Multi-tenant resource isolation system and method
By defining multiple meta-models in a multi-tenant system, and utilizing a visual sandbox environment and an independent container database combined with SQL routing middleware, the problems of insufficient data isolation and resource conflicts are solved, achieving accurate data access and security in a multi-tenant environment.
Patent Information
- Application Number
- CN202511761620.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-27
- Publication Date
- 2026-04-14
AI Technical Summary
Existing technologies in shared database models suffer from insufficient data isolation, reliance on row-level isolation which can lead to data leakage risks, weak ability to prevent resource conflicts between tenants, low configuration flexibility, and reliance on code-level modifications.
By defining multiple metamodels in the metamodel-driven layer, users can select and configure them in a visual sandbox environment to generate independent containers and databases. Combined with SQL routing middleware, data isolation is achieved, resource quotas are dynamically managed, and data accuracy and security are ensured.
It achieves accurate data access and security in a multi-tenant environment, avoids resource contention issues, improves system stability and flexibility, and ensures precise data isolation and access accuracy.
Smart Images
Figure CN121859355A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of multi-tenant system architecture technology, and more specifically, to a multi-tenant resource isolation system and method. Background Technology
[0002] Existing data isolation technologies primarily rely on data isolation adapters, which switch database connection methods based on the security isolation type configured in the user's information to enable data access for different tenants. This technology, operating in a shared database model, depends on row-level isolation, posing a risk of data leakage and exhibiting weak capabilities in preventing resource conflicts between tenants. Summary of the Invention
[0003] In view of the above situation, this application provides a multi-tenant resource isolation system and method, which aims to solve the above problems or at least partially solve the above problems.
[0004] In a first aspect, embodiments of this application provide a multi-tenant resource isolation system, including: The metamodel-driven layer includes various digital management business metamodels and a dynamic metamodel parsing engine. The dynamic metamodel parsing engine is used to generate SQL table structures and business logic code based on the target metamodel selected by the tenant. The tenant configuration layer is configured as a visual sandbox environment, which allows tenants to configure the fields and processes of the target metamodel in the visual sandbox environment, and to perform conflict detection and simulated test runs through the sandbox verification mechanism when the configuration of the target metamodel is updated. The resource isolation layer is used to allocate independent containers and independent databases to each tenant, and to dynamically manage the CPU and memory resources of the containers. The data storage layer creates an independent tablespace in each tenant's database. Combined with the SQL routing middleware, it rewrites the initial query request based on the tenant ID and generates a target query request associated with the tenant ID. The target query request is used to extract data from the tenant's tablespace.
[0005] Secondly, embodiments of this application also provide a multi-tenant resource isolation method, including: In response to the target metamodel selected by the tenant, the corresponding SQL table structure and business logic code are generated based on the dynamic parsing engine. Based on the tenant's update operations on the fields and processes of the target metamodel in the visual sandbox environment, conflict detection and simulated operation tests are performed through the sandbox verification mechanism when the configuration of the target metamodel is updated. Allocate independent containers and independent databases to tenants, and dynamically manage the CPU and memory resources of the containers; Create separate tablespaces in separate databases and store tenant data in the corresponding separate tablespaces; Upon receiving a query request, the SQL routing middleware is controlled to convert the query request into a target query request based on the tenant ID. Based on the target query request, data is extracted from the tenant's dedicated tablespace.
[0006] Thirdly, embodiments of this application also provide a multi-tenant resource isolation device, comprising: The generation module is used to generate the corresponding SQL table structure and business logic code based on the dynamic parsing engine in response to the target metamodel selected by the tenant. The detection module is used to perform conflict detection and simulated operation tests based on the tenant's update operations on the fields and processes of the target metamodel in the visual sandbox environment, when the configuration of the target metamodel is updated, through the sandbox verification mechanism. The allocation module is used to allocate independent containers and independent databases to tenants, and to dynamically manage the CPU and memory resources of the containers. The storage module is used to create independent tablespaces in an independent database and store tenant data in the corresponding independent tablespaces. The conversion module is used to receive a query request and control the SQL routing middleware to convert the query request into a target query request based on the tenant ID. The extraction module is used to extract data from the tenant's dedicated tablespace based on the target query request.
[0007] Fourthly, embodiments of this application also provide an electronic device, including: a processor; and a memory arranged to store computer-executable instructions, which, when executed, cause the processor to perform the steps described in the second aspect.
[0008] Fifthly, embodiments of this application also provide a computer-readable storage medium that stores one or more programs, which, when executed by an electronic device including multiple applications, cause the electronic device to perform the steps described in the second aspect.
