Method and apparatus for transmitting data in content delivery network, device, and medium

Abstract

Embodiments of the present disclosure provide a method and apparatus for transmitting data in a content delivery network, an electronic device, and a computer-readable medium. The method comprises: generating a target orchestration script, the target orchestration script comprising an instruction to be executed by a content delivery network; transmitting the target orchestration script to a server of the content delivery network; and acquiring from the server a first log for execution of the target orchestration script in a corresponding trusted execution environment of a plurality of edge devices of the content delivery network. Therefore, during the use of a content delivery network service, the security of a content transmission process can be ensured for a user.

Description

Method, device, equipment and medium for data transmission in content distribution network

[0001] This application claims priority to the Chinese invention patent application entitled “Methods, devices, equipment and media for data transmission in a content distribution network” filed on March 21, 2024, with application number 202410330035.5, the entire contents of which are incorporated herein by reference. Technical Field

[0002] Example embodiments of the present disclosure relate generally to digital protection, and more particularly, to methods, apparatuses, devices, and computer-readable storage media for data transmission in a content distribution network. Background Art

[0003] Content transmission is widely used in various applications. Users can access content in client applications, such as reading news. After receiving a content access request from a client, the server can transmit the content to the client through a content delivery network (CDN), also known as a content delivery network, for the user to view. During the content transmission process, it is often necessary to overcome the problem of low transmission efficiency during peak network usage or unstable network conditions, hoping to achieve efficient content transmission. By utilizing a content distribution network, content transmission can be faster and more stable. During content transmission through a content distribution network, it is necessary to ensure the security of content transmission. Summary of the Invention

[0004] In a first aspect of the present disclosure, a method for data transmission in a content delivery network is provided. The method includes: generating, at a client device, a target orchestration script containing instructions to be executed by the content delivery network; transmitting the target orchestration script to a server of the content delivery network; and obtaining, from the server, a first log of execution of the target orchestration script in corresponding trusted execution environments of a plurality of edge devices of the content delivery network.

[0005] In a second aspect of the present disclosure, a method for data transmission in a content delivery network is provided. The method includes: receiving, at a server of the content delivery network, a target orchestration script from a client device, the target orchestration script including instructions to be executed by the content delivery network; distributing the target orchestration script to multiple edge devices of the content delivery network; receiving, from the multiple edge devices, a first log of execution of the target orchestration script in respective trusted execution environments of the multiple edge devices; and providing the first log to the client device.

[0006] In a third aspect of the present disclosure, a method for data transmission is provided. The method includes: receiving, at an edge device of a content delivery network, a target orchestration script from a server of the content delivery network, the target orchestration script including instructions to be executed by the content delivery network; executing the target orchestration script in a trusted execution environment; generating a first log of the execution of the target orchestration script in the trusted execution environment; and transmitting the first log to the server.

[0007] In a fourth aspect of the present disclosure, a method for data transmission in a content delivery network is provided. The method includes: receiving, at a log database, a first log of execution of a target orchestration script in a corresponding trusted execution environment of each edge device from multiple edge devices of the content delivery network; storing the received first log in chronological order; and providing, to a client device, a second log of execution of at least one orchestration script in the corresponding trusted execution environment of the multiple edge devices, wherein the at least one orchestration script is provided by the client device, and the at least one orchestration script includes the target orchestration script.

[0008] In a fifth aspect of the present disclosure, a device for data transmission is provided. The device includes: a script generation module configured to generate a target orchestration script containing instructions to be executed by a content delivery network; a script transmission module configured to transmit the target orchestration script to a server of the content delivery network; and a log acquisition module configured to acquire, from the server, a first log of execution of the target orchestration script in corresponding trusted execution environments of multiple edge devices of the content delivery network.

[0009] In a sixth aspect of the present disclosure, an apparatus for data transmission in a content distribution network is provided. The apparatus includes: a first script receiving module configured to receive a target orchestration script from a client device, the target orchestration script including instructions to be executed by the content distribution network; a script distribution module configured to distribute the target orchestration script to multiple edge devices of the content distribution network; a first log receiving module configured to receive, from the multiple edge devices, a first log of execution of the target orchestration script in corresponding trusted execution environments of the multiple edge devices; and a log providing module configured to provide the first log to the client device.

[0010] In a seventh aspect of the present disclosure, an apparatus for data transmission in a content distribution network is provided. The apparatus includes: a second script receiving module configured to receive a target orchestration script from a server of the content distribution network, the target orchestration script including instructions to be executed by the content distribution network; a script execution module configured to execute the target orchestration script in a trusted execution environment; a log generation module configured to generate a first log of the execution of the target orchestration script in the trusted execution environment; and a log transmission module configured to transmit the first log to the server.

[0011] In an eighth aspect of the present disclosure, an apparatus for data transmission in a content distribution network is provided. The apparatus includes: a second log receiving module configured to receive, from multiple edge devices of the content distribution network, a first log of execution of a target orchestration script in a corresponding trusted execution environment of each edge device; a log storage module configured to store the received first log in chronological order; and a log providing module configured to provide, to a client device, a second log of execution of at least one orchestration script in the corresponding trusted execution environment of the multiple edge devices, wherein the at least one orchestration script is provided by the client device, and the at least one orchestration script includes the target orchestration script.

[0012] In a ninth aspect of the present disclosure, an electronic device is provided. The electronic device includes at least one processing unit; and at least one memory coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit. When executed by the at least one processing unit, the instructions cause the electronic device to perform the method according to the first, second, third, or fourth aspect of the present disclosure.

[0013] In a tenth aspect of the present disclosure, a computer-readable storage medium is provided, wherein a computer program is stored on the computer-readable storage medium, and the computer program can be executed by a processor to perform the method according to the first aspect, the second aspect, the third aspect, or the fourth aspect of the present disclosure.

