Service isolation data transmission methods, apparatus, computer equipment and storage media

Abstract

This application belongs to the field of shared isolation of service resources, and relates to a service isolation data transmission method. The method includes determining the user's tenant based on the type of service requested and the user's role, and generating an access request. If the requested service data is not stored in the first service unit, a second service unit connected to the first service unit is accessed via a communication template to obtain the requested service data. The obtained service data is then returned to the user. This application also provides a service isolation data transmission apparatus, computer equipment, and storage medium. This application obtains data by accessing the corresponding service unit using the tenant's identity, and aggregates related service data stored in different service units into a single service unit before returning it to the user. This approach facilitates separate processing of user access and operations on data, effectively improving data processing efficiency and enhancing data security.

Description

Technical Field

[0001] This application relates to the field of shared isolation technology for service resources, and in particular to a service isolation data transmission method, apparatus, computer equipment, and storage medium. Background Technology

[0002] Databases are used to store data generated or invoked by upper-layer services. As the types of services increase and the volume of business grows, the amount of data stored in the database surges, and the types of data become increasingly complex. This data, for its owners, constitutes important trade secrets. Different data will be accessed by different services. Some data, such as identity verification data, is used in multiple services and is accessed frequently; while some data is only used by a few services and is accessed much less frequently than the former.

[0003] The original database simply created tables from this data and linked them according to the relationships between the tables. During access, the data tables were directly controlled for confidentiality through authentication. This database storage method is completely unsuitable for supporting large workloads and high concurrency services, resulting in a large number of database access errors and affecting the normal operation of the database.

[0004] The existing approach first controls the stability of data flow in the database by setting up mapping tables and controlling access to different mapping tables by users with different identities. Then, different services are routed according to user identities. However, since the mapping table is only a mapping and has a data source, the data operations performed by the service must ultimately be reflected in the corresponding data table. If multiple concurrent tasks operate on the same data table at the same time, it will cause misreads, dirty reads, and other problems. Therefore, a certain scheduling method is needed to execute data table operations. While one process is modifying a data table, the data table is locked, which greatly hinders other processes from operating on the database. This data isolation scheme is still not suitable for multi-task, high-concurrency database storage application scenarios. Summary of the Invention

[0005] The purpose of this application is to propose a service-isolated data transmission method to achieve service-isolated transmission of resources in a high-concurrency database.

[0006] To address the aforementioned technical problems, this application provides a service isolation data transmission method, which employs the following technical solution:

[0007] A service-isolated data transmission method includes the following steps:

[0008] The user's tenant is determined based on the type of service requested by the user and the user's role, and an access request is generated.

[0009] The tenant's access request is sent to the first service unit, which stores the service data.

[0010] Determine whether the tenant has permission to access the service data of the first service unit;

[0011] If the user has permission to access the service data of the first service unit, then determine whether the service data requested in the access request is stored in the first service unit being accessed.

[0012] If the requested service data is stored in the first service unit being accessed, then the requested service data is retrieved from the first service unit.

[0013] If the requested service data is not stored in the first service unit being accessed, then the second service unit that is connected to the first service unit is accessed through the communication template, and the requested service data is obtained from the second service unit.

[0014] The obtained service data will be returned to the user.

[0015] Furthermore, the step of determining the user's tenant based on the type of service requested by the user and the user's role, and generating an access request specifically includes:

[0016] Based on the type of service requested by the user and the service data corresponding to that type of service, determine the data types included in the service accessed by the user;

[0017] Determine the data type the user intends to access based on the user's role and the data types included in the service;

[0018] Based on the user's role and the type of data they intend to access, determine the frequency of their access and the amount of data they interact with, in order to identify the tenant to which the user belongs.

[0019] Bind users to their respective tenants and generate access requests based on the tenant's identity.

[0020] Furthermore, based on the user's role and the data types included in the service, the specific data types that the user intends to access include:

[0021] Record the data type accessed by each role by analyzing the field information manipulated during each access;

[0022] Count the number of accesses of the same role and the access frequency. Based on the access frequency, determine the data type that the current role intends to access from the data types included in the service.

[0023] Furthermore, sending the tenant's access request to the first service unit specifically involves balancing the tenant's access load across the nodes in the first service unit based on the frequency and number of interactions of the tenant's access request.

