Data access method and device in cloud service multi-tenant environment

Abstract

The application discloses a data access method and device in a cloud service multi-tenant environment, and relates to the technical field of cloud computing, wherein the method comprises the following steps: obtaining a characteristic value of a tenant when the tenant accesses an application; determining a function type of the user accessing the application; and according to the function type of the user accessing the application, entering a corresponding type of database for data query through a database address returned according to the characteristic value of the tenant. The application can dynamically select a data source according to the characteristic value of different tenants, that is, different database clusters are dynamically called for data query when the application is queried to achieve the purpose of accessing different database clusters, without wasting many machine resources, so that the data isolation problem in the cloud service multi-tenant environment is fundamentally solved, the safety of data access in the cloud service multi-tenant environment is improved, and the cost of deploying machine resources is saved.

Description

Technical Field

[0001] This invention relates to the field of cloud computing technology, and in particular to a data access method and apparatus in a multi-tenant cloud service environment. Background Technology

[0002] This section is intended to provide background or context for the embodiments of the invention set forth in the claims. The description herein is not an admission that it is prior art simply because it is included in this section.

[0003] With the explosive growth of cloud services, people are placing increasingly higher demands on the data security strategies of service providers. Each tenant wants their data to be isolated from other tenants' data through a VPC (Virtual Private Cloud) to prevent data leakage risks. In traditional microservice architectures, the solution is either to have each tenant use a separate application and database cluster, or multiple tenants use the same application and database cluster. However, both of these approaches either waste significant machine resources or fail to fundamentally solve the data isolation problem. Summary of the Invention

[0004] This invention provides a data access method for a multi-tenant cloud service environment, which solves the data isolation problem in a multi-tenant cloud service environment without wasting a lot of deployment machine resources. The method includes:

[0005] When a tenant accesses the application, obtain the tenant's characteristic values;

[0006] Determine the type of application function the user is accessing;

[0007] Based on the type of application function accessed by the user, the database address returned by the tenant's characteristic values ​​is used to enter the corresponding type of database for data query.

[0008] In one embodiment, based on the type of application function accessed by the user, data is queried in the corresponding type of database by using the database address returned based on the tenant's characteristic values, including:

[0009] When it is determined that the application's function type is a non-basic application function, the corresponding business database is accessed for data querying by returning the database address based on the tenant's characteristic values.

[0010] In one embodiment, based on the type of application function accessed by the user, data is queried in the corresponding type of database by using the database address returned based on the tenant's characteristic values, including:

[0011] When the application's functional type is determined to be a basic application function, the corresponding basic database is accessed for data querying based on the database address returned by the tenant's characteristic values.

[0012] In one embodiment, when a tenant accesses the application, the tenant's characteristic values ​​are obtained, including:

[0013] When a tenant's cloud service interface login request is received, the characteristic value of the tenant who initiated the cloud service interface login request is written into the cache.

[0014] When a tenant accesses the application, the user obtains the tenant's characteristic values ​​by accessing the cache.

[0015] In one embodiment, the data access method in a multi-tenant cloud service environment further includes: writing the tenant's characteristic value into a thread variable of the application service public class.

[0016] In one embodiment, when a tenant accesses the application, the tenant's characteristic values ​​are obtained by accessing the cache, including:

[0017] When a tenant accesses the application, the application service accesses the cache through a pre-filter to obtain the tenant's characteristic values.

[0018] In one embodiment, the data access method in a multi-tenant cloud service environment further includes: performing security checks on the database address returned based on the tenant's characteristic values.

[0019] In one embodiment, the tenant's characteristic value is a number pre-configured for the tenant.

[0020] In one embodiment, the tenant's characteristic value is the pre-collected biometric information of the tenant.

[0021] In one embodiment, the tenant's characteristic value is pre-collected tenant behavioral characteristic information.

[0022] This invention also provides a data access device for a multi-tenant cloud service environment, which solves the data isolation problem in a multi-tenant cloud service environment without wasting a lot of deployment machine resources. The device includes:

[0023] The acquisition unit is used to acquire the tenant's characteristic values ​​when the tenant accesses the application;

[0024] The determining unit is used to determine the type of application function accessed by the user.