[0014] It should be understood that the content described in this section is not intended to limit the key features or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The above and other features, advantages and aspects of the various embodiments of the present disclosure will become more apparent hereinafter with reference to the following detailed description in conjunction with the accompanying drawings. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, wherein:

[0016] FIG1 shows a schematic diagram of an example environment in which embodiments of the present disclosure can be implemented;

[0017] FIG2 shows a schematic flow chart of a content transmission process according to some embodiments of the present disclosure;

[0018] FIG3 shows a flowchart of a method for data transmission in a content distribution network according to some embodiments of the present disclosure;

[0019] FIG4 shows a flowchart of a method for data transmission in a content distribution network according to other embodiments of the present disclosure;

[0020] FIG5 shows a flowchart of a method for data transmission in a content distribution network according to yet other embodiments of the present disclosure;

[0021] FIG6 shows a flowchart of a method for data transmission in a content distribution network according to some other embodiments of the present disclosure;

[0022] FIG7 shows a schematic structural block diagram of an apparatus for data transmission in a content distribution network according to some embodiments of the present disclosure;

[0023] FIG8 shows a schematic structural block diagram of an apparatus for data transmission in a content distribution network according to other embodiments of the present disclosure;

[0024] FIG9 shows a schematic structural block diagram of an apparatus for data transmission in a content distribution network according to further embodiments of the present disclosure;

[0025] FIG10 shows a schematic structural block diagram of an apparatus for data transmission in a content distribution network according to some other embodiments of the present disclosure; and

[0026] FIG11 shows a block diagram of an electronic device capable of implementing one or more embodiments of the present disclosure. DETAILED DESCRIPTION

[0027] The following describes embodiments of the present disclosure in more detail with reference to the accompanying drawings. Although some embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as limited to the embodiments described herein. Instead, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of protection of the present disclosure.

[0028] In the description of the embodiments of the present disclosure, the term "including" and similar terms should be understood as open inclusion, i.e., "including but not limited to." The term "based on" should be understood as "based at least in part on." The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment." The term "some embodiments" should be understood as "at least some embodiments." Other explicit and implicit definitions may be included below.

[0029] The term "in response to" indicates that a corresponding event occurs or a condition is satisfied. It will be understood that the timing of executing a subsequent action executed in response to the event or condition is not necessarily strongly correlated with the time when the event occurs or the condition is satisfied. In some cases, the subsequent action may be executed immediately when the event occurs or the condition is satisfied; in other cases, the subsequent action may be executed some time after the event occurs or the condition is satisfied.

[0030] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) must comply with the requirements of relevant laws, regulations and relevant provisions.

[0031] It is understandable that before using the technical solutions disclosed in the various embodiments of this disclosure, the type, scope of use, usage scenarios, etc. of the personal information involved in this disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0032] For example, in response to receiving a user's active request, a prompt message is sent to the user to clearly remind the user that the operation requested to be performed will require obtaining and using the user's personal information, so that the user can independently choose whether to provide personal information to the electronic device, application, server or storage medium and other software or hardware that performs the operation of the technical solution of the present disclosure based on the prompt message.

[0033] As an optional but non-limiting implementation, in response to receiving a user's active request, a prompt message may be sent to the user, for example, in the form of a pop-up window, in which the prompt message may be presented in text form. Furthermore, the pop-up window may also include a selection control for the user to select "agree" or "disagree" to provide personal information to the electronic device.

[0034] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0035] Security issues are gaining increasing attention in the open environments of various electronic devices, not only for end users but also for service providers, mobile operators, and chip manufacturers. A Trusted Execution Environment (TEE) is a hardware-based security mechanism that loads the code and data involved in computing into a trusted environment protected by the central processing unit (CPU), safeguarding the confidentiality and integrity of the code and data. Compared to operating systems, a Trusted Execution Environment (TEE) provides a higher level of security and is therefore suitable for processing sensitive data within a Trusted Execution Environment. The instruction set architectures currently used by mainstream TEE technologies primarily include the X86 and ARM instruction set architectures.

[0036] A content delivery network (CDN) is a system designed to optimize the delivery of internet content through technologies such as network acceleration, content caching, and load balancing. It can effectively increase website access speeds, enhance data transmission stability, and reduce the burden on origin servers.

[0037] However, the original scripting engines of content distribution networks have always had potential for untrustworthiness, especially when processing sensitive user data and executing critical business logic. Content distribution networks generate service logs when processing sensitive user data and executing critical business logic, but customers cannot use these logs to verify whether their orchestration scripts are being scheduled and executed according to the established logic. Furthermore, content distribution network services cannot verify that the semantics of their edge nodes (such as edge scripts) have been executed. This is because edge nodes are subject to numerous attacks.

[0038] To this end, some embodiments of the present disclosure provide a data transmission solution in a content delivery network. In this solution, after a client device generates a target orchestration script containing instructions to be executed by the content delivery network, the client device transmits the target orchestration script to a server in the content delivery network. The server distributes the target orchestration script to multiple edge devices in the content delivery network. Each edge device executes the target orchestration script in a trusted execution environment and generates corresponding execution logs. After the edge device transmits the logs to the server, the server transmits the logs to the client device.

[0039] By allowing client devices to directly upload orchestration scripts, CDN services can respond more quickly to customer needs, improving overall service efficiency and responsiveness. By running scripts in TEEs on edge nodes, script execution remains unaffected even in the event of an edge node attack, thereby enhancing the reliability of the entire CDN service. By recording and feeding back execution logs, client devices can be provided with feedback on content delivery, improving the user experience. This solution not only improves CDN service performance, but also enhances the end-user experience.

[0040] FIG1 shows a schematic diagram of an example environment 100 in which embodiments of the present disclosure can be implemented.

[0041] As shown in Figure 1, environment 100 includes client device 110. Client 110 may send a request for content to server 120 of a content delivery network. The content may be data that user 150 needs to access via client device 110 or any other appropriate content.

[0042] The client device 110 can be any type of device, including virtual and physical devices. As an example, the client device 110 can include, but is not limited to, mobile devices, fixed devices, or portable devices, including mobile phones, desktop computers, laptop computers, notebook computers, netbook computers, tablet computers, media computers, multimedia tablets, personal communication systems (PCS) devices, personal navigation devices, personal digital assistants (PDAs), audio / video players, digital cameras / camcorders, positioning devices, television receivers, radio broadcast receivers, e-book devices, virtual reality (VR) all-in-one machines, game consoles, game books, or any combination thereof, including accessories and peripherals of these devices or any combination thereof. In some embodiments, the client device 110 can also support any type of interface for the user (such as "wearable" circuits, etc.).