[0009] The above-mentioned technical solutions adopted in this application embodiment can achieve the following beneficial effects: By defining multiple metamodels in the metamodel-driven layer, users can select metamodels according to their actual needs. The fields and processes of the metamodels can be configured through the visual sandbox environment provided by the tenant configuration layer, allowing users to make personalized configurations according to their own needs without relying on code-level modifications. Furthermore, by allocating independent containers and databases to each tenant, physical computing and storage resources are realized. By dynamically allocating quotas for containers and CPU memory, storage and computing resources are adjusted in real time according to the actual needs of the tenants, avoiding service anomalies caused by shared resources and avoiding resource contention issues in a multi-tenant environment. Finally, an independent tablespace is generated in the database of each tenant to achieve precise data isolation. At the same time, combined with the SQL routing middleware, during the data access process, the SQL routing middleware will automatically rewrite the initial query request to generate a target query request associated with the tenant ID, thereby accurately obtaining data from the corresponding tenant tablespace based on the target query request, ensuring the accuracy and security of data access, preventing data leakage and interference between tenants, and realizing accurate data access in a multi-tenant environment. Attached Figure Description
[0010] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 The system architecture diagram of the multi-tenant resource isolation system provided in the embodiments of this application is shown; Figure 2 A flowchart of the multi-tenant resource isolation method provided in an embodiment of this application is shown; Figure 3 A structural diagram of the multi-tenant resource isolation device provided in an embodiment of this application is shown; Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of this application is shown. Detailed Implementation
[0011] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0012] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such use can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the term "comprising" and its variations should be interpreted as open-ended terms meaning "including but not limited to."
[0013] The data isolation methods described in the background technology have the following problems: 1. Insufficient data isolation: In a shared database mode, relying on row-level isolation is prone to data leakage risks; 2. Low configuration flexibility: Tenants cannot independently customize table structures and business logic, and need to rely on code-level modifications; 3. Resource conflict risk: Application modifications between tenants may cause service anomalies due to shared storage or computing resources.
[0014] Based on this, this application proposes a multi-tenant resource isolation system. By defining multiple metamodels at the metamodel-driven layer, users can select the appropriate metamodel based on their actual needs. The fields and processes of the metamodels are configured through a visual sandbox environment provided by the tenant configuration layer, allowing users to personalize their configurations without relying on code-level modifications. Furthermore, by allocating independent containers and databases to each tenant, physical separation of computing and storage resources is achieved. Dynamic quota management of containers, CPU, and memory is implemented, adjusting storage and computing resources in real time according to the tenant's actual needs, avoiding service anomalies caused by shared resources and preventing resource contention issues in a multi-tenant environment. Finally, an independent tablespace is generated in each tenant's database, achieving precise data isolation. Simultaneously, combined with an SQL routing middleware, during data access, the SQL routing middleware automatically rewrites the initial query request, generating a target query request associated with the tenant ID. This allows for precise data retrieval from the corresponding tenant tablespace based on the target query request, ensuring the accuracy and security of data access, preventing data leakage and interference between tenants, and achieving accurate data access in a multi-tenant environment.
[0015] The present application will now be described in detail through specific embodiments.
[0016] Figure 1 This diagram illustrates the structure of a multi-tenant resource isolation system according to an embodiment of this application. The multi-tenant resource isolation method provided in this embodiment can be implemented through, for example... Figure 1 The system implementation, from Figure 1 As can be seen, the multi-tenant resource isolation system 100 includes a meta-model driving layer 101, a tenant configuration layer 102, a resource isolation layer 103, and a data storage layer 104.
[0017] The metamodel-driven layer 101 defines a variety of digital management business metamodels and includes a dynamic metamodel parsing engine, which is used to generate SQL table structures and business logic code based on the metamodel selected by the tenant.
[0018] Specifically, the metamodel-driven layer 101 predefines various digital management business metamodels, such as human resources models, OA system models, and smart canteen models. The metamodels are described in XML format and cover important information such as field definitions, business processes, and permission rules. The dynamic metamodel parsing engine is responsible for reading the metamodel selected by the tenant, generating corresponding SQL table structures and business logic code based on the metamodel's definition, thereby realizing the system's dynamic logic generation function and supporting the personalized business needs of different tenants.
[0019] Taking the metamodel of a human resources system as an example, its definition is as follows: <metamodel name="HR_System"> <fields> <field name="employee_id" type="string" primaryKey="true" / > <Fieldname="performance_coefficient" type="float" editable="true" / > < / fields> <workflow> <approvalnode name="部门审批" condition="salary_change>10%" >< / approvalnode> < / workflow> < / metamodel> in, <fields>The tag defines the field information: the employee_id field is defined as a string type and is the primary key; the performance_coefficient field is a floating-point type and is editable. <workflow>The tags define the business process; when a salary change exceeds 10%, a "department approval" process is triggered. This application adds field-level dynamic configuration capabilities, allowing tenants to flexibly configure fields according to actual business needs.
[0020] When the metamodel dynamic parsing engine is working, it first reads the metamodel's XML file. By parsing the field definitions in the XML file, it converts them into corresponding SQL table creation statements. For example, for the above human resources metamodel, the generated table creation statements might be as follows: CREATE TABLE TENANT_001_HR_Employee ( employee_id VARCHAR(255) PRIMARY KEY, performance_coefficient FLOAT ); Here, TENANT_001 represents the tenant ID. Table names for different tenants are distinguished by their IDs to ensure data isolation. In the table creation statements, field types and constraints are strictly set according to the meta-model definition to guarantee data integrity and consistency.