[0025] The processing unit is used to query the corresponding type of database based on the database address returned by the tenant's characteristic values, according to the function type of the application accessed by the user.

[0026] In one embodiment, the processing unit is specifically used for:

[0027] When it is determined that the application's function type is a non-basic application function, the corresponding business database is accessed for data querying by returning the database address based on the tenant's characteristic values.

[0028] In one embodiment, the processing unit is specifically used for:

[0029] When the application's functional type is determined to be a basic application function, the corresponding basic database is accessed for data querying based on the database address returned by the tenant's characteristic values.

[0030] In one embodiment, the acquisition unit is specifically used for:

[0031] When a tenant's cloud service interface login request is received, the characteristic value of the tenant who initiated the cloud service interface login request is written into the cache.

[0032] When a tenant accesses the application, the user obtains the tenant's characteristic values ​​by accessing the cache.

[0033] In one embodiment, the data access device in the above-mentioned cloud service multi-tenant environment further includes: a writing unit, used to write the characteristic value of the tenant into a thread variable of the application service public class.

[0034] In one embodiment, when a tenant accesses the application, the tenant's characteristic values ​​are obtained by accessing the cache, including:

[0035] When a tenant accesses the application, the application service accesses the cache through a pre-filter to obtain the tenant's characteristic values.

[0036] In one embodiment, the data access device in the above-mentioned cloud service multi-tenant environment further includes: a security detection unit, used to perform security detection on the database address returned based on the tenant's characteristic value.

[0037] In one embodiment, the tenant's characteristic value is a number pre-configured for the tenant.

[0038] In one embodiment, the tenant's characteristic value is the pre-collected biometric information of the tenant.

[0039] In one embodiment, the tenant's characteristic value is pre-collected tenant behavioral characteristic information.

[0040] This invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the data access method described above in a multi-tenant cloud service environment.

[0041] This invention also provides a computer-readable storage medium storing a computer program that executes the data access method described above in a multi-tenant cloud service environment.

[0042] In this embodiment of the invention, the data access scheme in a multi-tenant cloud service environment differs from existing technologies that either require each tenant to use a separate application and database cluster, or multiple tenants to use the same application and database cluster, which either wastes significant machine resources or fails to fundamentally solve the data isolation problem. Instead, the scheme achieves this by: obtaining the tenant's characteristic values ​​when the tenant accesses the application; determining the function type of the application accessed by the user; and, based on the function type of the accessed application, accessing the corresponding type of database for data querying using the database address returned by the tenant's characteristic values. This invention can dynamically select the data source based on the characteristic values ​​of different tenants, that is, dynamically calling different database clusters for data querying during application queries to achieve the purpose of accessing different database clusters, without wasting significant machine resources. This fundamentally solves the data isolation problem in a multi-tenant cloud service environment, improving the security of data access while saving deployment machine resource costs. Attached Figure Description

[0043] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:

[0044] Figure 1 This is a flowchart illustrating the data access method in a multi-tenant cloud service environment according to an embodiment of the present invention.

[0045] Figure 2 This is a schematic diagram illustrating the principle of data access in a multi-tenant cloud service environment according to an embodiment of the present invention.

[0046] Figure 3 This is a schematic diagram of the process for obtaining the feature values ​​of a tenant in an embodiment of the present invention;

[0047] Figure 4 This is a schematic diagram illustrating the process of entering a database of the corresponding type for data querying in an embodiment of the present invention;

[0048] Figure 5 This is a schematic diagram of the structure of a data access device in a multi-tenant cloud service environment according to an embodiment of the present invention;

[0049] Figure 6 This is a schematic diagram of the structure of a computer device in an embodiment of the present invention. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. Here, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0051] Before introducing the solutions provided in the embodiments of the present invention, the technical names involved in the embodiments of the present invention will be introduced first.

[0052] 1. VPC: Virtual Private Cloud (VPC) is a virtual network environment built for cloud servers, cloud containers, cloud databases, and other resources. It is isolated and configured and managed by the user, improving the security of cloud resources and simplifying network deployment. A Virtual Private Cloud (VPC) is a private cloud existing within a shared or public cloud; it is also a type of internet cloud.