[0043] Environment 100 also includes a content delivery network server 120, which can be used to provide corresponding content for access by client device 110. A content delivery network is an intelligent virtual network built on the existing network foundation. Relying on edge servers deployed in various locations, and through the load balancing, content distribution, and scheduling functional modules of the central platform, it enables users to obtain the required content nearby, reduces network congestion, and improves user access response speed and hit rate.

[0044] Server 120 can be implemented by any type of device, including virtual and physical devices. Examples of such devices include, but are not limited to, mainframe computers, edge computing nodes, rack servers, router computers, server computers, personal computers, mainframe computers, laptop computers, tablet computers, desktop computers, and the like. In some embodiments, the device may include a virtual machine, a container, or a bare metal server.

[0045] Environment 100 also includes a content delivery network edge device 130, which can be an edge node or edge server in the content delivery network. The content delivery network edge node 130 can run scripts or programs, which are referred to as content delivery network edge scripts. Edge scripts enable more complex and customized processing during content delivery. This approach can enhance the traditional caching and distribution functions of the content delivery network and provide more advanced content processing and optimization capabilities.

[0046] The edge device 130 of the content delivery network can be implemented by any type of device, including virtual and physical devices. Examples of such devices include, but are not limited to, mainframe computers, edge computing nodes, rack servers, router computers, server computers, personal computers, mainframe computers, laptop computers, tablet computers, desktop computers, and the like. In some embodiments, the device can include a virtual machine, a container, or a bare metal server.

[0047] Environment 100 also includes a log database 140, which can be used to store log data generated by applications running on devices in the content distribution network. Recording log information facilitates troubleshooting, performance optimization, and security auditing needs, and can meet the requirements for large-scale, efficient, and reliable log storage and querying. The log database can be implemented using any database technology, and the scope of this disclosure is not limited in this respect.

[0048] In the environment 100, the client device 110 may create an orchestration script, which may be transmitted to the edge device 130 via the server 120 for execution by the edge device 130. An example process of script transmission and execution is described below with reference to FIG.

[0049] As shown in Figure 2, the client device 110 transmits (212) the target orchestration script to the server 120 of the content distribution network. The server 120 of the content distribution network sends (223) the target orchestration script to the trusted script engine based on the trusted execution environment of the edge node. The trusted script engine completes the execution of the target orchestration script in the trusted execution environment and transmits the execution result and the log of the execution process to the server 120 of the content distribution network and the log database 140 respectively (232, 234). The server 120 of the content distribution network then transmits (221) the execution result and the log of the execution process to the client device 110. The log database 140 also transmits (241) the execution result and the log of the execution process to the client device 110.

[0050] Some example embodiments of the present disclosure are described below with reference to FIG. 3 to FIG. 6 .

[0051] 3 shows a flow chart of a method for data transmission according to some embodiments of the present disclosure. The method 300 may be performed by the client device 110. For ease of discussion, the method 300 will be described with reference to the environment 100 of FIG. 1 .

[0052] In some embodiments, at block 310, client device 110 generates a target orchestration script containing instructions to be executed by the content delivery network. For example, the client service may generate a target orchestration script that may contain, for example, content distribution logic, specific caching policies, or instructions for responding to specific requests (e.g., security requirements). These included objects are collectively referred to as instructions to be executed by the content delivery network.

[0053] At block 320, client device 110 transmits the target orchestration script to the content distribution network server 120. By transmitting the target orchestration script to the content distribution network, client device 110 can directly control the content distribution network's behavior, implementing personalized and customized content distribution strategies, thereby improving the flexibility and efficiency of the content distribution network's services. Furthermore, this process lays the foundation for subsequent security verification.

[0054] In some embodiments, the target orchestration script is transmitted to server 120 via a secure file transfer protocol or an application programming interface call. The target orchestration script upload process is completed via a secure file transfer protocol (SFTP) or an application programming interface (API), which improves security.

[0055] In some embodiments, the client device 110 can encrypt the target orchestration script. During the upload process, it is crucial to ensure the security of data transmission. The client device 110 can transmit the encrypted target orchestration script to the server 120. Encryption technology is usually used to protect the data during transmission from being intercepted or tampered. The encryption technology can be, for example, a secure transport layer protocol (TLS) or a secure socket layer (SSL). The CDN service provider needs to verify the user's identity to ensure that only authorized users can upload scripts. This is usually achieved through API keys, OAuth (an open protocol) tokens, etc.

[0056] In some embodiments, client device 110 may send a request to server 120 for transmitting a target orchestration script, and receive a response to the target orchestration script from server 120. For example, when client device 110 transmits a target orchestration script to server 120, it needs to send a related request to server 120, and server 120 will receive a related response.

[0057] In box 330, the client device 110 obtains the logs (referred to as "first logs") of the execution of the target orchestration script in the corresponding trusted execution environment of multiple edge devices of the content distribution network from the server 120. For example, the content distribution network has corresponding multiple edge devices, each edge device is configured with a trusted execution environment, and the target orchestration script is securely transmitted to the trusted execution environment of each edge node and executed in the trusted execution environment. The trusted execution environment provides an isolated and secure environment for the execution of the target orchestration script, preventing external attacks and data leakage. The use of trusted execution environment technology significantly enhances the security of edge computing. This approach can effectively defend against external attacks and internal threats and protect sensitive business logic and user data.

[0058] After the target orchestration script is executed in the trusted execution environment of the edge device 130, a first log can be obtained. The first log can be transmitted from the edge device 130 to the server 120 and stored in the server 120. The first log includes a log of the execution result and the execution process.

[0059] In some embodiments, client device 110 may send a request to server 120 to access a first log. The first log is accessible and transparent. In response to the request, client device 110 may obtain the first log from server 120. By accessing the first log, client device 110 can obtain detailed information about the execution of the orchestration script. This provides operational transparency, enabling users to gain a deeper understanding of the execution of the content delivery network service.