[0021] Using a template engine (such as Freemarker), corresponding business logic code is generated based on the process rules defined in the metamodel. Template engines, through predefined templates and data population mechanisms, can quickly generate code that conforms to specific language specifications. For example, let's take generating Java approval process code: if(salaryChange>0.1) { / / Triggering departmental approval process / / Add approval logic here, such as notifying the supervisor, recording approval logs, etc. / / Send notification to supervisor String supervisorEmail = "supervisor@example.com"; String message = "Employee salary changes exceeding 10% require departmental approval"; / / Assume there exists an email sending utility class EmailSender.sendEmail(supervisorEmail, message); / / Record approval log Logger logger = LoggerFactory.getLogger(HRWorkflow.class); logger.info("Employee salary change exceeds 10%, triggering departmental approval process"); } This code determines whether to trigger a departmental approval process based on salary change conditions, and then performs operations such as notifying the supervisor and logging the approval process. Generating code using a template engine not only improves development efficiency but also ensures code standardization and consistency, while also facilitating customized development based on the different business needs of various tenants.
[0022] Tenant configuration layer 102 is configured as a visual sandbox environment, which allows tenants to configure the fields and processes of the target metamodel in the visual sandbox environment, and to perform conflict detection and simulated operation tests through the sandbox verification mechanism when the configuration of the target metamodel is updated.
[0023] Specifically, the tenant configuration layer 102 provides tenants with a visual sandbox environment where they can configure applications according to their own business needs. Through a drag-and-drop designer, tenants can easily customize fields and configure processes without writing complex code to complete application configuration.
[0024] Tenants can add various fields, such as "Employee Performance Coefficient," through simple drag-and-drop operations. After adding fields, they can also set the data type of the fields, including common types such as strings, numbers, and dates. Detailed validation rules can also be defined, such as setting the "Employee Performance Coefficient" field to be a positive number between 0 and 5, ensuring the accuracy and validity of the data.
[0025] Through a graphical interface, tenants can easily design approval workflow branching conditions. For example, when designing a workflow where "department approval requires supervisor signature," tenants can intuitively construct complex business processes by dragging and dropping approval nodes, connecting workflow lines, and setting node conditions and operations. This visual design approach lowers the technical barrier, allowing business personnel to participate in system configuration and improving the integration of business and technology.
[0026] Furthermore, when a tenant makes configuration changes to the metamodel, the sandbox validation mechanism first performs conflict detection. Conflict detection checks whether newly added or modified field names conflict with existing field names and whether there are circular dependencies or unreasonable condition settings in the approval process. For example, regarding field naming, the system checks whether newly added or modified field names conflict with existing field names to ensure the uniqueness of field names within the same tenant. Regarding process configuration, it deeply analyzes whether there are circular dependencies or unreasonable condition settings in the approval process, such as whether two approval nodes depend on each other, causing the process to fail. Through this conflict detection mechanism, potential problems can be identified and resolved in advance, avoiding configuration errors in the production environment.
[0027] To ensure the logical correctness of the configuration, the sandbox verification mechanism generates test data for simulated operation to determine if any anomalies exist in the system. Taking a human resources system as an example, the system automatically generates 1,000 virtual employee records, covering various possible business scenarios such as employee onboarding, performance evaluation, and salary adjustments. Then, this test data is used to simulate the execution of real business processes, checking whether the approval process flows correctly and whether data validation is effective. During the simulation, if problems are found, the system will promptly provide prompts, allowing tenants to adjust and optimize accordingly. This ensures that configuration changes do not affect the business of other tenants, while guaranteeing the stability and reliability of the new configuration in actual use.
[0028] Resource isolation layer 103 is used to allocate independent containers and independent databases to each tenant, and to dynamically manage the CPU and memory resources of the containers.
[0029] In this embodiment, the resource isolation layer 103 utilizes containerization technology (mainly Docker and Kubernetes) and database sharding strategies to achieve physical isolation between computing and storage resources. Each tenant is allocated an independent container and database schema, and Kubernetes is used to precisely manage the CPU and memory resources of the containers, effectively avoiding resource contention issues in a multi-tenant environment and ensuring the stability and performance of each tenant's service.
[0030] Specifically, each tenant is assigned a dedicated container, such as "HR - Container - 001". The container provides an isolated runtime space for the tenant's application, containing all the dependencies required for the application to run, such as the operating system, runtime environment, and library files. This isolation ensures that applications from different tenants do not interfere with each other during operation, improving system stability and security.