[0053] A Virtual Private Cloud (VPN) is conceptually similar to a Virtual Private Network (VPN). A VPN can be used to send data over a public network, such as the Internet, through a dedicated tunnel that prevents improperly encrypted data from entering. The additional level of security includes encrypting both the data itself and the network addresses used to generate and receive it.

[0054] A private cloud is a cloud infrastructure and hardware / software resources built within a firewall, allowing various departments within an organization or enterprise to share resources within a data center. A private cloud is a cloud infrastructure that operates entirely for a specific organization; the administrator may be the organization itself or a third party; its location may be internal or external to the organization.

[0055] Virtual Private Cloud (VPC) builds an isolated, user-configurable and managed virtual network environment for elastic cloud servers, improving the security of users' cloud resources and simplifying network deployment.

[0056] Within a VPC, you can define network characteristics such as security groups, VPNs, IP address ranges, and bandwidth. Users can easily manage and configure their internal networks through VPCs, enabling secure and rapid network changes. Furthermore, users can customize access rules for Elastic Cloud Servers within and between security groups, enhancing the security protection of Elastic Cloud Servers.

[0057] 2. Database Cluster: Utilizes at least two or more database servers to form a virtual single database logical image, providing transparent data services to clients like a single database system.

[0058] Technical specifications of database clusters: Since the database system is the core of any information system, in addition to business logic, users are also concerned about the following three points:

[0059] a. System performance

[0060] Performance issues involve many aspects, including hardware, software, network, application architecture, and code quality. However, if a database cluster can provide load balancing and automatic optimization capabilities, it will greatly benefit the overall system performance.

[0061] b. Data reliability

[0062] The possibility of data loss under any system failure (including operating system, database engine, hard drive, disk array, or storage network failures). Some systems are inherently designed to have a theoretical possibility of data loss, while others, due to redundancy design principles, can theoretically guarantee zero data loss. In disaster recovery terminology, this is similar to RPO (Recovery Point Objective), but not entirely equivalent.

[0063] c. Service availability

[0064] The possibility that the entire system will cease providing data services under any system failure (including operating system, database engine, hard drive, disk array, or storage network failures). Closely related to database reliability, if a system theoretically has the potential for data loss, then such a system will inevitably lead to the cessation of all services. Similarly, in disaster recovery terminology, this is similar to RTO (Recovery Time Objective), but it is not entirely equivalent to RTO.

[0065] 3. A thread is the smallest unit of computation that an operating system can schedule. It is contained within a process and is the actual unit of operation within a process. A thread refers to a single, sequential flow of control within a process. Multiple threads can run concurrently within a process, each executing different tasks in parallel. In Unix System V and SunOS, they are also called lightweight processes, but lightweight processes more often refer to kernel threads, while user threads are simply called threads.

[0066] A thread is the basic unit of independent scheduling and dispatching. Threads can be kernel threads scheduled by the operating system kernel, such as Win32 threads; user threads scheduled by user processes themselves, such as POSIX threads on the Linux platform; or threads scheduled by a combination of kernel and user processes, such as threads in Windows 7.

[0067] Multiple threads within the same process will share all system resources of that process, such as the virtual address space, file descriptors, and signal handling. However, each thread within the same process has its own call stack, its own register context, and its own thread-local storage.

[0068] A process can have many threads, and each thread can execute different tasks in parallel.

[0069] 4. Cache, in its original sense, refers to a high-speed memory that is faster than regular random access memory (RAM). It typically doesn't use DRAM technology like main system memory, but rather the more expensive but faster SRAM technology. Cache configuration is one of the key factors for achieving high performance in all modern computer systems.

[0070] 5. Process: A process is a single execution of a program on a specific set of data in a computer. It is the basic unit for resource allocation and scheduling in a system and the foundation of the operating system architecture. In early process-oriented computer architectures, the process was the basic execution entity of a program; in contemporary thread-oriented computer architectures, the process is a container for threads. A program is a description of instructions, data, and their organization; a process is the entity of a program.

