used to receive the response result of the target application server to the network request, and to forward the response result to the client.

[0107] In some optional implementations, the edge server-based network request scheduling device further includes a log recording module.

[0108] The logging module is used to record the process of scheduling network requests in the trusted execution environment as a log file, and to store the log file.

[0109] In some optional implementations, the edge server includes an application load balancing gateway and a traffic scheduling engine deployed in a trusted execution environment; the request acquisition module 501 includes:

[0110] The preliminary processing unit is used to parse and perform security checks on the network request sent by the client when it reaches the application load balancing gateway in the trusted execution environment to obtain the preliminary processing result of the request.

[0111] The request forwarding unit is used to forward the network request to the traffic scheduling engine in the trusted execution environment according to the preliminary processing result of the request being a legal result, so that the network request can be scheduled according to the preset scheduling strategy through the traffic scheduling engine.

[0112] The request discarding unit is used to discard the network request if the preliminary processing result of the request is an illegal result.

[0113] In some optional implementations, the preset scheduling strategy includes at least one of a polling method, a minimum connection number method, a scheduling method based on application server resources, a hash calculation method, a path hash method, and a domain name hash method.

[0114] The request scheduling module 502 is specifically used to schedule network requests through at least one of polling, minimum connection number, application server resource-based scheduling, hash calculation, path hash, and domain name hash to schedule network requests to the target application server.

[0115] In some optional implementations, the request scheduling module 502 includes:

[0116] The information acquisition unit is used to acquire response history information and current network status information of multiple preset application servers.

[0117] The request scheduling unit is used to schedule network requests by selecting one or more of the following methods: polling method, minimum connection number method, scheduling method based on application server resources, hash calculation method, path hash method, and domain name hash method according to response history information and current network status information.

[0118] In some optional implementations, the edge server-based network request scheduling device further includes:

[0119] An environment creation module that creates a trusted execution environment on the application load balancer in the edge server.

[0120] The signature verification module is used to verify the signature of the execution code corresponding to the preset scheduling strategy.

[0121] The code execution module is used to execute the execution code in a trusted execution environment based on the signature verification of the execution code.

[0122] The execution rejection module is used to reject the execution code from running in the trusted execution environment based on the signature of the execution code failing to pass the verification.

[0123] In some optional implementations, the request scheduling module 502 is further configured to encrypt the network request and send the encrypted network request to the target application server according to a preset scheduling policy.

[0124] The request response module 503 is further configured to encrypt the response result and send the encrypted response result to the client.

[0125] The further functional description of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0126] The edge server-based network request scheduling device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0127] The embodiment of the present disclosure further provides a cluster including an edge server and multiple preset application servers, wherein the multiple preset application servers are respectively communicatively connected to the edge server; the edge server has the network request scheduling device shown in FIG. 5 .

[0128] The cluster involved in the embodiments of the present disclosure is an edge cluster, specifically a cluster that combines multiple edge nodes or multiple edge servers. The edge nodes or edge servers are usually located closer to users or devices to achieve the purpose of setting computing resources and data storage resources closer to users, etc., for providing low-latency computing, low-latency storage and low-latency services, and realizing more efficient edge computing and services.

[0129] Please refer to Figure 6, which is a schematic diagram of the structure of an edge server provided by an optional embodiment of the present disclosure. As shown in Figure 6, the edge server includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. The various components are connected to each other using different buses and can be installed on a common motherboard or installed in other ways as needed. The processor can process instructions executed within the edge server, including instructions stored in or on the memory to display graphical information of a GUI on an external input / output device (such as a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used with multiple memories and multiple memories. Similarly, multiple edge servers can be connected, with each device providing some of the necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 6 uses a processor 10 as an example.

[0130] The processor 10 may be a central processing unit, a network processor, or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit, a programmable logic device, or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic, or any combination thereof.

[0131] The memory 20 stores instructions that can be executed by at least one processor 10, so as to enable at least one processor 10 to execute the method shown in the above embodiment.

[0132] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and applications required for at least one function; the data storage area may store data created based on the use of the edge server, etc. In addition, the memory 20 may include high-speed random access memory and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely located relative to the processor 10, and these remote memories may be connected to the edge server via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0133] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0134] The edge server further includes a communication interface 30 for the edge server to communicate with other devices or a communication network.