[0031] Furthermore, leveraging Kubernetes' powerful resource management capabilities, precise CPU and memory limits can be set for each container. For example, 2 CPU cores and 4GB of memory can be allocated to "HR-Container-001". By setting resource quotas, it is possible to effectively prevent one tenant from affecting the service performance of other tenants due to excessive resource usage, ensuring that each tenant receives stable computing resource support and improving the overall service quality of the system.
[0032] Furthermore, each tenant has an independent database schema, which achieves complete isolation of tenant data at the database level. Each schema has its own independent database objects, such as tables, views, and stored procedures. As the tenant's data volume grows with business development, the system supports dynamic expansion by adding new database nodes or expanding storage capacity to meet the tenant's increasing data storage needs and ensure system scalability.
[0033] Furthermore, by incorporating the RBAC (Role-Based Access Control) model, the system implements fine-grained access control for sensitive fields. For example, "salary information" is sensitive data, accessible only to users with the HR role. The system configures access permissions between roles and fields, performing permission verification when users access data to ensure the security of sensitive data and comply with data security management standards and requirements.
[0034] Data storage layer 104 creates independent tablespaces in each tenant's database. Using SQL routing middleware, it rewrites the initial query request based on the tenant ID, generating a target query request associated with that tenant ID. This target query request is used to extract data from the tenant's tablespace. In this embodiment, the data storage layer 104 generates independent tablespaces for each tenant and, in conjunction with the SQL routing middleware, achieves precise data isolation based on the tenant ID. During data access, the SQL routing middleware automatically rewrites SQL query statements to ensure the accuracy and security of data access and prevent data leakage and interference between tenants.
[0035] Specifically, after receiving the field information configured by the tenant in the low-code designer, the system initiates a table structure parsing process. This process converts the tenant's configured field information into specific SQL table creation statement fragments. For example, if the tenant adds an "employee name" field with a string data type and a maximum length of 50, the system will convert it into a table creation statement fragment like `employee_name VARCHAR(50)`. The system will perform similar processing on all configured fields and combine them into complete table creation statements according to the database's syntax rules.
[0036] Creating a separate tablespace for each tenant is a crucial step in ensuring data isolation. The system assigns a unique tablespace to each tenant based on their tenant ID. For example, the system creates the tablespace "TENANT_001_HR_Employee" for the human resources-related data of tenant "TENANT_001". Within the database, each tablespace has its own independent storage area. This physically isolates the data from different tenants, effectively preventing data interference and leakage risks, while also facilitating the management and maintenance of tenant data.
[0037] In some embodiments, the SQL routing middleware implements dynamic routing functionality based on ShardingShpere technology, ensuring that the system can accurately access data from different tenants.
[0038] Specifically, when an HTTP request arrives at the system, the SQL routing middleware first extracts the tenant ID from the request header. Typically, the tenant ID is passed as a specific field name, such as "X - Tenant - ID: TENANT_001". In this way, the system can quickly identify the tenant to which the request belongs. When the initial query statement, such as SELECT, is received... When using `FROM HR_Employee`, the SQL routing middleware rewrites the query statement based on the extracted tenant ID, transforming it into a query targeting a specific tenant table, such as `SELECT ...`. FROM TENANT_001_HR_Employee. In this way, the system can accurately retrieve data from the corresponding tenant tablespace, achieving accurate data access in a multi-tenant environment while ensuring data security and isolation.
[0039] In this embodiment, by defining multiple metamodels in the metamodel-driven layer, users can select a metamodel according to their actual needs. The fields and processes of the metamodels are configured through a visual sandbox environment provided by the tenant configuration layer, allowing users to personalize their configurations without relying on code-level modifications. Furthermore, by allocating independent containers and databases to each tenant, physical computing and storage resources are implemented. Dynamic quota management of containers, CPU, and memory allows for real-time adjustment of storage and computing resources based on the tenant's actual needs, avoiding service anomalies caused by shared resources and preventing resource contention in a multi-tenant environment. Finally, an independent tablespace is generated in each tenant's database, achieving precise data isolation. Simultaneously, combined with SQL routing middleware, during data access, the SQL routing middleware automatically rewrites the initial query request, generating a target query request associated with the tenant ID. This allows for precise data retrieval from the corresponding tenant tablespace based on the target query request, ensuring the accuracy and security of data access, preventing data leakage and interference between tenants, and achieving accurate data access in a multi-tenant environment.
[0040] It should be noted that this application is not limited to Figure 1 The multi-tenant resource isolation system shown can be any system, device, or framework that can implement the business logic of this application. Figure 1 This is merely an illustrative example.
[0041] In some embodiments of this application, the multi-tenant resource isolation system also includes a version rollback module, which is used to automatically create a version record when a tenant modifies the target metamodel and roll back to a historical version based on the version record.
[0042] Specifically, during the operation of digital management businesses, changes to system configurations may cause business anomalies for various reasons, making version rollback functionality crucial. To enable tenants to restore historical configuration versions, a robust version management mechanism needs to be established.
