Distributed multi-tenant data security isolation system and method

Abstract

The invention discloses a distributed multi-tenant data security isolation system and method, and relates to the technical field of data isolation, and the system comprises a data isolation module which is responsible for distributing independent container instances and hardware resources for each tenant, and adjusting the data access authority according to an access control strategy; the dynamic access control module is responsible for generating an access control strategy according to the user identity, the authority, the tenant strategy and the access behavior; the distributed data management module is responsible for storing data fragments on different storage nodes; the resource scheduling and optimizing module is responsible for collecting resource demand data of each tenant, calling an intelligent scheduling algorithm, performing dynamic prediction and analysis on resource demands, and then automatically adjusting a resource allocation strategy according to a prediction result; and the security auditing and monitoring module is responsible for collecting operation logs and event records of each module and carrying out comprehensive analysis. The invention aims to solve the problems of data security and resource management in a multi-tenant environment.

Description

Technical Field

[0001] The present invention relates to the technical field of data isolation, and in particular to a distributed multi-tenant data security isolation system and method. Background Art

[0002] With the popularity of cloud computing and distributed systems, more and more enterprises and organizations deploy their applications and data in a multi-tenant architecture to achieve efficient resource utilization and flexible expansion capabilities. However, traditional multi-tenant data management methods often cannot effectively solve the problems of data leakage and resource competition in such a complex environment.

[0003] Traditional methods usually rely on simple access control lists and permission management. Although they can provide data isolation to a certain extent, they are difficult to meet high-level security requirements when faced with a large number of users, complex applications, and changing resource requirements. In this case, resource contention between tenants may lead to performance degradation and even the risk of data leakage. In addition, in distributed and cloud-native environments, data management and security become more complex and difficult due to the dynamic and diverse nature of the system. Summary of the invention

[0004] In response to the needs and deficiencies of current technological development, the present invention provides a distributed multi-tenant data security isolation system and method.

[0005] In the first aspect, the present invention provides a distributed multi-tenant data security isolation system, and the technical solution adopted to solve the above technical problems is as follows:

[0006] A distributed multi-tenant data security isolation system, comprising:

[0007] The data isolation module is responsible for allocating independent container instances and hardware resources to each tenant through virtualization and containerization technologies to achieve physical and logical isolation, and then receives access control policies from the dynamic access control module to adjust data access permissions. It is also responsible for providing data access and operation records for real-time monitoring and audit analysis by the security audit and monitoring module.

[0008] The dynamic access control module is responsible for generating access control policies based on user identities, permissions, tenant policies, and access behaviors; it is also responsible for providing access control logs and access control policy change records for analysis and auditing by the security audit and monitoring module;

[0009] The distributed data management module is responsible for storing data shards on different storage nodes and working with the data isolation module to ensure data isolation and security in distributed storage. It is also responsible for providing log records of data storage for analysis by the security audit and monitoring module.

[0010] The resource scheduling and optimization module is responsible for collecting resource demand data of each tenant, working in collaboration with the data isolation module, dynamic access control module, distributed data management module, and security audit and monitoring module, and calling the intelligent scheduling algorithm to first dynamically predict and analyze resource demand, and then automatically adjust the resource allocation strategy based on the prediction results; it is also responsible for providing resource scheduling logs and access control policy change records for analysis by the security audit and monitoring module;

[0011] The security audit and monitoring module is responsible for collecting the operation logs and event records of each module and conducting comprehensive analysis. It is also responsible for real-time detection and identification of potential security threats and abnormal behaviors, and triggering alarms or automatic response measures.

[0012] Optionally, the data isolation module involved uses namespace and cgroups functions to allocate independent hardware resources to each tenant, implement resource restriction and isolation, and ensure physical data isolation between tenants;

[0013] The data isolation module works in conjunction with the dynamic access control module, using role-based access control and a policy engine to dynamically adjust access rights to data and resources based on the tenant's roles, permissions, and policies, ensuring that users can only access data relevant to their roles.

[0014] Further optionally, the data isolation module involved works in conjunction with the distributed data management module to distribute data shards to different storage nodes through data sharding technology and consistency protocol, thereby achieving distributed data management and consistency assurance; at the same time, the data isolation module also cooperates with the security audit and monitoring module to use encryption algorithms and security protocols to provide data encryption storage and transmission security.