[0024] Furthermore, the process of balancing the access load of tenants to each node in the first service unit specifically includes: assigning tenants with a large amount of access to nodes with a small amount of tasks, and / or assigning users with a high access frequency to nodes with more execution threads and stronger multi-threading capabilities.

[0025] Furthermore, the first service unit stores associated data related to the first service unit and its correspondence with the second service unit; the step of accessing the second service unit, which is connected to the first service unit via a preset communication protocol, and obtaining the requested service data from the second service unit specifically includes:

[0026] Based on the correspondence between the associated data of the first service unit and the second service unit, determine the second service unit where the service data requested by the tenant is stored;

[0027] The first service unit establishes a link with the second service unit through a preset communication protocol and sends the requested service data and the correspondence between the requested service data and the first service unit, so that the second service unit can determine the correspondence between the requested service data and the first service unit.

[0028] Receive the service data requested by the second service unit.

[0029] Furthermore, the service data includes primary data and secondary data, wherein the secondary data has the same data type and content as the primary data; the step of obtaining the requested service data from the first service unit specifically includes:

[0030] Identify the category of service data requested by the access request stored on the first service unit;

[0031] If it is subordinate data, determine the second service unit for the corresponding primary data storage based on the subordinate data;

[0032] The subordinate data will be synchronized with the main data on the second server module;

[0033] The synchronized slave data is returned to the tenant. The data type the user intends to access is determined.

[0034] To address the aforementioned technical problems, this application also provides a service isolation data transmission device, which employs the following technical solution:

[0035] A service-isolated data transmission apparatus, comprising:

[0036] The generation module is used to determine the user's tenant based on the type of service the user requests to access and the user's role, and to generate an access request.

[0037] The request module is used to send the tenant's access request to the first service unit, which stores service data; it is also used to return the obtained service data to the user.

[0038] The judgment module is used to determine whether the tenant has permission to access the service data of the first service unit. If the user has permission to access the service data of the first service unit, it determines whether the service data requested in the access request is stored in the accessed first service unit; and

[0039] The acquisition module retrieves the requested service data from the first service unit if the requested service data is stored in the first service unit being accessed; otherwise, it accesses the second service unit that is connected to the first service unit via a communication template and retrieves the requested service data from the second service unit.

[0040] To address the aforementioned technical problems, this application also provides a computer device that employs the steps of a service isolation data transmission method as described above.

[0041] To address the aforementioned technical problems, this application also provides a computer-readable storage medium that employs the steps of the service isolation data transmission method described above.

[0042] Compared with the prior art, the embodiments of this application have the following advantages: This solution stores data in different service units according to service types, and associates users with tenants. Through the management of tenants, users are assigned to different tenants according to the types of data they access, and they use the identity of the tenant to access the corresponding service unit to obtain data. The related data stored in different service units are aggregated in one service unit and returned to the user through the network inside the service unit. This solution is conducive to processing user access and operation of data separately, which can effectively improve the efficiency of data processing and enhance data security. Attached Figure Description

[0043] To more clearly illustrate the solutions in this application, the accompanying drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 This is an exemplary system architecture diagram to which this application can be applied;

[0045] Figure 2 A flowchart of an embodiment of a service isolation data transmission method according to this application;

[0046] Figure 3 yes Figure 2 A flowchart of a specific implementation of step S100;

[0047] Figure 4 yes Figure 2 A flowchart of a specific implementation of step S500-2;

[0048] Figure 5 yes Figure 2 A flowchart of a specific implementation of step S500-1;

[0049] Figure 6 This is a schematic diagram of one embodiment of a service-isolated data transmission apparatus according to this application;

[0050] Figure 7 This is a schematic diagram of the structure of one embodiment of the computer device according to this application.

[0051] Figure label:

[0052] 41 – Generation Module, 42 – Request Module, 43 – Judgment Module, 44 – Acquisition Module, 441 – Internal Interaction Submodule, 442 – Verification Submodule, 443 – Data Synchronization Submodule Detailed Implementation

[0053] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein in the specification of the application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application; the terms "comprising" and "having," and any variations thereof, in the specification, claims, and foregoing drawings of this application, are intended to cover non-exclusive inclusion. The terms "first," "second," etc., in the specification, claims, or foregoing drawings of this application are used to distinguish different objects, not to describe a particular order.