[0071] 6. A front-end filter, also known as a front-end server, is commonly used in banks, securities firms, and telecommunications operators. These entities typically have numerous back-end core processing systems that provide various interface services to the outside world. If a business interface needs to interact with these back-end systems, software needs to be developed to run on their internal network. This software is then connected to the external network system via a dedicated line or hardware isolation technology. Functionally, this computer running the software is called a front-end server.

[0072] 7. A public class is a class that can be accessed by everyone, and a series of operations can be performed through an instance of that class.

[0073] The technical field of this invention is in common multi-tenant cloud services, where different tenants access different database clusters to achieve data isolation. The inventors' approach to discovering the prior art and its existing technical problems is as follows:

[0074] The existing implementations similar to the embodiments of the present invention mainly include the following two types:

[0075] 1) Configure an application and database cluster for each tenant.

[0076] 2) Use the same application and database cluster for multiple tenants.

[0077] The disadvantages of the two existing solutions mentioned above are:

[0078] 1) The existing solution 1 can achieve the effect of data isolation, but for cloud products, the number of machines required to deploy applications and database clusters depends on the number of tenants, which consumes unnecessary resources and also puts a lot of pressure on the operation and maintenance work after the product goes live.

[0079] 2) In the existing solution 2, the data of multiple tenants is still stored in the same database cluster. The data is logically isolated by tenant flags and accessed by the application query with filtering conditions. This solution has high requirements for application development and there is a risk of leakage of other tenant data after it goes live.

[0080] To address the data isolation issues identified by the inventors in the two existing solutions for multi-tenant environments, a new data isolation scheme for multi-tenant environments is proposed. This scheme dynamically selects the data source based on the characteristic values ​​of different tenants; that is, it dynamically invokes different database clusters for data queries during application queries to achieve access to different database clusters. The embodiments of this invention also employ a combined configuration of basic and business databases to enable rapid deployment of new tenants, effectively solving the deployment efficiency problem. The following is a detailed description of this data isolation scheme for multi-tenant environments.

[0081] Figure 1 This is a flowchart illustrating the data isolation method in a multi-tenant cloud service environment according to an embodiment of the present invention. Figure 1 As shown, the method includes the following steps:

[0082] Step 101: Obtain the tenant's characteristic values ​​when the tenant accesses the application;

[0083] Step 102: Determine the type of application function the user is accessing;

[0084] Step 103: Based on the type of application function accessed by the user, enter the corresponding type of database to query data by using the database address returned based on the tenant's characteristic values.

[0085] In this embodiment of the invention, the data access method in a multi-tenant cloud service environment differs from existing technologies that rely on a single application and database cluster for each tenant, or multiple tenants using the same application and database cluster. These solutions either waste significant machine resources or fail to fundamentally address data isolation issues. Instead, the method involves: obtaining tenant characteristic values ​​when a tenant accesses an application; determining the function type of the application accessed by the user; and, based on the function type, accessing the corresponding database by retrieving the database address from the tenant's characteristic values. This invention dynamically selects data sources based on the characteristic values ​​of different tenants, i.e., dynamically calling different database clusters during application queries to access different database clusters. This eliminates the need for wasted machine resources, fundamentally solving the data isolation problem in a multi-tenant cloud service environment. It also improves the security of data access in a multi-tenant cloud service environment while saving on deployment machine resource costs.

[0086] The following is in conjunction with the appendix Figures 2 to 4 The various steps involved in the embodiments of the present invention will be described in detail below.

[0087] First, let's introduce step 101 above.

[0088] In one embodiment, such as Figure 3 As shown, obtaining a tenant's characteristic values ​​when a tenant accesses the application can include the following steps:

[0089] Step 1011: Upon receiving a tenant's cloud service interface login request, write the characteristic value of the tenant who initiated the cloud service interface login request into the cache;

[0090] Step 1012: When a tenant accesses the application, obtain the tenant's characteristic value by accessing the cache.

[0091] In practice, the above-described method of obtaining tenant characteristic values ​​can further improve the security of data access in a multi-tenant cloud service environment.