[0015] Further optionally, the dynamic access control module involved generates an access control policy according to the user identity, authority, tenant policy and access behavior. This process specifically includes:

[0016] First, the dynamic access control module authenticates the user's identity and matches the corresponding rules in the access control list based on the user's identity information. These rules define whether to allow or deny access rights to specified resources for specified users or user groups, ensuring that only authorized users can access the corresponding data.

[0017] Then, the dynamic access control module considers the tenants’ policies and generates access control policies based on the needs and security requirements of different tenants;

[0018] Then, the dynamic access control module monitors the user's access behavior in real time, analyzes their access patterns and operation records, and supports the detection and response to abnormal behavior to adjust access rights or trigger security warnings when abnormal behavior is detected.

[0019] Further optionally, the distributed data management module involved stores the data shards on different storage nodes, and this process includes:

[0020] The distributed data management module uses a distributed storage system and uses a data distribution algorithm to ensure that the sharded data is evenly distributed on the storage nodes;

[0021] The distributed data management module integrates a consistency protocol to coordinate data synchronization between storage nodes to ensure data consistency and integrity.

[0022] Further optionally, the distributed data management module involved stores the data fragments on different storage nodes, and this process also includes:

[0023] The distributed data management module stores data copies in different storage nodes or geographical locations through regular backup and snapshot technology;

[0024] The distributed data management module supports intelligent caching and hierarchical storage of data, caching hot data to high-speed storage media and storing cold data on high-capacity, low-speed storage media;

[0025] The distributed data management module has a dynamic data migration function, which automatically adjusts the location of sharded data according to load changes and resource usage, and provides log records of data migration for analysis by the security audit and monitoring module.

[0026] Further optionally, the security audit and monitoring module involved collects the operation logs and event records of each module and generates detailed audit logs, including user login, data access, permission changes and system configuration changes. The generated audit logs are stored by time series and event type classification to facilitate subsequent security analysis and compliance inspection;

[0027] The security audit and monitoring module supports automated security report generation, and regularly generates detailed security audit reports and risk assessment reports to help managers understand the security status and potential risks of the system and develop corresponding improvement measures;

[0028] The security audit and monitoring module also cooperates with the data isolation module to realize encrypted storage and access control of log data, ensuring the integrity and confidentiality of audit data.

[0029] In a second aspect, the present invention provides a distributed multi-tenant data security isolation method, and the technical solution adopted to solve the above technical problems is as follows:

[0030] A distributed multi-tenant data security isolation method, based on the distributed multi-tenant data security isolation system described in the first aspect, comprises the following steps:

[0031] S1, System initialization: Start the data isolation module, configure the virtualization and containerization environment, create independent container instances for different tenants, set up the distributed data management module, deploy data sharding and storage nodes, and configure the consistency protocol to ensure data synchronization and consistency;

[0032] S2. Adding new tenants: The data isolation module automatically configures virtualization and containerization environments according to the tenant's business needs and security policies to ensure the physical and logical isolation of tenant data; the dynamic access control module configures access control lists and policy engines according to tenant roles and permissions, and generates access control policies for new tenants;

[0033] S3, data upload and management: The distributed data management module divides the data into pieces and distributes them to different storage nodes, monitors the consistency of the data, and uses the consistency protocol to ensure the synchronization and integrity of the data between different nodes;

[0034] S4. Resource scheduling and optimization: The resource scheduling and optimization module collects resource demand data of each tenant, and calls the intelligent scheduling algorithm according to the application load, first dynamically predicts and analyzes the resource demand, and then automatically adjusts the resource allocation strategy according to the prediction results;

[0035] S5. Dynamic access control: The dynamic access control module adjusts access rights to data and resources in real time based on user identity and tenant policies. When a user accesses resources or data, the dynamic access control module checks the user identity and permissions to decide whether to allow access or restrict access.

[0036] S6. The security audit and monitoring module monitors the security status and data access records of the system in real time, detects and identifies potential security threats and abnormal behaviors, and triggers alarms or automatic response measures when potential security threats and abnormal behaviors are detected and identified; the security audit module regularly generates detailed audit reports, records the system operations and data access, and provides a comprehensive audit of tenant data security;

[0037] S7, System expansion: When new tenants join or the needs of existing tenants increase, the system can be seamlessly expanded by adding virtual machines, containers, storage nodes and computing resources. The resource scheduling and optimization module will automatically identify new resource requirements and adjust resource allocation and scheduling strategies accordingly.

[0038] S8. Maintenance and Update: Regularly maintain and update the system, including updates to the virtualization environment, data management strategies, resource scheduling algorithms, and security strategies. Adjust the system configuration and strategies based on tenant feedback and needs.