[0054] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0055] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0056] like Figure 1 As shown, system architecture 100 may include terminal devices 101, 102, and 103, a network 104, and a server 105. Network 104 serves as the medium for providing communication links between terminal devices 101, 102, and 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0057] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social media platform software, etc.

[0058] Terminal devices 101, 102, and 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III), MP4 players (Moving Picture Experts Group Audio Layer IV), laptops, and desktop computers, etc.

[0059] Server 105 can be a server that provides various services, such as a backend server that supports the pages displayed on terminal devices 101, 102, and 103.

[0060] It should be noted that the service isolation data transmission method provided in this application embodiment is generally executed by a server / terminal device, and correspondingly, a service isolation data transmission device is generally set in the server / terminal device.

[0061] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0062] Continue to refer to Figure 2 The diagram illustrates a flowchart of an embodiment of a service-isolated data transmission method according to this application. The service-isolated data transmission method includes the following steps:

[0063] Step S100: Determine the user's tenant based on the type of service the user requests to access and the user's role, and generate an access request.

[0064] In the process of request control for user access, each service type is associated with one or a limited number of tenants, and each tenant has a fixed identity during program execution. When a user accesses the database, they use the tenant's identity. There is a clear correspondence between services and tenants, thus controlling user data access. In the embodiments of this application, an identity table is set up, recording all tenants, as well as the service types and roles corresponding to each tenant. During the access request control process, the service type and user role in the user request are read, and the identity table is queried. Based on the requested service, several sets of tenants are determined, and the most suitable tenant is selected and used based on the user's access role to generate the access request. One tenant can simultaneously correspond to several users, providing access processes to multiple users concurrently.

[0065] A server cluster may use a single database to provide data support for multiple service types. Typically, each service type corresponds to a set of user interfaces, a set of business logic, and a portion of the data in the database. Categorizing access based on service type can effectively clarify the data type that the user intends to access.

[0066] Step S200: Send the tenant's access request to the first service unit, where the first service unit stores service data.

[0067] After a user rents a tenant's identity, their requests are sent to the corresponding first service unit in the tenant's name. Because there is a specific correspondence between tenants and first service units, the tenant can only send requests to the first service unit. This achieves isolation of user access between different services, ensuring that a service can only receive requests from a limited number of tenants. Furthermore, since these requests are all based on this single service, the data operations are largely consistent or follow predictable patterns, thereby accelerating the data processing efficiency of the first service unit. The first service unit only stores service data corresponding to the service type, and each service unit only needs to control a few relevant data tables or fields within those tables. This significantly reduces the overhead of implementing access control.

[0068] Step S300: Determine whether the tenant has permission to access the service data of the first service unit.

[0069] The first and second service units communicate via a link to exchange or synchronize data. The first and second service units usually belong to the same or adjacent intranets and have a complete security system outside the network where the service units are located. The communication overhead between them is relatively small and can ensure security. Therefore, by integrating data through communication between the first and second service units and interacting with the outside world through a single first service unit, the security and efficiency of data access are guaranteed.

[0070] The first service unit and the second service unit still need to determine the correlation between the interactive data and the first service unit in order to verify whether the corresponding first service unit has the authority to process the relevant data.

[0071] Step S400: If the user has permission to access the service data of the first service unit, then determine whether the service data requested by the access request is stored in the accessed first service unit.

[0072] Users request service data by renting a tenant identity. The tenant's role also reflects the user's permissions. For ordinary users, they can only access service data that matches their identity. By verifying the user role corresponding to the tenant, the scope of service data they can access is determined, and whether the tenant has the permission to obtain the requested service data is confirmed. Service units store service data corresponding to service types. Some service data is interrelated across multiple services. Data related to the first service unit may be stored in the second service unit, or it may need to be synchronized with related service data in the second service unit to maintain data accuracy. Upon receiving an access request and confirming that the tenant's identity is authorized to obtain the corresponding data, it is determined whether the requested data is stored in the first service unit to determine how to return the requested service data to the tenant.

[0073] If the requested service data is stored in the first service unit being accessed, then execute step S500-1: retrieve the requested service data from the first service unit.

[0074] Otherwise, proceed to step S500-2, access the second service unit that is connected to the first service unit through the communication template, and obtain the requested service data from the second service unit.