[0060] In some embodiments, the client device 110 can obtain a log (referred to as a "second log") for the execution of at least one orchestration script in the corresponding trusted execution environments of multiple edge devices from the log database 140. The at least one orchestration script is provided by the client device 110, and the at least one orchestration script includes a target orchestration script. For example, after the orchestration script completes execution of the orchestration script in the trusted execution environment, it will send a first log containing the execution result and the execution process to the above-mentioned server 120, and send a second log containing the execution result and the execution process to the log database 140. This process not only ensures the security of execution, but also provides transparency and traceability through detailed log records, making it convenient for users and service providers to verify and audit when necessary.

[0061] In some embodiments, client device 110 may send a request to log database 140 to access the second log. Client device 110 has access rights to log database 140. In response to the request, client device 110 may retrieve the second log from log database 140. Log database 140 provides a time-series log database storage service to transmit the second log to client device 110. Thus, the time-series log database storage service provides users with another way to receive execution logs. These logs are stored in a time-series manner, facilitating long-term data analysis and trend prediction.

[0062] By providing an independent, reliable log storage and retrieval system such as the log database 140, data availability and integrity are increased, which is crucial for ensuring long-term data security and compliance.

[0063] In some embodiments, in response to receiving a user's query request for the second log, the client device 110 may send a request to access the second log to the log database 140. By providing the user with access to the second log, the client device 110 can significantly improve user trust and satisfaction because it increases transparency and provides powerful tools to support the user's business operations.

[0064] 4 shows a flow chart of a method for data transmission according to some embodiments of the present disclosure. The method 400 may be performed by a server 120 of a content delivery network. For ease of discussion, the method 400 will be described with reference to the environment 100 of FIG. 1 .

[0065] At block 410, server 120 receives a target orchestration script from client device 110. The target orchestration script includes instructions to be executed by the content delivery network. The content delivery network server 120 receives the target orchestration script from client device 110, which includes instructions to be executed by the content delivery network. This allows users to upload customized scripts, which brings significant flexibility and personalization to the content delivery network service. Users can optimize content delivery based on their specific needs and strategies.

[0066] In some embodiments, the target orchestration script may be received via a secure file transfer protocol or an application programming interface call, thereby ensuring the security of the target orchestration script.

[0067] In some embodiments, the received target orchestration script may be an encrypted target orchestration script. Encrypting the target orchestration script further ensures its security. Server 120 may decrypt the received target orchestration script. Server 120 of the content distribution network includes tools for decrypting the target orchestration script. In other words, by performing encryption and decryption before and after transmission of the target orchestration script, the security of the target orchestration script is significantly improved, preventing it from being intercepted or tampered with during transmission.

[0068] In some embodiments, server 120 may receive a request for transmitting a target orchestration script from client device 110. Server 120 may verify the identity of the user of client device 110 (referred to as "first verification"). In response to passing the first verification, server 120 may send a response for transmitting the target orchestration script to client device 110. For example, before server 120 of a content distribution network receives the target orchestration script, it first receives a request for transmitting the target orchestration script from client device 110 and needs to verify the identity of the user of client device 110, i.e., perform the first verification process.

[0069] If the first verification fails, the server 120 of the content distribution network does not receive the target orchestration script. If the first verification passes, the server 120 of the content distribution network receives the target orchestration script and sends a corresponding transmission response to the client device 110 to indicate that the target orchestration script has been received.

[0070] At block 420, server 120 distributes the target orchestration script to multiple edge devices in the content delivery network. For example, each edge device is configured with a trusted execution environment (TEE) that provides a trusted script engine service based on a TEE. The TEE provides a secure execution environment that protects scripts from interference from other software, particularly attacks at the operating system level. This is crucial for executing scripts containing sensitive logic or data processing.

[0071] The scripting engine for CDN edge devices is an advanced feature of CDN technology. It allows users to write and run custom scripts or code on CDN edge nodes. This technology enables real-time data processing and decision-making at the forefront of content delivery, greatly enhancing the flexibility and functionality of CDNs.

[0072] In some embodiments, server 120 may perform a verification (referred to as "second verification") on the received target orchestration script. After receiving the target orchestration script, content delivery network server 120 performs a second verification to ensure that it does not contain malicious code or instructions that do not comply with policies. In response to passing the second verification, server 120 may distribute the target orchestration script to multiple edge devices. After the second verification is completed, if the result is passed, the content delivery network server will distribute the target orchestration script to the multiple edge devices; if the result is failed, the content delivery network server 120 will not distribute the target orchestration script to the multiple edge devices.

[0073] In some embodiments, server 120 may convert the received target orchestration script into a script having a format suitable for execution at multiple edge devices. For example, content delivery network server 120 may further process the target orchestration script, such as compiling or converting it into a format suitable for execution at an edge node. Server 120 may distribute the converted target orchestration script to multiple edge devices. For example, after the target orchestration script completes format conversion, server 120 may distribute it to multiple edge devices so that it can be successfully executed in the trusted execution environment of the edge devices, thereby improving execution efficiency.

[0074] In some embodiments, server 120 may transmit multiple copies of the target orchestration script to each edge device. Content delivery network server 120 may distribute the received target orchestration script to its globally distributed edge nodes. This typically involves replicating the target orchestration script to multiple servers, ensuring that the content is geographically close to end users, thereby reducing latency. Furthermore, the distribution process must ensure that all edge nodes are synchronized and updated to the latest script version to maintain service consistency.

[0075] In some embodiments, the target orchestration script is distributed to multiple edge devices via a secure file transfer protocol. In some embodiments, server 120 may encrypt the target orchestration script. Server 120 may distribute the encrypted target orchestration script to multiple edge devices. In addition to ensuring security during the aforementioned transmission process, the target orchestration script also needs to be secure when distributed to each edge device. Therefore, encrypting the target orchestration script before distributing it to multiple edge devices further ensures its security.