[0039] Compared with the prior art, the distributed multi-tenant data security isolation system and method of the present invention have the following beneficial effects:

[0040] 1. The present invention can adjust the access rights to resources and data in real time according to the needs and permissions of tenants through the dynamic access control module, ensuring that data leakage and unauthorized access can be effectively prevented at any time; through the data isolation module and the distributed data management module, tenant data is stored in different nodes or clusters in pieces to achieve physical and logical isolation of data, greatly improving the security and reliability of data management; through the resource scheduling and optimization module, according to the real-time resource needs and application load conditions of tenants, dynamically optimize resource allocation and task scheduling strategies to ensure optimal utilization of resources; through the security audit and monitoring module, comprehensive real-time monitoring and security auditing, record user operations and system events, provide predictive security protection and detailed security reports; ultimately solve the data security and resource management problems in a multi-tenant environment;

[0041] 2. The present invention realizes multi-level data isolation by combining physical isolation and logical isolation, which can not only isolate the data of different tenants at the physical level, but also realize data isolation at the logical level through fine-grained permission control, thereby enhancing data security; at the same time, the intelligent scheduling algorithm is adopted, and the resource scheduling optimization technology combined with the intelligent scheduling algorithm can dynamically adjust the resource allocation and scheduling strategy according to the resource requirements of the tenants and the application load conditions, so as to ensure the optimal utilization of resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Attached Figure 1 It is a system module connection block diagram of the present invention. DETAILED DESCRIPTION

[0043] In order to make the technical solution, the technical problem solved and the technical effect of the present invention more clearly understood, the technical solution of the present invention is clearly and completely described below in conjunction with specific embodiments.

[0044] Embodiment 1:

[0045] Combined with Figure 1 , this embodiment proposes a distributed multi-tenant data security isolation system, which includes:

[0046] The data isolation module is responsible for allocating independent container instances and hardware resources to each tenant through virtualization and containerization technologies to achieve physical and logical isolation, and then receives access control policies from the dynamic access control module to adjust data access permissions. It is also responsible for providing data access and operation records for real-time monitoring and audit analysis by the security audit and monitoring module.

[0047] The dynamic access control module is responsible for generating access control policies based on user identities, permissions, tenant policies, and access behaviors; it is also responsible for providing access control logs and access control policy change records for analysis and auditing by the security audit and monitoring module;

[0048] The distributed data management module is responsible for storing data shards on different storage nodes and working with the data isolation module to ensure data isolation and security in distributed storage. It is also responsible for providing log records of data storage for analysis by the security audit and monitoring module.

[0049] The resource scheduling and optimization module is responsible for collecting resource demand data of each tenant, working in collaboration with the data isolation module, dynamic access control module, distributed data management module, and security audit and monitoring module, and calling the intelligent scheduling algorithm to first dynamically predict and analyze resource demand, and then automatically adjust the resource allocation strategy based on the prediction results; it is also responsible for providing resource scheduling logs and access control policy change records for analysis by the security audit and monitoring module;

[0050] The security audit and monitoring module is responsible for collecting the operation logs and event records of each module and conducting comprehensive analysis. It is also responsible for real-time detection and identification of potential security threats and abnormal behaviors, and triggering alarms or automatic response measures.

[0051] The data isolation module involved in this embodiment adopts the namespace and cgroups functions to allocate independent hardware resources (CPU, memory, storage) to each tenant, realize resource restriction and isolation, and ensure physical data isolation between tenants; the data isolation module works together with the dynamic access control module, adopts role-based access control (RBAC) and policy engine, and dynamically adjusts the access rights of data and resources according to the tenant's role, authority and policy, to ensure that users can only access data related to their role.

[0052] The data isolation module involved works together with the distributed data management module, and through data sharding technology and consistency protocols (such as Paxos and Raft), the data shards are distributed to different storage nodes to achieve distributed data management and consistency assurance; at the same time, the data isolation module also cooperates with the security audit and monitoring module, using encryption algorithms (such as AES and RSA) and security protocols (such as TLS / SSL) to provide data encryption storage and transmission security.