[0092] In practice, a tenant’s characteristic value can be a characteristic identifier assigned based on the tenant’s characteristics, such as a tenant number. To facilitate subsequent data access operations, a characteristic library can be pre-built, which stores the relationship between tenants and their characteristic values.

[0093] In one embodiment, the data access method in a multi-tenant cloud service environment may further include: writing the tenant's characteristic value into a thread variable of the application service public class.

[0094] In practice, the tenant's characteristic value is written into the thread variable of the application service's public class, which facilitates the subsequent quick and accurate return of the database address based on the tenant's characteristic value, thereby improving the accuracy and efficiency of data access in a multi-tenant cloud service environment.

[0095] In one embodiment, obtaining the tenant's characteristic value by accessing the cache when the tenant accesses the application may include:

[0096] When a tenant accesses the application, the application service accesses the cache through a pre-filter to obtain the tenant's characteristic values.

[0097] In practice, accessing the cache through the application service's pre-filter and obtaining the tenant's characteristic values ​​can further improve the security and flexibility of data access in a multi-tenant cloud service environment.

[0098] In specific implementation, such as Figure 2 As shown, when a user (tenant) logs in through the interface, the user writes the tenant's characteristic value (tenant number) to the cache.

[0099] In practice, when a tenant accesses an application (which includes "basic functions" services for multi-tenant shared databases and application services for each tenant's unique database, i.e., non-basic functions), the tenant obtains the tenant number through the application service's pre-filter access cache and writes it into the thread variable of the service's public class.

[0100] Second, we will now introduce step 102 above.

[0101] In practice, when a tenant accesses the normal business functions of an application (the type of application function) and obtains a database connection, the first step is to determine whether it is a basic function (basic functions may include user login, page permission control, etc.).

[0102] Third, we will now introduce step 103 above.

[0103] In one embodiment, such as Figure 4 As shown, based on the type of application function accessed by the user, and by entering the corresponding type of database for data querying based on the database address returned by the tenant's characteristic values, the process may include the following step 1031:

[0104] When it is determined that the application's function type is a non-basic application function, the corresponding business database is accessed for data querying by returning the database address based on the tenant's characteristic values.

[0105] In practice, if it is determined that the user accesses an application whose function type is not a basic function type, the application can use the dynamic data source selection method to return the corresponding database connection for querying based on the tenant number (feature value).

[0106] In practice, the aforementioned method of querying data from the corresponding business database further improves the efficiency and security of data access in a multi-tenant cloud service environment.

[0107] In one embodiment, such as Figure 4 As shown, based on the type of application function accessed by the user, and by entering the corresponding type of database for data querying based on the database address returned by the tenant's characteristic values, the process may include the following step 1032:

[0108] When the application's functional type is determined to be a basic application function, the corresponding basic database is accessed for data querying based on the database address returned by the tenant's characteristic values.

[0109] In practice, if it is determined that the user accesses the application's function type as a basic function type, the public database cluster can be accessed by calling the public data source. That is, by returning the database address based on the tenant's characteristic value, the corresponding basic database can be accessed for data querying.

[0110] In practice, the aforementioned method of querying data from the corresponding basic database further improves the efficiency and security of data access in a multi-tenant cloud service environment.

[0111] In practical implementation, the solution provided in this embodiment of the invention adopts a combination configuration of basic library (basic database) and business library (business database), which is conducive to the rapid deployment of new tenants and effectively solves the problem of deployment efficiency.

[0112] In one embodiment, the data access method in a multi-tenant cloud service environment further includes: performing security checks on the database address returned based on the tenant's characteristic values.

[0113] In practice, after performing security checks on the database address returned based on the tenant's characteristic values, the database is then accessed for data querying based on the corresponding type of database, which further improves the efficiency and security of data access in a multi-tenant cloud service environment.

[0114] In one embodiment, the tenant's characteristic value is a number pre-configured for the tenant.

[0115] In practice, the number can be 0001, 0002, etc.

[0116] In one embodiment, the tenant's characteristic value is the pre-collected biometric information of the tenant.

[0117] In practice, biometric information can include tenant's iris features, fingerprint features, vein features, facial features, and DNA information, etc.