[0076] In box 430, the server 120 receives a first log of the execution of the target orchestration script in the corresponding trusted execution environment of the multiple edge devices from the multiple edge devices. TEE ensures that the execution process and data of the script are isolated from the main operating system, providing a secure "trust zone". The trusted script engine is responsible for interpreting and executing the target orchestration script sent to the edge node. It runs within the TEE, ensuring the security of the execution environment. The trusted script engine is also able to handle various requests from the script, such as data processing, content caching, and distribution decisions. The use of TEE technology significantly improves the security of the edge node executing the target orchestration script. By running the script in the TEE, it can be guaranteed that even if the edge node is attacked, the execution of the script will not be affected, thereby improving the reliability of the entire content distribution network service.

[0077] In some embodiments, the received first log may be an encrypted first log. For example, the first log of the edge device received by the content distribution network server is encrypted, safe and reliable.

[0078] At block 440 , the server 120 provides the first log to the client device 110 .

[0079] CDN server 120 can first collect script execution results and related logs from its edge nodes 130. This includes detailed information about the script execution, such as timestamps, execution status, generated output, and any exceptions or error messages. This log data may need to be processed and consolidated to ensure it is clear and useful to users. For example, the raw logs may need to be formatted or summarized for easier understanding.

[0080] The CDN service provider can provide these logs to the client device 110 in a variety of ways. For example, the logs can be provided through an API, a file transfer protocol (FTP) server, or a log viewing function integrated into its management console.

[0081] In some embodiments, server 120 may receive a request from client device 110 to access a first log. In response to receiving the request, server 120 may provide the first log to client device 110. During the execution of the target orchestration script, all operations and events are recorded in detail in the first log. This includes every step of the script execution, the decisions made, the data processed, and any exceptions. The first log is crucial for subsequent review and analysis, providing a comprehensive view of the execution process. Therefore, providing client device 110 with access to the first log by the content delivery network server 120 improves the user experience.

[0082] In some embodiments, users can access these logs in real time, which is crucial for monitoring the execution of their orchestration scripts and understanding the performance of CDN services. Through these logs, users can obtain direct feedback on their content delivery and identify areas that require optimization or adjustment. Log data provides users with insights for analyzing CDN service performance, optimizing scripts and strategies, and more. Through logs, users can better understand the needs and behaviors of their user base, thereby improving the efficiency and effectiveness of content delivery.

[0083] By providing execution logs, CDN services increase operational transparency, enabling users to better understand and monitor their service performance. By analyzing logs, users can more quickly identify and resolve issues, adjust CDN configurations to improve efficiency, or respond to specific user behavior patterns. This not only improves CDN service performance but also enhances the user experience.

[0084] 5 shows a flow chart of a method for data transmission in a content delivery network according to some embodiments of the present disclosure. The method 500 may be performed by an edge device 130 of the content delivery network. For ease of discussion, the method 500 will be described with reference to the environment 100 of FIG. 1 .

[0085] At block 510, edge device 130 receives a target orchestration script from server 120 of a content delivery network. The target orchestration script includes instructions to be executed by the content delivery network. At block 520, edge device 130 executes the target orchestration script in a trusted execution environment. At block 530, edge device 130 generates a first log of the execution of the target orchestration script in the trusted execution environment. At block 540, the first log is transmitted to server 120.

[0086] Executing scripts and generating logs in the TEE ensures data integrity and confidentiality. This ensures that data is not tampered with or leaked, even if the edge device 130 is attacked. The application of TEE technology can also optimize edge node performance by providing a dedicated environment for executing user-targeted orchestration scripts, thereby avoiding potential conflicts with other system processes.

[0087] In some embodiments, the received target orchestration script may be an encrypted target orchestration script. Edge device 130 may decrypt the received target orchestration script. In some embodiments, edge device 130 may transmit the first log to log database 140. In some embodiments, edge device 130 may encrypt the first log. Edge device 130 may transmit the encrypted first log. As previously described, the encryption of the target orchestration script and the first log greatly ensures security.

[0088] In some embodiments, the target orchestration script can be executed by a trusted script engine in a trusted execution environment. In a trusted script engine based on TEE, the target orchestration script is securely executed. As an isolated execution environment, TEE ensures that the execution of the script is not affected by external attacks or other parts of the system. This execution method is particularly suitable for processing sensitive data or executing critical business logic because it can effectively prevent data leakage or unauthorized access. TEE provides a hardware-level security protection, which means that even if the operating system is attacked, the script execution environment remains secure. Executing scripts in this environment can ensure the integrity of the execution logic and the confidentiality of the data.

[0089] Edge devices 130 provide transparency and traceability for content delivery network services by recording detailed execution logs and sending them to CDN servers 120 and log database 140. Users can verify that their scripts are executing as expected, while service providers can demonstrate the reliability and security of their services. For example, CDN service providers can better monitor the performance and security of their services and promptly identify and respond to potential issues by recording and analyzing detailed execution logs. This is crucial for compliance, security audits, and troubleshooting.

[0090] 6 shows a flow chart of a method for data transmission in a content distribution network according to some embodiments of the present disclosure. Method 600 may be executed by log database 140. For ease of discussion, method 600 will be described with reference to environment 100 of FIG. 1 .

[0091] At block 610, log database 140 receives a first log of the execution of a target orchestration script in a corresponding trusted execution environment of each edge device from multiple edge devices of the content delivery network. The log may record the execution process of the orchestration script in detail, including timestamps, execution results, and any exceptions or error information.

[0092] At block 620, log database 140 stores the received first log in chronological order. After execution is complete at the edge device, the resulting first log is securely sent to log database 140. In some embodiments, log database 140 may include a time series log database. Storing the first log in chronological order facilitates historical data tracing and trend analysis.

[0093] In some embodiments, log database 140 may encrypt the received first log. Log database 140 may store the encrypted first log. Transmission of the first log involves encrypted transmission to ensure security during network transmission. Accordingly, log database 140 stores the encrypted first log. Log database 140 ensures data integrity and security. Encrypted storage of log data prevents unauthorized access and data leakage.