[0053] The dynamic access control module involved in this embodiment generates an access control policy based on user identity, permissions, tenant policies and access behavior. This process specifically includes: first, the dynamic access control module authenticates the user identity and matches the corresponding rules in the access control list (ACL) according to the user's identity information. These rules define the access rights allowed or denied to the specified user or user group to the specified resources, ensuring that only authorized users can access the corresponding data; then, the dynamic access control module considers the tenant's policy and generates an access control policy based on the needs and security requirements of different tenants; then, the dynamic access control module monitors the user's access behavior in real time, analyzes its access mode and operation records, and supports the detection and response to abnormal behavior, so as to adjust the access rights or trigger security warnings when abnormal behavior is detected.

[0054] It should be added that the dynamic access control module integrates an automated policy evaluation and decision-making engine, which can automatically modify and deploy access policies based on the real-time needs of tenants and the security status of the system.

[0055] The distributed data management module involved in this embodiment stores data shards on different storage nodes. This process includes: the distributed data management module adopts a distributed storage system (such as a distributed file system, object storage or database), and ensures that the sharded data is evenly distributed on the storage nodes through a data distribution algorithm (such as a hash algorithm or a range allocation algorithm); the distributed data management module integrates a consistency protocol (such as Paxos, Raft) to coordinate data synchronization between storage nodes to ensure data consistency and integrity; the distributed data management module implements a data backup and recovery mechanism, and stores data copies in different storage nodes or geographical locations through regular backup and snapshot technology to cope with data loss or system failure; the distributed data management module supports intelligent caching and hierarchical storage of data, caches hot data to high-speed storage media (such as memory or SSD), and stores cold data on high-capacity, low-speed storage media to further improve system performance and reliability; the distributed data management module has a dynamic data migration function, automatically adjusts the location of sharded data according to load changes and resource usage to optimize storage performance and resource utilization, and provides data migration log records for analysis by the security audit and monitoring module.

[0056] The resource scheduling and optimization module involved in this embodiment collects resource demand data of each tenant, works in conjunction with the data isolation module, dynamic access control module, distributed data management module, and security audit and monitoring module, and calls the intelligent scheduling algorithm to first dynamically predict and analyze resource demand based on advanced load prediction and analysis technology, and then automatically adjust the resource allocation strategy according to the prediction results. Specifically, the intelligent scheduling algorithm uses a variety of scheduling strategies, such as priority scheduling, scheduling that minimizes response time, and load balancing algorithms, which ensure efficient utilization and balanced allocation of resources in a multi-tenant environment; the intelligent scheduling algorithm can also process changes in resource demand in real time, automatically adjust resource allocation strategies, support resource pooling, and abstract physical resources into logical resource pools, so as to dynamically allocate and reconfigure resources between different tenants, thereby improving the elasticity and resource utilization of the system.

[0057] In addition, the intelligent scheduling algorithm supports resource optimization mechanisms based on predictive analysis, which pre-configures and adjusts resources by analyzing historical data and future demand forecasts to prevent resource bottlenecks and over-allocation.

[0058] The security audit and monitoring module involved in this embodiment collects the operation logs and event records of each module, generates detailed audit logs, including user login, data access, permission changes and system configuration changes, and stores the generated audit logs by time series and event type, which is convenient for subsequent security analysis and compliance inspection. The security audit and monitoring module supports automated security report generation, and regularly generates detailed security audit reports and risk assessment reports to help managers understand the security status and potential risks of the system and formulate corresponding improvement measures. The security audit and monitoring module also cooperates with the data isolation module to realize encrypted storage and access control of log data, ensuring the integrity and confidentiality of audit data.

[0059] Embodiment 2:

[0060] Based on the distributed multi-tenant data security isolation system described in Example 1, this embodiment proposes a distributed multi-tenant data security isolation method, including the following steps:

[0061] S1. System initialization: Start the data isolation module, configure the virtualization and containerization environment, create independent container instances for different tenants, set up the distributed data management module, deploy data sharding and storage nodes, and configure the consistency protocol (such as Paxos or Raft) to ensure data synchronization and consistency;

[0062] S2. Adding new tenants: The data isolation module automatically configures virtualization and containerization environments according to the tenant's business needs and security policies to ensure the physical and logical isolation of tenant data; the dynamic access control module configures access control lists and policy engines according to tenant roles and permissions, and generates access control policies for new tenants;

[0063] S3, data upload and management: The distributed data management module divides the data into pieces and distributes them to different storage nodes, monitors the consistency of the data, and uses the consistency protocol to ensure the synchronization and integrity of the data between different nodes;

[0064] S4, Resource Scheduling and Optimization: The resource scheduling and optimization module collects resource demand data of each tenant, and calls the intelligent scheduling algorithm according to the application load, first dynamically predicts and analyzes resource demand, and then automatically adjusts the resource allocation strategy according to the prediction results;

[0065] S5. Dynamic access control: The dynamic access control module adjusts access rights to data and resources in real time based on user identity and tenant policies. When a user accesses resources or data, the dynamic access control module checks the user identity and permissions to decide whether to allow access or restrict access.