[0118] In one embodiment, the tenant's characteristic value is pre-collected tenant behavioral characteristic information.

[0119] In practice, behavioral characteristic information can include gestures, laughter, mouth opening, and other behavioral characteristic information.

[0120] To facilitate understanding, an example is given below to provide a detailed description of the solutions involved in the embodiments of the present invention.

[0121] Example 1: A public cloud procurement platform has two tenants, A and B, who use the same application services (including basic applications and procurement applications). The database is divided into a basic database (used by the basic applications) and a tenant database (used by the procurement applications).

[0122] 1) When tenants A and B access the basic application function, the basic database tenant configuration is read, the relevant authentication is called, the page permission is configured after successful authentication, and the tenant number (the tenant's characteristic value) is written to the cache.

[0123] 2) When tenants A and B access the procurement application (non-basic application function) respectively, the relevant tenant number (tenant characteristic value) is obtained through step 1). The application extension dynamically selects the data source method and returns the corresponding database address (e.g., database link) based on the tenant number, and enters the corresponding tenant database (business database) for query.

[0124] 3) When tenants A and B access the basic application functions again, they can use the application's extended dynamic data source selection method (which can be an existing method, such as the dynamic data source selection method of an existing report, etc.) to read the basic database again for querying.

[0125] As can be seen from the above, in this embodiment of the invention, a multi-tenant data isolation method is provided for cloud-based multi-tenant products. It can access database clusters of different VPCs based on the user's characteristic values, fundamentally solving the data isolation problem existing in existing cloud-based products.

[0126] In summary, the data access scheme for cloud services in a multi-tenant environment provided by this invention uses a data isolation method in a multi-tenant environment, which can dynamically call different data sources to access different database clusters for different tenants, thereby achieving the purpose of data isolation. Its advantages are as follows:

[0127] 1) In multi-tenancy scenarios where independent deployment is not necessary, application servers can be reused, requiring only the deployment of a new database server.

[0128] 2) Database VPC isolation can be achieved, and the common database module can be reused, making deployment flexible and convenient.

[0129] This invention also provides a data isolation device for a multi-tenant cloud service environment, as described in the following embodiments. Since the principle by which this device solves the problem is similar to the data isolation method for a multi-tenant cloud service environment, the implementation of this device can refer to the implementation of the data isolation method for a multi-tenant cloud service environment; repeated details will not be elaborated further.

[0130] Figure 5 This is a schematic diagram of the data isolation device in a multi-tenant cloud service environment according to an embodiment of the present invention, such as... Figure 5 As shown, the device includes:

[0131] Acquisition unit 01 is used to acquire the tenant's characteristic values ​​when the tenant accesses the application;

[0132] Determining unit 02 is used to determine the function type of the application accessed by the user;

[0133] Processing unit 03 is used to query data in the corresponding type of database by entering the database address returned based on the tenant's characteristic value, according to the function type of the application accessed by the user.

[0134] In this embodiment of the invention, the data access device in a multi-tenant cloud service environment, compared with existing technologies that use a single application and database cluster for each tenant, or multiple tenants using the same application and database cluster (which either wastes significant machine resources or fails to fundamentally solve the data isolation problem), achieves the following: The acquisition unit 01 acquires the tenant's characteristic values ​​when the tenant accesses the application; the determination unit 02 determines the function type of the application accessed by the user; and the processing unit 03, based on the function type of the accessed application, enters the corresponding type of database for data querying using the database address returned by the tenant's characteristic values. This invention can dynamically select the data source based on the characteristic values ​​of different tenants, that is, dynamically call different database clusters for data querying during application queries to achieve the purpose of accessing different database clusters, without wasting significant machine resources. It fundamentally solves the data isolation problem in a multi-tenant cloud service environment, improving the security of data access in a multi-tenant cloud service environment while saving deployment machine resource costs.

[0135] In one embodiment, the processing unit may specifically be used for:

[0136] When it is determined that the application's function type is a non-basic application function, the corresponding business database is accessed for data querying by returning the database address based on the tenant's characteristic values.

[0137] In practice, if the processing unit determines that the user's access to the application's function type is not a basic function type, it can use the application's extended dynamic data source selection method to return the corresponding database connection for querying based on the tenant number (feature value).