[0094] In some embodiments, the stored first log can be immutable. This allows the database to achieve log immutability, meaning that once written, data cannot be altered, thereby preventing tampering and ensuring the authenticity of the log. Therefore, a time series log database provides a way to store and analyze this data over the long term.

[0095] At block 630, log database 140 provides a second log of execution of at least one orchestration script in corresponding trusted execution environments of the plurality of edge devices to client device 110, wherein the at least one orchestration script is provided by client device 110 and includes a target orchestration script. For example, log database 140 transmits a log (i.e., a second log) containing execution results and processes to client device 110.

[0096] In some embodiments, log database 140 may receive a request for access to the second log from client device 110. In response to receiving the request for access to the second log, log database 140 may provide the second log to client device 110. To improve user experience, client device 110 has access rights to the second log.

[0097] Users can thus access the log database 140 to obtain detailed information about the execution of their orchestration scripts. This provides operational transparency, allowing users to understand the performance of CDN services. This access can be provided through an API or a dedicated query interface, allowing users to retrieve and analyze log data as needed.

[0098] In some embodiments, log database 140 can support long-term data storage. This allows for the long-term storage, management, and analysis of execution logs, ensuring data integrity and security. This enables users to analyze historical data and identify trends and patterns. This allows for optimization of CDN strategies, improving service efficiency, and adjusting business decisions.

[0099] Figure 7 shows a schematic structural block diagram of an apparatus for data transmission according to some embodiments of the present disclosure. Apparatus 700 may be implemented at client device 110 of Figure 1. Each module / component in apparatus 700 may be implemented by hardware, software, firmware, or any combination thereof.

[0100] As shown in Figure 7, apparatus 700 includes a script generation module 710, a script transmission module 720, and a log acquisition module 730. Script generation module 710 is configured to generate a target orchestration script containing instructions to be executed by a content delivery network. Script transmission module 720 is configured to transmit the target orchestration script to a server 120 of the content delivery network. Log acquisition module 730 is configured to acquire, from the server, a first log of the execution of the target orchestration script in the corresponding trusted execution environments of multiple edge devices of the content delivery network.

[0101] In some embodiments, the apparatus 700 may include a calling module configured to transmit the target orchestration script to the server via a secure file transfer protocol or an application programming interface call.

[0102] In some embodiments, the apparatus 700 may include a first script encryption module configured to encrypt the target orchestration script. The script transmission module 720 may also be configured to transmit the encrypted target orchestration script to the server.

[0103] In some embodiments, apparatus 700 may include a request response module configured to send a request for a transmission target orchestration script to a server; and receive a response for the transmission target orchestration script from the server.

[0104] In some embodiments, the apparatus 700 may include a first log access module configured to send a request to access a first log to a server. The log acquisition module 730 is further configured to acquire the first log from the server in response to sending the request to access the first log.

[0105] In some embodiments, the log acquisition module 730 may also be configured to acquire, from the log database 140 , a second log for the execution of at least one orchestration script in corresponding trusted execution environments of a plurality of edge devices, wherein the at least one orchestration script is provided by the client device 110 , and the at least one orchestration script includes a target orchestration script.

[0106] In some embodiments, the apparatus 700 may include a second log access module configured to send a request for accessing the second log to the log database 140. The second log acquisition module is further configured to acquire the second log from the log database 140 in response to the request for accessing the second log.

[0107] In some embodiments, the second log access module is further configured to send a request for accessing the second log to the log database 140 in response to receiving a query request for the second log from the user.

[0108] FIG8 shows a schematic structural block diagram of an apparatus for data transmission according to other embodiments of the present disclosure. Apparatus 800 may be implemented at server 120 of the content distribution network of FIG1 . Each module / component in apparatus 800 may be implemented by hardware, software, firmware, or any combination thereof.

[0109] As shown in FIG8 , apparatus 800 includes a first script receiving module 810, a script distribution module 820, a first log receiving module 830, and a first log providing module 840. First script receiving module 810 is configured to receive a target orchestration script from client device 110, the target orchestration script containing instructions to be executed by a content delivery network. Script distribution module 820 is configured to distribute the target orchestration script to multiple edge devices of the content delivery network. First log receiving module 830 is configured to receive, from multiple edge devices, first logs of the execution of the target orchestration script in their respective trusted execution environments. First log providing module 840 is configured to provide the first logs to client device 110.

[0110] In some embodiments, apparatus 800 may include a call receiving module configured to receive the target orchestration script via a secure file transfer protocol or an application programming interface call.

[0111] In some embodiments, the apparatus 800 may include an encrypted script receiving module configured to receive an encrypted target orchestration script and may further include a first decryption module configured to decrypt the received target orchestration script.

[0112] In some embodiments, apparatus 800 may include a first verification module configured to receive a request for a transmission target orchestration script from client device 110; perform a first verification on the identity of a user of client device 110; and, in response to passing the first verification, send a response for the transmission target orchestration script to client device 110.

[0113] In some embodiments, the apparatus 800 may include a first access request receiving module configured to receive a request for accessing the first log from the client device 110. The first log providing module 840 is further configured to provide the first log to the client device 110 in response to receiving the request for accessing the first log.

[0114] In some embodiments, the apparatus 800 may include a second verification module configured to perform a second verification on the received target orchestration script. The script distribution module 820 is further configured to distribute the target orchestration script to multiple edge devices in response to passing the second verification.

[0115] In some embodiments, apparatus 800 may include a script format conversion module configured to convert the received target orchestration script into a script having a format suitable for execution at multiple edge devices. Script distribution module 820 is further configured to distribute the converted target orchestration script to multiple edge devices.

[0116] In some embodiments, script distribution module 820 is further configured to transmit multiple copies of the target orchestration script to each edge device.

[0117] In some embodiments, the script distribution module 820 is further configured to distribute the target orchestration script to multiple edge devices via a secure file transfer protocol.

[0118] In some embodiments, apparatus 800 may include a second script encryption module configured to encrypt the target orchestration script. Script distribution module 820 is further configured to distribute the encrypted target orchestration script to multiple edge devices.