[0075] When the service data requested by the tenant is not in the first service unit, the first service unit needs to interact with the second service unit where the data is located to obtain the corresponding data and return it to the tenant. During the access process, the first service unit requests the content information of the corresponding field under a topic from the corresponding second service unit through the communication template.

[0076] Step S600: Return the acquired service data to the user.

[0077] Data is centralized in the first service unit and forwarded to the corresponding tenants through this unit. Requests and retrieval of service data are transmitted using internal protocols between service units, avoiding the confusion caused by tenants directly accessing multiple service units. This facilitates the management and access control of service data.

[0078] This solution categorizes users and binds them to tenant identities. Users access a primary service unit through their tenant identity to retrieve relevant service data. The primary service unit itself maintains only a small amount of data associated with the corresponding service and synchronizes with a secondary service unit via an internal communication link. All service-related data is then aggregated and returned to the tenant, ensuring that the access processes and accessed service data are isolated between different user types. This allows for simultaneous access by different user types without interference, facilitating standardized and convenient business management, significantly reducing security risks, and improving access management efficiency.

[0079] In this embodiment, a service-isolated data transmission method operates on an electronic device (e.g., Figure 1 The server / terminal device shown can enable mutual access between tenants, the first service unit, and the second service unit via wired or wireless connections. It should be noted that the aforementioned wireless connection methods may include, but are not limited to, 3G / 4G connections, WiFi connections, Bluetooth connections, WiMAX connections, Zigbee connections, UWB (ultra-wideband) connections, and other currently known or future-developed wireless connection methods.

[0080] Furthermore, in some embodiments, the step of determining the user's tenant based on the type of service requested by the user and the user's role, and generating an access request, specifically includes:

[0081] Step S101: Determine the data types included in the services accessed by the user based on the type of service requested by the user and the service data corresponding to the type of service.

[0082] In this scheme, data is stored in a distributed manner according to services and interacts with the outside world as resources on different service units. In this state, a specific service type usually corresponds to some data types. Therefore, the data types that the user will interact with the service unit after the communication link is established can be determined according to the service type accessed by the user.

[0083] Step S102: Determine the data type that the user intends to access based on the user's role and the data types included in the service;

[0084] After clarifying the data types that the user can interact with the first service unit after establishing this communication link, the user's role in the service during this access request can be further used to determine the data types the user intends to access within that first service unit. Different roles within the service have different data type preferences. As an example, a performance evaluation management system includes at least two roles: sales personnel and managers. Sales personnel, when accessing the first service unit, tend to obtain data types such as performance points for individual projects, related deadlines and amounts, and project memos. Managers, on the other hand, tend to obtain statistical data such as employee performance rankings and departmental and project team cash flow. Clearly, different roles have different preferences for accessing different data types, which can be differentiated through prior access control statistics. Specifically, by recording the field information operated on during each access, the access requests generated by each role are recorded, along with the access frequency for each field. Based on these access frequencies, the data types that a role tends to access are determined.

[0085] Step S103: Determine the frequency of access and the amount of data interacted based on the user's role and the type of data they intend to access, in order to determine the tenant to which the user belongs;

[0086] Based on user roles and access data type preferences, and using daily statistical records of each user's access requests, the system establishes the accessed data and determines the data types that users with certain roles intend to access during the access process. Based on these intended data types, users are associated with tenants, and tenants are associated with one or more users simultaneously. Users access the first data unit by renting a tenant identity. To facilitate application load balancing on the first data unit, tenants can send access requests to multiple nodes within the first data unit. During this process, based on the characteristics exhibited during tenant access, appropriate nodes are selected to establish connections. This maximizes the efficient use of existing hardware resources, and users associated with a single tenant exhibit similar characteristics during access, which also facilitates efficient scheduling of nodes during load tasks, thereby improving their work efficiency.

[0087] Step S104: Bind the user to the tenant and generate an access request in the tenant's identity.

[0088] The access request is issued in the name of the tenant. After the user binds the tenant identity, the network device that generates the request can determine the tenant's identity and the corresponding first service unit by reading the corresponding fields in the request. The first service unit can then determine the data that the user is requesting to access through the tenant's identity by reading the request. In this way, a corresponding access request is generated and sent to the first service unit.