[0138] In practice, the aforementioned method of querying data from the corresponding business database further improves the efficiency and security of data access in a multi-tenant cloud service environment.

[0139] In one embodiment, the processing unit may specifically be used for:

[0140] When the application's functional type is determined to be a basic application function, the corresponding basic database is accessed for data querying based on the database address returned by the tenant's characteristic values.

[0141] In practice, if the processing unit determines that the user is accessing a basic function type of the application, it can access the public database cluster by calling the public data source. That is, it can enter the corresponding basic database to query data by returning the database address based on the tenant's characteristic value.

[0142] In practice, the aforementioned method of querying data from the corresponding basic database further improves the efficiency and security of data access in a multi-tenant cloud service environment.

[0143] In one embodiment, the acquisition unit may specifically be used for:

[0144] When a tenant's cloud service interface login request is received, the characteristic value of the tenant who initiated the cloud service interface login request is written into the cache.

[0145] When a tenant accesses the application, the user obtains the tenant's characteristic values ​​by accessing the cache.

[0146] In practice, the above-described method of obtaining tenant characteristic values ​​can further improve the security of data access in a multi-tenant cloud service environment.

[0147] In practice, a tenant’s characteristic value can be a characteristic identifier assigned based on the tenant’s characteristics, such as a tenant number. To facilitate subsequent data access operations, a characteristic library can be pre-built, which stores the relationship between tenants and their characteristic values.

[0148] In one embodiment, the data access device in the above-mentioned cloud service multi-tenant environment may further include: a writing unit, used to write the characteristic value of the tenant into a thread variable of the application service public class.

[0149] In practice, the writing unit writes the tenant's characteristic value into the thread variable of the application service's public class, which facilitates the subsequent quick and accurate return of the database address based on the tenant's characteristic value, thereby improving the accuracy and efficiency of data access in a multi-tenant cloud service environment.

[0150] In one embodiment, obtaining the tenant's characteristic value by accessing the cache when the tenant accesses the application may include:

[0151] When a tenant accesses the application, the application service accesses the cache through a pre-filter to obtain the tenant's characteristic values.

[0152] In practice, accessing the cache through the application service's pre-filter and obtaining the tenant's characteristic values ​​can further improve the security and flexibility of data access in a multi-tenant cloud service environment.

[0153] In specific implementation, such as Figure 2 As shown, when a user (tenant) logs in through the interface, the user writes the tenant's characteristic value (tenant number) to the cache.

[0154] In practice, when a tenant accesses an application (which includes "basic functions" services for multi-tenant shared databases and application services for each tenant's unique database, i.e., non-basic functions), the tenant obtains the tenant number through the application service's pre-filter access cache and writes it into the thread variable of the service's public class.

[0155] In one embodiment, the data access device in the above-mentioned cloud service multi-tenant environment further includes: a security detection unit, used to perform security detection on the database address returned based on the tenant's characteristic value.

[0156] In practice, after performing security checks on the database address returned based on the tenant's characteristic values, the database is then accessed for data querying based on the corresponding type of database, which further improves the efficiency and security of data access in a multi-tenant cloud service environment.

[0157] In one embodiment, the tenant's characteristic value is a number pre-configured for the tenant.

[0158] In practice, the number can be 0001, 0002, etc.

[0159] In one embodiment, the tenant's characteristic value is the pre-collected biometric information of the tenant.

[0160] In practice, biometric information can include tenant's iris features, fingerprint features, vein features, facial features, and DNA information, etc.

[0161] In one embodiment, the tenant's characteristic value is pre-collected tenant behavioral characteristic information.

[0162] In practice, behavioral characteristic information can include gestures, laughter, mouth opening, and other behavioral characteristic information.

[0163] This invention also provides a computer device, such as... Figure 6 As shown, it includes a memory 302, a processor 304, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements any of the above-described receiver circuits and the working method of the terminal.

[0164] Specifically, the computer device can be a computer terminal, a server, or a similar computing device.

[0165] This invention also provides a computer-readable storage medium storing a computer program that executes the operating methods of any of the receiver circuits and terminals described above.