[0066] S6. The security audit and monitoring module monitors the system's security status and data access records in real time, detects and identifies potential security threats and abnormal behaviors, and triggers alarms or automatic response measures when potential security threats and abnormal behaviors are detected and identified; the security audit module regularly generates detailed audit reports, records system operations and data access, and provides a comprehensive audit of tenant data security.

[0067] It should be supplemented that the method described in this embodiment may also include the following steps:

[0068] S7, System expansion: When new tenants join or the needs of existing tenants increase, the system can be seamlessly expanded by adding virtual machines, containers, storage nodes and computing resources. The resource scheduling and optimization module will automatically identify new resource requirements and adjust resource allocation and scheduling strategies accordingly.

[0069] S8. Maintenance and Update: Regularly maintain and update the system, including updates to the virtualization environment, data management strategies, resource scheduling algorithms, and security strategies. Adjust the system configuration and strategies based on tenant feedback and needs.

[0070] In summary, the distributed multi-tenant data security isolation system and method of the present invention can achieve physical and logical isolation of data, improve the security and reliability of data management, and dynamically optimize resource allocation and task scheduling strategies according to the real-time resource requirements and application load conditions of tenants to ensure optimal utilization of resources, ultimately solving data security and resource management problems in a multi-tenant environment.

[0071] The above specific examples are used to explain the principles and implementation methods of the present invention in detail. These examples are only used to help understand the core technical content of the present invention. Based on the above specific embodiments of the present invention, any improvements and modifications made by technicians in this technical field without departing from the principles of the present invention should fall within the scope of patent protection of the present invention.

Claims

1. A distributed multi-tenant data security isolation system, characterized in that: It includes: The data isolation module is responsible for allocating independent container instances and hardware resources to each tenant through virtualization and containerization technologies to achieve physical and logical isolation, and then receives access control policies from the dynamic access control module to adjust data access permissions. It is also responsible for providing data access and operation records for real-time monitoring and audit analysis by the security audit and monitoring module. The dynamic access control module is responsible for generating access control policies based on user identities, permissions, tenant policies, and access behaviors; it is also responsible for providing access control logs and access control policy change records for analysis and auditing by the security audit and monitoring module; The distributed data management module is responsible for storing data shards on different storage nodes and working with the data isolation module to ensure data isolation and security in distributed storage. It is also responsible for providing log records of data storage for analysis by the security audit and monitoring module. The resource scheduling and optimization module is responsible for collecting resource demand data of each tenant, working in collaboration with the data isolation module, dynamic access control module, distributed data management module, and security audit and monitoring module, and calling the intelligent scheduling algorithm to first dynamically predict and analyze resource demand, and then automatically adjust the resource allocation strategy based on the prediction results; it is also responsible for providing resource scheduling logs and access control policy change records for analysis by the security audit and monitoring module; The security audit and monitoring module is responsible for collecting the operation logs and event records of each module and conducting comprehensive analysis. It is also responsible for real-time detection and identification of potential security threats and abnormal behaviors, and triggering alarms or automatic response measures.

2. A distributed multi-tenant data security isolation system according to claim 1, characterized in that: The data isolation module uses namespace and cgroups functions to allocate independent hardware resources to each tenant, implement resource restriction and isolation, and ensure physical data isolation between tenants; The data isolation module works in conjunction with the dynamic access control module, using role-based access control and a policy engine to dynamically adjust access rights to data and resources based on the tenant's role, permissions, and policies, ensuring that users can only access data relevant to their role.

3. A distributed multi-tenant data security isolation system according to claim 2, characterized in that: The data isolation module works in conjunction with the distributed data management module, and through data sharding technology and consistency protocol, distributes data shards to different storage nodes to achieve distributed data management and consistency assurance; at the same time, the data isolation module also cooperates with the security audit and monitoring module, using encryption algorithms and security protocols to provide data encryption storage and transmission security.