[0043] Each time a tenant makes a configuration change to the metamodel, the system automatically creates a version record. This version record includes not only the content of the metamodel's XML configuration file, but also the time of the change, the person performing the change, and the specific details of the change (such as adding fields or modifying process rules). This version data is stored in a dedicated version database using an efficient storage structure (such as timestamp-based chained storage) for fast querying and tracing.
[0044] When a tenant needs to roll back a version, they can view a list of historical versions through the system's interface. The list details key information for each version, and the tenant can select the version to roll back to based on their business needs. During the rollback operation, the system first pauses the current business processes related to the metamodel to ensure data consistency. Then, it extracts the metamodel configuration data for the selected version from the version database and overwrites the current configuration. After the configuration replacement is complete, the system restarts the relevant business processes and performs data verification and process testing on key business nodes to ensure business continuity and system stability.
[0045] In some embodiments of this application, the multi-tenant resource isolation system further includes a dependency management module. The dependency management module is used to mark the dependency relationships between metamodels and to perform conflict detection on the version compatibility between the target metamodel and the dependent metamodel when the target metamodel is updated, and to determine the conflict detection result.
[0046] Specifically, in digital management business systems, there are complex dependencies between various meta-models, such as the approval process between the OA system and the human resources management system. Strict dependency management is necessary to ensure the overall stable operation of the system.
[0047] During the metamodel design phase, the dependencies of each metamodel must be clearly labeled. For example, in the human resource management system metamodel, if it involves association with the approval process of the OA system, the version range of the OA system metamodel it depends on, the specific association interface, and the data interaction method must be specified. This dependency information is stored in the metamodel dependency database.
[0048] During metamodel updates or deployments, the system automatically triggers a dependency detection mechanism. The detection program first analyzes the dependencies of the metamodel to be updated, then queries the dependency database to obtain the current version information of the dependent metamodels. It compares the version compatibility of the metamodel to be updated with the dependent metamodels. If version incompatibility is found (e.g., the interface of the dependent metamodel has changed, and the metamodel to be updated is not adapted), the system immediately issues a warning, blocks the update operation, and prompts the user to make appropriate adjustments.
[0049] To resolve dependency conflicts, the system provides several solutions. One approach is version coordination, which involves upgrading or downgrading conflicting metamodel versions to ensure compatibility. Another approach is to refactor the dependency interfaces of the metamodel, ensuring that dependency conflicts are resolved without affecting business functionality. During the conflict resolution process, the system simulates and tests relevant business processes to verify the effectiveness of the solutions.
[0050] In some embodiments of this application, the data storage layer further includes a routing cache module, which is used to store the mapping relationship between tenant IDs and table names.
[0051] Specifically, to reduce the overhead of parsing the tenant ID-table name mapping relationship in the SQL routing middleware and improve query efficiency, this application introduces a caching mechanism. A distributed caching technology (such as Redis) is used to build a cache server cluster. The cache server cluster is deployed in a network location close to the business servers to reduce network latency. When the SQL routing middleware starts, frequently used tenant ID-table name mapping relationships are pre-loaded into the cache. These mapping relationships come from the system's configuration database and are synchronized during the system initialization phase.
[0052] When the SQL routing middleware receives an HTTP request, it first looks up the table name corresponding to the tenant ID in the cache. If the cache is hit, the table name is directly retrieved for SQL rewriting, avoiding the overhead of querying the mapping relationship from the database. If the cache is not hit, the middleware queries the mapping relationship from the configuration database and writes the query result into the cache for later use. To ensure the consistency of cached data, the system sets a cache expiration time (e.g., 5 minutes). Within the expiration time, if the mapping relationship in the configuration database changes, the system promptly notifies the cache server to update the data via a message queue (e.g., Kafka).
[0053] In addition, the routing caching module is also used to clear the least recently used cached data when cache space is insufficient. Specifically, the cache eviction policy adopts the LRU (Least Recently Used) algorithm. When cache space is insufficient, the system automatically evicts the least recently used cached data to make room for new mapping relationships. At the same time, the cached data is cleaned and optimized regularly, deleting invalid or expired cached items to improve cache utilization.
[0054] In some embodiments of this application, the system further includes a data aggregation module for aggregating data from various tenants.
[0055] Specifically, administrators can use the MySQL Federated engine to create global views, enabling aggregated display of data across tenants. For example, to create the "Global_HR_View" view, the creation statement is as follows: CREATE TABLE Global_HR_View ( tenant_id VARCHAR(20), employee_count INT)ENGINE=FEDERATED CONNECTION='mysql: / / ...'; In this view, tenant_id represents the tenant ID, and employee_count represents the number of employees per tenant. This view allows administrators to easily summarize and view employee count information for each tenant, providing data support for overall human resource management and decision-making within the enterprise.
[0056] In this embodiment of the application, cross-tenant data integration and analysis are achieved without migrating the original data, which ensures data security and improves the utilization value of the data.
[0057] In some embodiments of this application, the system further includes a gateway aggregation module, which is used to call data from each tenant based on cross-tenant query requests and generate reports.