[0089] Furthermore, in some embodiments, the tenant's access request is sent to the first service unit, specifically by balancing the tenant's access load across the nodes in the first service unit based on the access frequency and number of interactions of the tenant's access request.

[0090] Specifically, the first service unit can be a single computer device or a server group composed of several computer devices. Based on the computing power of each device in the server group and the current business load, tenants or each request are allocated to the corresponding computer device to achieve a balance of computing power. Regarding tenant allocation, during the process of a user renting a tenant identity, traffic is distributed based on access frequency and the number of interactions. For a single tenant, the access frequency and number of interactions generated under their name follow a predictable pattern. Based on the workload and business type that each node in the first service unit needs to handle, the connections generated by the tenant are allocated to various nodes within the module. Specifically, tenants with higher access volumes are assigned to nodes with lower workloads, and users with higher access frequencies are assigned to nodes with more execution threads and stronger multi-threading capabilities. This helps improve the overall execution efficiency of the first service unit in handling tenant access.

[0091] Furthermore, in some embodiments, the first service unit and the second service unit respectively store service data, and the first service unit also stores related data and the correspondence between the first service unit and the second service unit.

[0092] The smallest unit for data storage is typically a data table, which stores a portion of the service data from the database through a limited number of fields. In this embodiment, different data tables may be stored in different service units, but the service data within these tables is interconnected, and tenants may simultaneously access service data from different data tables. The correspondence between the associated data stored in the first service unit and the second service unit is such that when a user requests service data from the first service unit, but the service data is not stored there, the first service unit will determine the second service unit where the requested service data is stored by retrieving record data. The service data requested by the user is the associated data from the first service unit.

[0093] Based on this, the steps of accessing the second service unit, which is connected to the first service unit via a communication template, and obtaining the requested service data from the second service unit specifically include:

[0094] Step S501: Based on the correspondence between the service data related to the first service unit and the second service unit, determine the second service unit where the service data requested by the tenant is stored.

[0095] When it is determined that the requested service data is not stored in the first service unit, the second storage unit where the requested data is stored is determined based on the associated data stored in the first service unit, and this unit is used as the source of service data acquisition. The aforementioned service data is then aggregated into the first storage unit and sent to the tenant.

[0096] Step S502: Establish a link between the first service unit and the second service unit, and send the requested service data and the correspondence between the requested service data and the first service unit, so that the second service unit can determine the correspondence between the requested service data and the first service unit.

[0097] The first service unit sends a request to the second service unit requesting the mapping relationship between the requested service data and the first service unit. This mapping relationship can be proven through field numbers, join relationships between data tables, etc. The second service unit determines that the requested service data is relevant to the first service unit, and then allows the first service unit to access the second service unit to obtain the corresponding service data. The service data is centralized in the first service unit and transmitted to the tenant. The second service unit is transparent to the tenant.

[0098] Step S503: Receive the service data requested by the second service unit.

[0099] The second service unit confirms the correspondence between the requested data item and the first service unit, determines that the first service unit has the authority to operate on the relevant data, and then returns the data corresponding to the requested data item. This scheme can aggregate the service data required by the user in the first service unit through the link between service units and transmit it to the user in a unified manner, ensuring the security of data access and reducing the complexity of controlling the link.

[0100] Furthermore, a set of data stored in a first service unit or a second service unit is set as the primary data, and other first service units and / or second service units store subordinate data with the same data type and content as the primary data, and the subordinate data is synchronized with the primary data.

[0101] Specifically, different service units may use the same set of data simultaneously. This situation may occur between foreign keys in different data tables, or between service logic of different services corresponding to the same original data table. The former can be verified through the relationship between data tables, while the latter assigns the same set of data to different service units, which have no direct relationship with each other, and is prone to data misreading. Setting primary data and subordinate data and synchronizing them with each other can maintain the accuracy of the data.

[0102] Based on this, it is determined whether the main data obtained by the tenant is stored on the first service unit, and the specific method of obtaining the data in the requested service data in the first service unit is as follows:

[0103] Step S504: Identify the type of service data requested by the access request stored on the first service unit.

[0104] When a tenant requests subordinate data, directly returning the corresponding data to the tenant may cause data inaccuracies. In this case, data synchronization is necessary to ensure data accuracy.

[0105] Step S505: If it is subordinate data, determine the second service unit for the corresponding primary data storage based on the subordinate data.