4. A distributed multi-tenant data security isolation system according to claim 3, characterized in that: The dynamic access control module generates an access control policy based on user identity, permissions, tenant policy and access behavior. This process specifically includes: First, the dynamic access control module authenticates the user's identity and matches the corresponding rules in the access control list based on the user's identity information. These rules define whether to allow or deny access rights to specified resources for specified users or user groups, ensuring that only authorized users can access the corresponding data. Then, the dynamic access control module considers the tenants’ policies and generates access control policies based on the needs and security requirements of different tenants; Then, the dynamic access control module monitors the user's access behavior in real time, analyzes their access patterns and operation records, and supports the detection and response to abnormal behavior to adjust access rights or trigger security warnings when abnormal behavior is detected.

5. A distributed multi-tenant data security isolation system according to claim 3, characterized in that: The distributed data management module stores data fragments on different storage nodes. This process includes: The distributed data management module adopts a distributed storage system and ensures that the data after sharding is evenly distributed on the storage nodes through a data distribution algorithm; The distributed data management module integrates a consistency protocol to coordinate data synchronization between storage nodes to ensure data consistency and integrity.

6. A distributed multi-tenant data security isolation system according to claim 5, characterized in that: The distributed data management module stores the data slices on different storage nodes. This process also includes: The distributed data management module stores data copies in different storage nodes or geographical locations through regular backup and snapshot technology; The distributed data management module supports intelligent caching and hierarchical storage of data, caching hot data to high-speed storage media and storing cold data on high-capacity, low-speed storage media; The distributed data management module has a dynamic data migration function, which automatically adjusts the location of sharded data according to load changes and resource usage, and provides log records of data migration for analysis by the security audit and monitoring module.

7. A distributed multi-tenant data security isolation system according to claim 6, characterized in that: The security audit and monitoring module collects the operation logs and event records of each module and generates detailed audit logs, including user login, data access, permission changes and system configuration changes. The generated audit logs are stored by time series and event type to facilitate subsequent security analysis and compliance checks; The security audit and monitoring module supports automated security report generation, and regularly generates detailed security audit reports and risk assessment reports to help managers understand the security status and potential risks of the system and develop corresponding improvement measures; The security audit and monitoring module also cooperates with the data isolation module to implement encrypted storage and access control of log data, ensuring the integrity and confidentiality of audit data.

8. A distributed multi-tenant data security isolation method, characterized in that: It is based on the distributed multi-tenant data security isolation system as claimed in claim 1, and includes the following steps: S1. System initialization: Start the data isolation module, configure the virtualization and containerization environment, create independent container instances for different tenants, set up the distributed data management module, deploy data sharding and storage nodes, and configure the consistency protocol (such as Paxos or Raft) to ensure data synchronization and consistency; S2. Adding new tenants: The data isolation module automatically configures virtualization and containerization environments according to the tenant's business needs and security policies to ensure the physical and logical isolation of tenant data; the dynamic access control module configures access control lists and policy engines according to tenant roles and permissions, and generates access control policies for new tenants; S3, data upload and management: The distributed data management module divides the data into pieces and distributes them to different storage nodes, monitors the consistency of the data, and uses the consistency protocol to ensure the synchronization and integrity of the data between different nodes; S4, Resource Scheduling and Optimization: The resource scheduling and optimization module collects resource demand data of each tenant, and calls the intelligent scheduling algorithm according to the application load, first dynamically predicts and analyzes resource demand, and then automatically adjusts the resource allocation strategy according to the prediction results; S5. Dynamic access control: The dynamic access control module adjusts access rights to data and resources in real time based on user identity and tenant policies. When a user accesses resources or data, the dynamic access control module checks the user identity and permissions to decide whether to allow access or restrict access. S6. The security audit and monitoring module monitors the system's security status and data access records in real time, detects and identifies potential security threats and abnormal behaviors, and triggers alarms or automatic response measures when potential security threats and abnormal behaviors are detected and identified.

9. A distributed multi-tenant data security isolation method according to claim 8, characterized in that: The method further comprises the steps of: S7, System expansion: When new tenants join or the needs of existing tenants increase, the system can be seamlessly expanded by adding virtual machines, containers, storage nodes and computing resources. The resource scheduling and optimization module will automatically identify new resource requirements and adjust resource allocation and scheduling strategies accordingly. S8. Maintenance and Update: Regularly maintain and update the system, including updates to the virtualization environment, data management strategies, resource scheduling algorithms, and security strategies. Adjust the system configuration and strategies based on tenant feedback and needs.

10. A distributed multi-tenant data security isolation method according to claim 8, characterized in that: The security audit module regularly generates detailed audit reports, records system operations and data access, and provides a comprehensive audit of tenant data security.

Images