[0058] Specifically, before conducting cross-tenant queries, the API gateway rigorously verifies the administrator's identity using the OAuth 2.0 protocol. Only authenticated administrators can initiate cross-tenant query requests, preventing unauthorized access and data leakage. Furthermore, upon receiving a legitimate query request, the API gateway calls the APIs of each tenant to retrieve the corresponding data. Then, it integrates and processes the retrieved data according to the query requirements to generate reports. Throughout this process, the original data remains stored in the respective tenant's database and is not migrated, effectively ensuring data security and privacy. Simultaneously, the unified management and scheduling by the API gateway improves the efficiency and stability of cross-tenant data queries.
[0059] In this embodiment, cross-tenant query functionality is implemented through an API gateway to ensure the security and efficiency of data access.
[0060] Figure 2 This paper illustrates a flowchart of a multi-tenant resource isolation method provided in an embodiment of this application. Figure 2 It can be seen that this application includes at least steps S101-S106: Step S101: In response to the target meta-model selected by the tenant, generate the corresponding SQL table structure and business logic code based on the dynamic parsing engine.
[0061] Step S102: Based on the tenant's update operations on the fields and processes of the target metamodel in the visual sandbox environment, conflict detection and simulation test are performed through the sandbox verification mechanism when the configuration of the target metamodel is updated.
[0062] Step S103: Allocate independent containers and independent databases to tenants, and dynamically manage the CPU and memory resources of the containers.
[0063] Step S104: Create an independent tablespace in the independent database and store the tenant's data in the corresponding independent tablespace.
[0064] Step S105: Upon receiving a query request, control the SQL routing middleware to convert the query request into a target query request based on the tenant ID.
[0065] Step S106: Extract data from the tenant's dedicated tablespace based on the target query request.
[0066] For details on the implementation of steps S101-S106, please refer to [link / reference]. Figure 1 The specific implementation methods corresponding to the embodiments shown will not be described in detail here.
[0067] from Figure 2 As shown in the method, in this application, users can select the metamodel according to their actual needs and configure the fields and processes of the metamodel through the visual sandbox environment provided by the tenant configuration layer. This allows users to personalize the configuration according to their own needs without relying on code-level modifications. Furthermore, by allocating independent containers and databases to each tenant, physical computing and storage resources are implemented. Through dynamic quota management of containers and CPU memory, storage and computing resources are adjusted in real time according to the actual needs of the tenants, avoiding service anomalies caused by shared resources and avoiding resource contention issues in a multi-tenant environment. Finally, an independent tablespace is generated in each tenant's database to achieve precise data isolation. At the same time, combined with the SQL routing middleware, during the data access process, the SQL routing middleware automatically rewrites the initial query request to generate a target query request associated with the tenant ID. This allows for accurate data retrieval from the corresponding tenant tablespace based on the target query request, ensuring the accuracy and security of data access, preventing data leakage and interference between tenants, and achieving accurate data access in a multi-tenant environment.
[0068] In some embodiments of this application, the mapping relationship between tenant ID and table name is cached. In response to receiving a query request, the table name corresponding to the tenant ID is searched in the cache. If the cache is hit, the query request is converted into a target query request based on the table name in the cache. If the cache is not hit, the mapping relationship is queried from the configuration database and the query result is written into the cache.
[0069] In this embodiment of the application, by setting up a cache, the overhead of parsing the mapping relationship between tenant ID and table name in the SQL routing middleware is reduced, thereby improving query efficiency.
[0070] In some embodiments of this application, upon receiving a cross-tenant query request, the identity of the tenant is verified. In response to the successful authentication of the tenant, the API of each tenant is called to obtain tenant data, and a report is generated based on the tenant data of each tenant.
[0071] In this embodiment, cross-tenant query functionality is implemented through an API gateway to ensure the security and efficiency of data access.
[0072] The following example, using a multi-tenant human resource management system deployment, illustrates the multi-tenant resource isolation method provided in this application: 1. Tenant Registration: Company A registers in the system and receives a unique ID "TENANT_001" upon successful registration. This ID will serve as Company A's identifier in the system and will be used for various subsequent operations, such as data storage, resource allocation, and access control.
[0073] 2. Metamodel Selection: After logging into the system's visual configuration sandbox, the administrator of Company A selects the "Human Resource Management" template from the metamodel library. This template provides the basic framework and functional modules of the human resource management system. Based on Company A's actual business needs, the administrator adds personalized requirements to the template, such as adding a "Year-End Bonus Calculation Rules" field. When adding fields, the administrator can set the data type (e.g., numeric), validation rules (e.g., must be greater than 0), etc., to ensure the accuracy and usability of the fields.
[0074] 3. Sandbox Validation: To ensure the correctness and stability of the configuration, the system performs sandbox validation. The system simulates 1000 employee data entries, covering various possible business scenarios, such as employees with different performance coefficients and different salary changes. Then, this test data is used to comprehensively test the approval process, checking for issues such as field conflicts and process deadlocks. If problems are found during testing, the system will promptly provide feedback to the administrator, who can then make adjustments and optimizations based on the prompts. Only after all conflicts are detected and the process runs normally can the administrator release the configuration to the production environment.