[0166] Specifically, computer-readable storage media include both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer-readable storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable storage media does not include transient media, such as modulated data signals and carrier waves.

[0167] The beneficial technical effects of the data access solution in a multi-tenant cloud service environment provided by this invention are as follows: Compared with existing technologies that use a single application and database cluster for each tenant, or multiple tenants using the same application and database cluster, which either wastes significant machine resources or fails to fundamentally solve the data isolation problem, this invention achieves the following: when a tenant accesses an application, it obtains the tenant's characteristic value; determines the function type of the application accessed by the user; and, based on the function type of the accessed application, enters the corresponding type of database for data querying by using the database address returned based on the tenant's characteristic value. This invention can dynamically select the data source based on the characteristic values ​​of different tenants, that is, dynamically call different database clusters for data querying during application queries to achieve the purpose of accessing different database clusters, without wasting significant machine resources. It fundamentally solves the data isolation problem in a multi-tenant cloud service environment, improving the security of data access in a multi-tenant cloud service environment while saving deployment machine resource costs.

[0168] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0169] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0170] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1The function specified in one or more boxes.

[0171] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0172] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A data access method in a multi-tenant cloud service environment, characterized in that, include: When a tenant accesses the application, obtain the tenant's characteristic values; When a tenant's cloud service interface login request is received, the characteristic value of the tenant who initiated the cloud service interface login request is written into the cache. When a tenant accesses the application, the application service accesses the cache through a pre-filter to obtain the tenant's characteristic value; the tenant's characteristic value is written into a thread variable of the application service's public class; the tenant's characteristic value is a characteristic identifier assigned based on the tenant's characteristics; Determine whether the type of application function accessed by the user is a basic function type; If the user's access to the application's functional type is determined to be different from the basic functional type, the application's extended dynamic data source selection method returns the corresponding business database connection for querying based on the tenant's characteristic value. If the user's access to the application's functional type is determined to be different from the basic functional type, the public database cluster is accessed by calling the public data source, and the corresponding basic database type is returned based on the tenant's characteristic value for data querying, in order to solve the data isolation problem existing in the current cloud products.

2. The data access method in a multi-tenant cloud service environment as described in claim 1, characterized in that, Also includes: Perform security checks on the database address returned based on the tenant's characteristic values.

3. The data access method in a multi-tenant cloud service environment as described in claim 1, characterized in that, The characteristic value of the tenant is a number pre-configured for the tenant.

4. The data access method in a multi-tenant cloud service environment as described in claim 1, characterized in that, The tenant's characteristic value is the pre-collected biometric information of the tenant.

5. The data access method in a multi-tenant cloud service environment as described in claim 1, characterized in that, The tenant's characteristic value is the pre-collected behavioral characteristic information of the tenant.

6. A data access device for a multi-tenant cloud service environment, characterized in that, include: The acquisition unit is used to acquire the tenant's characteristic values ​​when the tenant accesses the application; When a tenant's cloud service interface login request is received, the characteristic value of the tenant who initiated the cloud service interface login request is written into the cache. When a tenant accesses the application, the cache is accessed through the application service's pre-filter to obtain the tenant's characteristic value; the tenant's characteristic value is then written into a thread variable of the application service's public class. A tenant's characteristic value is a feature identifier assigned based on the tenant's characteristics; The determining unit is used to determine whether the function type accessed by the user to the application is a basic function type; The processing unit is used to, if it is determined that the user accesses an application whose function type is not a basic function type, use the application's extended dynamic data source selection method to return the corresponding business database connection for querying based on the tenant's characteristic value; if it is determined that the user accesses an application whose function type is a basic function type, it accesses a public database cluster by calling a public data source and returns the corresponding type of basic database for data querying based on the tenant's characteristic value, in order to solve the data isolation problem existing in the current cloud products.

7. The data access device in a multi-tenant cloud service environment as described in claim 6, characterized in that, Also includes: The security detection unit is used to perform security checks on the database address returned based on the tenant's characteristic values.

8. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 5.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that performs the method of any one of claims 1 to 5.

Images