[0106] By synchronizing with the primary data, deviations in the subordinate data are eliminated, thus ensuring data accuracy.

[0107] Step S506: Synchronize the subordinate data with the main data on the second server module.

[0108] The bias-corrected subordinate data is returned to the tenant through the first service unit, while the intermediate verification process is transparent to the tenant. This ensures the accuracy of the data.

[0109] Step S507: Return the synchronized slave data to the tenant.

[0110] The method also includes determining that the service data requested by the tenant is stored in the first service unit accessed, and that the data stored in the first service unit is the primary data, and then directly returning the service data to the user through the first service unit.

[0111] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This computer program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. The aforementioned storage medium can be a non-volatile storage medium such as a magnetic disk, optical disk, or read-only memory (ROM), or random access memory (RAM).

[0112] It should be understood that although the steps in the flowcharts of the accompanying figures are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the accompanying figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0113] Further reference Figure 4 As a response to the above Figure 2 The implementation of the method shown in this application provides an embodiment of a service isolation data transmission device, which is similar to... Figure 2 Corresponding to the method embodiments shown, this device can be specifically applied to various electronic devices.

[0114] like Figure 4 As shown, the service isolation data transmission device 500 described in this embodiment includes: a generation module 41, a request module 42, a judgment module 43, and an acquisition module 44. Wherein:

[0115] The generation module 41 is used to determine the user's tenant based on the type of service the user requests to access and the user's role, and to generate an access request.

[0116] The request module 42 is used to send the tenant's access request to the first service unit, which stores service data; it is also used to return the obtained service data to the user.

[0117] Module 43 is used to determine whether the tenant has permission to access the service data of the first service unit. If the user has permission to access the service data of the first service unit, it determines whether the service data requested in the access request is stored in the accessed first service unit; and

[0118] The acquisition module 44 retrieves the requested service data from the first service unit if the requested service data is stored in the first service unit being accessed; otherwise, it accesses the second service unit that is connected to the first service unit through the communication template and retrieves the requested service data from the second service unit.

[0119] In this embodiment, the generation module 41 reads the service type and user role from the user request, queries the identity table, determines several corresponding tenant groups based on the requested service, and selects the most suitable tenant based on the user's access role to generate the access request. One tenant can simultaneously correspond to several users, providing access processes to multiple users concurrently. Furthermore, after the first service unit collects the corresponding service data, it forwards the service data to the user through the tenant.

[0120] After a user rents a tenant's identity, the request module 42 sends the user's request to the corresponding first service unit in the name of the tenant. Since there is a correspondence between the tenant and the first service unit, the corresponding tenant can only send requests to the first service unit.

[0121] Upon receiving an access request, the judgment module 43 confirms whether the tenant has the right to obtain the corresponding data, and then determines whether the requested data is stored in the first service unit in order to determine how to return the requested service data to the tenant.

[0122] The acquisition module 44 acquires the corresponding data from the corresponding first service unit or second service unit.

[0123] This solution categorizes users and binds them to tenant identities. Users access a primary service unit through their tenant identity to retrieve relevant service data. The primary service unit itself maintains only a small amount of data associated with the corresponding service and communicates internally with a secondary service unit to aggregate all service-related data. This data is then returned to the tenant, ensuring isolation between different user access processes and service data. This allows different user types to access services simultaneously without interference, simplifying business management, significantly reducing security risks, and improving access management efficiency.

[0124] In some optional implementations of this embodiment, a load balancing module is also included, which is used to balance the access load of the tenant to each node in the first service unit according to the access frequency and number of interactions of the tenant's access requests.

[0125] Please refer to the figure. In some optional implementations of this embodiment, the acquisition module 44 further includes an internal interaction submodule 441 and a verification submodule 442.

[0126] The internal interaction submodule 441 is used to determine the second service unit where the service data requested by the tenant is stored based on the correspondence between the service data related to the first service unit and the second service unit; the second service unit determines the correspondence between the requested data item and the first service unit, and returns the service data corresponding to the requested data item to the first service unit.

[0127] Specifically, the internal interaction submodule 441 determines a second service unit based on the storage relationship between the relevant data stored in the first service unit and the service units. Then, the second service unit confirms the correspondence between the requested data item and the second service unit, determines that the first service unit has the permission to operate on the relevant data, and then returns the data corresponding to the requested data item.