[0119] In some embodiments, the first log receiving module 830 is configured such that the received first log is an encrypted first log.

[0120] Figure 9 shows a schematic structural block diagram of an apparatus for data transmission according to further embodiments of the present disclosure. Apparatus 900 may be implemented at edge device 130 of the content distribution network of Figure 1. Each module / component in apparatus 900 may be implemented by hardware, software, firmware, or any combination thereof.

[0121] As shown in FIG9 , apparatus 900 includes a second script receiving module 910, a script execution module 920, a log generation module 930, and a log transmission module 940. Second script receiving module 910 is configured to receive a target orchestration script from server 120 of a content distribution network. The target orchestration script includes instructions to be executed by the content distribution network. Script execution module 920 is configured to execute the target orchestration script in a trusted execution environment. Log generation module 930 is configured to generate a first log of the execution of the target orchestration script in the trusted execution environment. Log transmission module 940 is configured to transmit the first log to the server.

[0122] In some embodiments, the second script receiving module 910 is further configured to receive an encrypted target orchestration script. The apparatus 900 may further include a second decryption module configured to decrypt the received target orchestration script.

[0123] In some embodiments, the apparatus 900 may include a first log transmission module configured to transmit a first log to the log database 140 .

[0124] In some embodiments, the apparatus 900 may include a first log encryption module configured to encrypt the first log and a first log transmission module configured to transmit the encrypted first log.

[0125] In some embodiments, the script execution module 920 is further configured to target the orchestration script for execution by a trusted script engine in a trusted execution environment.

[0126] Figure 10 shows a schematic structural block diagram of an apparatus for data transmission according to some other embodiments of the present disclosure. Apparatus 1000 may be implemented at the log database 140 of Figure 1. Each module / component in apparatus 1000 may be implemented by hardware, software, firmware, or any combination thereof.

[0127] As shown in FIG10 , apparatus 1000 includes a second log receiving module 1010, a log storage module 1020, and a second log providing module 1030. Second log receiving module 1010 is configured to receive, from multiple edge devices of a content distribution network, first logs related to the execution of target orchestration scripts in the trusted execution environments of the respective edge devices. Log storage module 1020 is configured to store the received first logs in chronological order. Second log providing module 1030 is configured to provide, to client device 110, a second log related to the execution of at least one orchestration script in the trusted execution environments of the multiple edge devices. The at least one orchestration script is provided by client device 110, and the at least one orchestration script includes the target orchestration script.

[0128] In some embodiments, the apparatus 1000 may include a received log encryption module configured to encrypt the received first log. The log storage module 1020 is further configured to store the encrypted first log.

[0129] In some embodiments, the log storage module 1020 is further configured to ensure that the stored first log cannot be altered.

[0130] In some embodiments, the apparatus 1000 may include a second access request receiving module configured to receive a request for accessing the second log from the client device 110. The second log providing module 1030 is further configured to provide the second log to the client device 110 in response to receiving the request for accessing the second log.

[0131] Figure 11 shows a block diagram of an electronic device 1100 in which one or more embodiments of the present disclosure may be implemented. The electronic device 1100 shown in Figure 11 is merely exemplary and does not constitute any limitation on the functionality and scope of the embodiments described herein.

[0132] As shown in FIG11 , electronic device 1100 is a general-purpose electronic device. Components of electronic device 1100 may include, but are not limited to, one or more processors or processing units 1110, memory 1120, storage device 1130, one or more communication units 1140, one or more input devices 1150, and one or more output devices 1160. Processing unit 1110 may be a real or virtual processor and is capable of performing various processes according to programs stored in memory 1120. In a multi-processor system, multiple processing units execute computer-executable instructions in parallel to enhance the parallel processing capabilities of electronic device 1100.

[0133] The electronic device 1100 typically includes a plurality of computer storage media. Such media can be any available media accessible to the electronic device 1100, including but not limited to volatile and non-volatile media, removable and non-removable media. The memory 1120 can be a volatile memory (e.g., a register, a cache, a random access memory (RAM)), a non-volatile memory (e.g., a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), flash memory), or some combination thereof. The storage device 1130 can be a removable or non-removable medium and can include a machine-readable medium, such as a flash drive, a disk, or any other medium that can be used to store information and / or data (e.g., training data for training) and can be accessed within the electronic device 1100.

[0134] The electronic device 1100 may further include additional removable / non-removable, volatile / non-volatile storage media. Although not shown in FIG. 11 , a disk drive for reading from or writing to a removable, non-volatile disk (e.g., a "floppy disk") and an optical drive for reading from or writing to a removable, non-volatile optical disk may be provided. In these cases, each drive may be connected to a bus (not shown) by one or more data media interfaces. The memory 1120 may include a computer program product 1125 having one or more program modules configured to perform various methods or actions of various embodiments of the present disclosure.

[0135] The communication unit 1140 enables communication with other electronic devices via a communication medium. Additionally, the functions of the components of the electronic device 1100 can be implemented as a single computing cluster or multiple computing machines that can communicate via a communication connection. Thus, the electronic device 1100 can operate in a networked environment using logical connections to one or more other servers, network personal computers (PCs), or other network nodes.

[0136] Input device 1150 may be one or more input devices, such as a mouse, keyboard, or trackball. Output device 1160 may be one or more output devices, such as a display, a speaker, or a printer. Electronic device 1100 may also communicate with one or more external devices (not shown) via communication unit 1140 as needed, such as storage devices, display devices, or the like, with one or more devices that allow a user to interact with electronic device 1100, or with any device that allows electronic device 1100 to communicate with one or more other electronic devices (e.g., a network card, a modem, etc.). Such communication may be performed via an input / output (I / O) interface (not shown).

[0137] According to an exemplary implementation of the present disclosure, a computer-readable storage medium is provided, on which one or more computer instructions are stored, wherein the one or more computer instructions are executed by a processor to implement the method described above.

[0138] Various aspects of the present disclosure are described herein with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products implemented according to the present disclosure. It should be understood that each block of the flowcharts and / or block diagrams, and combinations of blocks in the flowcharts and / or block diagrams, can be implemented by computer-readable program instructions.