[0075] 4. Database: Based on Company A's configuration information, the system generates the "TENANT_001_HR_Employee" table in the database. This table not only contains the fields from the "Human Resources Management" template but also includes the "Year-End Bonus Calculation Rules" field, which was added by the administrator. During the table creation process, the system sets the corresponding data types and constraints according to the field definitions to ensure data integrity and consistency.
[0076] 5. Container: The system starts a Docker container "HR-Container-001" and allocates 2 CPU cores and 4GB of memory to it. During the container startup process, Enterprise A's human resource management application and its dependencies are deployed into the container. Through containerization technology, Enterprise A's human resource management system is isolated from other tenant systems, ensuring system performance and security.
[0077] 6. User Query: When an employee of Company A initiates a request to " / api / employee", the request first reaches the SQL routing middleware. The SQL routing middleware extracts the tenant ID "TENANT_001" from the request header and then rewrites the general query statement as a query targeting the "TENANT_001_HR_Employee" table. In this way, the system can accurately retrieve employee data from Company A's dedicated tablespace and return it to the requesting employee, ensuring the accuracy and security of data access.
[0078] 7. Administrator Monitoring: Administrators at Company A can view the total number of employees across all tenants through the "Global_HR_View". After logging into the system's management interface, administrators can execute corresponding queries. The system will retrieve employee count information from each tenant's database and summarize it in the "Global_HR_View". This allows administrators to easily manage and analyze personnel globally, providing data support for the company's strategic decision-making.
[0079] The multi-tenant resource isolation method provided in this application achieves the following technical effects: 1. Enhanced data isolation security: Data isolation is achieved through a dual mechanism of independent tablespaces and dynamic routing, effectively reducing the risk of data leakage; 2. Enhanced configuration flexibility: The combination of a visual sandbox and dynamic metamodel parsing meets the "reproducibility of technical effects" standard, improving system scalability; 3. Reduced risk of resource conflicts: Service anomalies caused by resource contention are reduced, ensuring system stability; 4. Optimized performance and stability: Dynamic optimization of the metamodel and efficient development capabilities of the low-code platform improve system performance and enhance stability in a multi-tenant environment.
[0080] In some embodiments of this application, a multi-tenant resource isolation device is provided, which corresponds one-to-one with the multi-tenant resource isolation methods described in the above embodiments. For example... Figure 3 As shown, the multi-tenant resource isolation device includes a generation module 101, a detection module 102, an allocation module 103, a storage module 104, a conversion module 105, an extraction module 106, a caching module 107, a lookup module 108, and a verification module 109.
[0081] The generation module 101 is used to generate the corresponding SQL table structure and business logic code based on the dynamic parsing engine in response to the target meta-model selected by the tenant. The detection module 102 is used to perform conflict detection and simulated operation tests through the sandbox verification mechanism when the target metamodel is updated, based on the tenant's update operations on the fields and processes of the target metamodel in the visual sandbox environment. The allocation module 103 is used to allocate independent containers and independent databases to tenants, and to dynamically manage the CPU and memory resources of the containers. Storage module 104 is used to create independent tablespaces in an independent database and store tenant data in the corresponding independent tablespaces; The conversion module 105 is used to receive a query request and control the SQL routing middleware to convert the query request into a target query request based on the tenant ID; Extraction module 106 is used to extract data from the tenant's dedicated tablespace based on the target query request.
[0082] In some embodiments of this application, in the above-described apparatus, the caching module 107 is used to cache the mapping relationship between tenant ID and table name; the lookup module 108 is used to look up the table name corresponding to the tenant ID from the cache in response to receiving a query request; if the cache is hit, the conversion module 105 is used to convert the query request into a target query request based on the table name in the cache; if the cache is not hit, the lookup module 108 is also used to query the mapping relationship from the configuration database and write the query result into the cache.
[0083] In some embodiments of this application, in the above-described apparatus, the verification module 109 is used to receive a cross-tenant query request and verify the identity of the tenant; the extraction module 106 is also used to call the API of each tenant to obtain tenant data in response to the successful authentication of the tenant; and the generation module 101 is also used to generate reports based on the tenant data of each tenant.
[0084] It should be noted that any of the above-mentioned multi-tenant resource isolation devices can implement the aforementioned multi-tenant resource isolation method one by one, which will not be elaborated here.
[0085] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of this application is shown. Figure 4 As shown, at the hardware level, this electronic device includes a processor, and optionally also includes an internal bus, a network interface, and memory. The memory may include main memory, such as high-speed random-access memory (RAM), or it may include non-volatile memory, such as at least one disk drive. Of course, this electronic device may also include other hardware required for other business operations.
[0086] The processor, network interface, and memory can be interconnected via an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 4 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.