[0135] The embodiments of the present disclosure also provide a computer-readable storage medium. The above-mentioned method according to the embodiments of the present disclosure can be implemented in hardware, firmware, or implemented as a computer code that can be recorded in a storage medium, or implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and downloaded through a network and will be stored in a local storage medium, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state drive, etc.; further, the storage medium can also include a combination of the above-mentioned types of memory. It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor or hardware, the method shown in the above embodiment is implemented.

[0136] Although the embodiments of the present disclosure have been described with reference to the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present disclosure, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A network request scheduling method based on an edge server, the method being applied to an edge server configured with a trusted execution environment (TEE), wherein the operating system and application program execution spaces on the edge server are isolated from the TEE; the method comprising: Get the network request sent by the client; In the trusted execution environment, forwarding the network request to a target application server among a plurality of preset application servers according to a preset scheduling policy; Receive a response result of the target application server to the network request, and forward the response result to the client.

2. The method according to claim 1, wherein The method further comprises: The process of scheduling the network request in the trusted execution environment is recorded as a log file, and the log file is stored.

3. The method according to claim 1, wherein The edge server includes an application load balancing gateway and a traffic scheduling engine deployed in the trusted execution environment; The obtaining of the network request sent by the client includes: When the network request sent by the client arrives at the application load balancing gateway in the trusted execution environment, the application load balancing gateway parses and performs security checks on the network request to obtain a preliminary processing result of the request; If the preliminary processing result of the request is a legal result, forwarding the network request to the traffic scheduling engine in the trusted execution environment, so that the network request is scheduled by the traffic scheduling engine according to the preset scheduling policy; If the preliminary processing result of the request is an illegal result, the network request is discarded.

4. The method according to any one of claims 1 to 3, wherein The preset scheduling strategy includes at least one of a polling method, a minimum connection number method, a scheduling method based on application server resources, a hash calculation method, a path hash method, and a domain name hash method; forwarding the network request to a target application server among the plurality of preset application servers according to the preset scheduling strategy includes: The network request is scheduled by at least one of a polling method, a minimum connection number method, a scheduling method based on application server resources, a hash calculation method, a path hash method, and a domain name hash method to schedule the network request to the target application server.

5. The method according to claim 4, wherein The scheduling of the network request by at least one of a polling method, a minimum number of connections method, a scheduling method based on application server resources, a hash calculation method, a path hash method, and a domain name hash method includes: Obtaining response history information and current network status information of the plurality of preset application servers; According to the response history information and the current network status information, one or more methods selected from the group consisting of polling method, minimum connection number method, scheduling method based on application server resources, hash calculation method, path hash method, and domain name hash method are selected to schedule the network request.

6. The method according to any one of claims 1 to 3, wherein Before obtaining the network request sent by the client, the method further includes: creating the trusted execution environment on an application load balancer in the edge server; Verifying the signature of the execution code corresponding to the preset scheduling policy; If the signature of the execution code passes the verification, running the execution code in the trusted execution environment; If the signature of the execution code fails to pass the verification, the execution code is refused to run in the trusted execution environment.

7. The method according to any one of claims 1 to 3, wherein Forwarding the network request to a target application server among a plurality of preset application servers according to a preset scheduling policy includes: encrypting the network request, and sending the encrypted network request to the target application server according to the preset scheduling policy; The forwarding the response result to the client includes: encrypting the response result, and sending the encrypted response result to the client.

8. A network request scheduling device based on an edge server, the device being deployed on an edge server configured with a trusted execution environment (TEE), wherein the operating system and application program execution spaces on the edge server are isolated from the TEE; the device comprising: Request acquisition module, used to obtain network requests sent by the client; A request scheduling module, configured to forward the network request to a target application server among a plurality of preset application servers in the trusted execution environment according to a preset scheduling policy; The request response module is used to receive the response result of the target application server to the network request, and to forward the response result to the client.

9. A cluster comprising an edge server and a plurality of preset application servers, wherein the plurality of preset application servers are respectively in communication with the edge server; The edge server includes a memory and a processor, the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the network request scheduling method based on the edge server according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium having computer instructions stored thereon, wherein the computer instructions are used to enable a computer to execute the edge server-based network request scheduling method according to any one of claims 1 to 7.

Images