[0139] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, such that when these instructions are executed by the processing unit of the computer or other programmable data processing device, a device is generated that implements the functions / actions specified in one or more blocks in the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, where these instructions cause the computer, programmable data processing device, and / or other device to operate in a specific manner. Thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing various aspects of the functions / actions specified in one or more blocks in the flowchart and / or block diagram.

[0140] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device, so that a series of operational steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0141] The flow charts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the systems, methods and computer program products according to multiple implementations of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a part for a module, program segment or instruction, and a part for a module, program segment or instruction comprises one or more executable instructions for realizing the logical function of the specification. In some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be realized by a special hardware-based system that performs the function or action of the specification, or can be realized by a combination of special hardware and computer instructions.

[0142] While various implementations of the present disclosure have been described above, the foregoing description is intended to be illustrative, non-exhaustive, and not limited to the disclosed implementations. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described implementations. The terminology used herein is selected to best explain the principles of the implementations, their practical applications, or improvements to existing technologies, or to enable others skilled in the art to understand the implementations disclosed herein.

Claims

1. A method for data transmission in a content distribution network, comprising: At the client device, generating a target orchestration script, wherein the target orchestration script includes instructions to be executed by the content delivery network; transmitting the target orchestration script to a server of the content delivery network; as well as A first log of execution of the target orchestration script in corresponding trusted execution environments of a plurality of edge devices of the content delivery network is obtained from the server. 2 . The method according to claim 1 , wherein the target orchestration script is transmitted to the server via a secure file transfer protocol or an application programming interface call.

3. The method according to claim 1, further comprising: Sending a request for transmitting the target orchestration script to the server; as well as A response to transmitting the target orchestration script is received from the server.

4. The method according to claim 1, further comprising: Sending a request to the server for accessing the first log, Obtaining the first log includes: In response to sending the request to access the first log, the first log is obtained from the server.

5. The method according to claim 1, further comprising: A second log of execution of at least one orchestration script in corresponding trusted execution environments of the plurality of edge devices is obtained from a log database, wherein the at least one orchestration script is provided by the client device and includes the target orchestration script.

6. The method according to claim 5, further comprising: Sending a request to the log database for accessing the second log, Obtaining the second log includes: In response to sending the request to access the second log, the second log is obtained from the log database.

7. A method for data transmission in a content distribution network, comprising: receiving, at a server of the content delivery network, a target orchestration script from a client device, the target orchestration script comprising instructions to be executed by the content delivery network; Distributing the target orchestration script to multiple edge devices of the content delivery network; receiving, from the plurality of edge devices, a first log of execution of the target orchestration script in respective trusted execution environments of the plurality of edge devices; as well as The first log is provided to the client device.

8. The method according to claim 7, further comprising: receiving a request from the client device to transmit the target orchestration script; Performing a first verification on the identity of the user of the client device; as well as In response to the first verification being successful, a response for transmitting the target orchestration script is sent to the client device.

9. The method according to claim 7, further comprising: receiving a request from the client device to access the first log, Providing the first log includes: In response to receiving the request to access the first log, the first log is provided to the client device.

10. The method according to claim 7, further comprising: Performing a second verification on the received target orchestration script, Distributing the target orchestration script to the multiple edge devices includes: In response to the second verification being passed, the target orchestration script is distributed to the plurality of edge devices.

11. The method according to claim 7, further comprising: converting the received target orchestration script into a script having a format suitable for execution at the plurality of edge devices, Distributing the target orchestration script to the multiple edge devices includes: The converted target orchestration script is distributed to the plurality of edge devices.

12. The method of claim 7, wherein distributing the target orchestration script to the plurality of edge devices comprises: Transmitting multiple copies of the target orchestration script to each of the edge devices.

13. A method for data transmission in a content distribution network, comprising: At an edge device of the content delivery network, receiving a target orchestration script from a server of the content delivery network, the target orchestration script including instructions to be executed by the content delivery network; executing the target orchestration script in a trusted execution environment; generating a first log of execution of the target orchestration script in the trusted execution environment; as well as The first log is transmitted to the server.

14. The method according to claim 13, further comprising: The first log is transmitted to a log database.

15. The method of claim 13, wherein the target orchestration script is executed by a trusted script engine in the trusted execution environment.

16. A device for transmitting data in a content distribution network, comprising: a script generation module, configured to generate a target orchestration script, wherein the target orchestration script includes instructions to be executed by the content delivery network; A script transmission module, configured to transmit the target editing script to a server of the content distribution network; as well as The log obtaining module is configured to obtain, from the server, a first log of execution of the target orchestration script in corresponding trusted execution environments of a plurality of edge devices of the content distribution network.

17. A device for transmitting data in a content distribution network, comprising: a first script receiving module configured to receive a target orchestration script from a client device, wherein the target orchestration script includes instructions to be executed by a content delivery network; a script distribution module, configured to distribute the target orchestration script to a plurality of edge devices of the content distribution network; A first log receiving module is configured to receive, from the plurality of edge devices, first logs of execution of the target orchestration script in corresponding trusted execution environments of the plurality of edge devices; as well as The first log providing module is configured to provide the first log to the client device.

18. A device for transmitting data in a content distribution network, comprising: A second script receiving module is configured to receive a target orchestration script from a server of the content distribution network, wherein the target orchestration script includes instructions to be executed by the content distribution network; A script execution module, configured to execute the target orchestration script in a trusted execution environment; a log generating module, configured to generate a first log for execution of the target orchestration script in the trusted execution environment; as well as The log transmission module is configured to transmit the first log to the server.

19. An electronic device comprising: at least one processing unit; as well as at least one memory coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions, when executed by the at least one processing unit, causing the apparatus to perform the method according to any one of claims 1 to 6, the method according to any one of claims 7 to 12, or the method according to any one of claims 13 to 15.

20. A computer-readable storage medium having a computer program stored thereon, wherein when the program is executed by a processor, the method according to any one of claims 1 to 6, the method according to any one of claims 7 to 12, or the method according to any one of claims 13 to 15 is implemented.

Images