[0087] Memory is used to store programs. Specifically, programs may include program code, which includes computer operation instructions. Memory may include main memory and non-volatile memory, and provides instructions and data to the processor.
[0088] The processor reads the corresponding computer program from non-volatile memory into main memory and then runs it, forming a multi-tenant resource isolation device at the logical level. The processor executes the program stored in memory and specifically performs the aforementioned methods.
[0089] The processor may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in the memory, and the processor reads the information in the memory and, in conjunction with its hardware, completes the steps of the above method.
[0090] The electronic device can execute the multi-tenant resource isolation method provided in several embodiments of this application, and is implemented as a multi-tenant resource isolation device. Figure 3 The functions of the embodiments shown are not described in detail here.
[0091] This application also proposes a computer-readable storage medium that stores one or more programs, the programs including instructions that, when executed by an electronic device including multiple applications, enable the electronic device to perform the multi-tenant resource isolation method provided in several embodiments of this application.
[0092] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0093] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0094] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0095] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0096] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.
[0097] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.
[0098] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.
[0099] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0100] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0101] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.< / workflow> < / fields>
Claims
1. A multi-tenant resource isolation system, characterized in that, The system includes: The metamodel-driven layer includes various digital management business metamodels and a dynamic metamodel parsing engine. The dynamic metamodel parsing engine is used to generate SQL table structures and business logic code based on the target metamodel selected by the tenant. The tenant configuration layer is configured as a visual sandbox environment, which allows tenants to configure the fields and processes of the target metamodel in the visual sandbox environment, and to perform conflict detection and simulated test runs through the sandbox verification mechanism when the configuration of the target metamodel is updated. The resource isolation layer is used to allocate independent containers and independent databases to each tenant, and to dynamically manage the CPU and memory resources of the containers. The data storage layer creates an independent tablespace in each tenant's database. Combined with the SQL routing middleware, it rewrites the initial query request based on the tenant ID and generates a target query request associated with the tenant ID. The target query request is used to extract data from the tenant's tablespace.
2. The system according to claim 1, characterized in that, The system also includes a version rollback module and a dependency management module; The version rollback module is used to automatically create a version record when a tenant modifies the target metamodel, and roll back to a historical version based on the version record; The dependency management module is used to mark the dependencies between metamodels and to perform conflict detection on the version compatibility between the target metamodel and the dependent metamodels when the target metamodel is updated, and to determine the conflict detection result.
3. The system according to claim 1, characterized in that, The conflict detection is used to detect whether newly added or modified field names conflict with existing field names and whether there are circular dependencies or unreasonable condition settings in the approval process. The simulation is used to run the system based on test data to determine if there are any abnormal problems.
4. The system according to claim 1, characterized in that, The data storage layer also includes a routing cache module, which is used to store the mapping relationship between tenant IDs and table names; The routing cache module is also used to clear the least frequently used cached data when the cache space is insufficient.
5. The system according to claim 1, characterized in that, The system also includes a data aggregation module and a gateway aggregation module, wherein the data aggregation module is used to aggregate data from each tenant; The gateway aggregation module is used to retrieve data from each tenant based on cross-tenant query requests and generate reports.
6. A multi-tenant resource isolation method, characterized in that, The method includes: In response to the target metamodel selected by the tenant, the corresponding SQL table structure and business logic code are generated based on the dynamic parsing engine. Based on the tenant's update operations on the fields and processes of the target metamodel in the visual sandbox environment, conflict detection and simulated operation tests are performed through the sandbox verification mechanism when the configuration of the target metamodel is updated. Allocate independent containers and independent databases to tenants, and dynamically manage the CPU and memory resources of the containers; Create separate tablespaces in separate databases and store tenant data in the corresponding separate tablespaces; Upon receiving a query request, the SQL routing middleware is controlled to convert the query request into a target query request based on the tenant ID. Based on the target query request, data is extracted from the tenant's dedicated tablespace.
7. The method according to claim 6, characterized in that, The method further includes: Cache the mapping relationship between tenant IDs and table names; In response to receiving a query request, look up the table name corresponding to the tenant ID from the cache; If the cache is hit, the query request will be transformed into the target query request based on the table name in the cache. If the cache is not hit, query the mapping relationship from the configuration database and write the query result to the cache.
8. The method according to claim 6, characterized in that, The method further includes: Upon receiving a cross-tenant query request, verify the tenant's identity; In response to successful tenant authentication, the system calls the respective tenant's API to retrieve tenant data. Reports are generated based on tenant data for each tenant.
9. An electronic device, comprising: processor; as well as A memory configured to store computer-executable instructions, characterized in that, when executed, the executable instructions cause the processor to perform the steps of the multi-tenant resource isolation method as described in any one of claims 6-8.
10. A computer-readable storage medium storing one or more programs, characterized in that, When the one or more programs are executed by an electronic device including multiple applications, the electronic device performs the steps of the multi-tenant resource isolation method as described in any one of claims 6-8.