[0128] The verification submodule 442 is used for the first service unit to establish a link with the second service unit and send the requested data items and the correspondence between the requested data items and the first service unit.

[0129] Specifically, the correspondence between the data items sent by the first service unit box and the second service unit and the first service unit can be proven through field numbers, connection relationships between data tables, etc.

[0130] This solution can aggregate the service data required by users in the first service unit through the links between service units and transmit it to users in a unified manner, ensuring the security of data access and reducing the complexity of controlling the links.

[0131] Please refer to the figure. In some optional implementations of this embodiment, the above-mentioned acquisition module 44 further includes a data synchronization submodule 443.

[0132] The verification submodule 442 is also used to: determine that the service data requested by the tenant is stored in the first service unit accessed, and that the data stored in the first service unit is subordinate data;

[0133] When a tenant requests subordinate data, directly returning the corresponding data to the tenant may cause data inaccuracies. In this case, data synchronization is necessary to ensure data accuracy.

[0134] The synchronization verification submodule 442 is used to: determine the second service unit for storing the primary data corresponding to the subordinate data on the first service unit, and synchronize the subordinate data with the primary data on the second server module.

[0135] Request module 42 is also used to return synchronized data to the tenant via the first service unit.

[0136] By synchronizing with the primary data, deviations in subordinate data are eliminated to ensure data accuracy. The deviation-corrected subordinate data is then returned to the tenant through the first service unit, with the intermediate verification process transparent to the tenant. This ensures data accuracy. This scheme guarantees both distributed data storage and retrieval, and reliable data reading.

[0137] To address the aforementioned technical problems, embodiments of this application also provide a computer device. Please refer to [link / reference needed]. Figure 6 , Figure 6 This is a basic structural block diagram of the computer device in this embodiment.

[0138] The computer device 6 includes a memory 61, a processor 62, and a network interface 63 that are interconnected via a system bus. It should be noted that only the computer device 6 with components 61-63 is shown in the figure; however, it should be understood that it is not required to implement all the shown components, and more or fewer components can be implemented alternatively. Those skilled in the art will understand that the computer device described here is a device capable of automatically performing numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes, but is not limited to, microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0139] The computer device can be a desktop computer, laptop, handheld computer, or cloud server, etc. The computer device can interact with the user via a keyboard, mouse, remote control, touchpad, or voice control.

[0140] The memory 61 includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 61 may be an internal storage unit of the computer device 6, such as the hard disk or memory of the computer device 6. In other embodiments, the memory 61 may also be an external storage device of the computer device 6, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the computer device 6. Of course, the memory 61 may include both the internal storage unit and its external storage device of the computer device 6. In this embodiment, the memory 61 is typically used to store the operating system and various application software installed on the computer device 6, such as program code for a service-isolated data transmission method. In addition, the memory 61 can also be used to temporarily store various types of data that have been output or will be output.

[0141] In some embodiments, the processor 62 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip. The processor 62 is typically used to control the overall operation of the computer device 6. In this embodiment, the processor 62 is used to run program code stored in the memory 61 or process data, for example, to run program code for the service-isolated data transmission method.

[0142] The network interface 63 may include a wireless network interface or a wired network interface, which is typically used to establish communication connections between the computer device 6 and other electronic devices.

[0143] This application also provides another embodiment, namely, a computer-readable storage medium storing a service-isolated data transmission program, which can be executed by at least one processor to cause the at least one processor to perform the steps of the service-isolated data transmission method described above.

[0144] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0145] Obviously, the embodiments described above are only some embodiments of this application, not all embodiments. The accompanying drawings show preferred embodiments of this application, but do not limit the patent scope of this application. This application can be implemented in many different forms; rather, the purpose of providing these embodiments is to provide a more thorough and comprehensive understanding of the disclosure of this application. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or make equivalent substitutions for some of the technical features. Any equivalent structures made using the content of this application's specification and drawings, directly or indirectly applied to other related technical fields, are similarly within the scope of patent protection of this application.

Claims

1. A service-isolated data transmission method, characterized in that, Includes the following steps: The user's tenant is determined based on the type of service requested by the user and the user's role, and an access request is generated. An identity table is set up, which records all tenants, as well as the service types and roles corresponding to each tenant. During the access request control process, the service type and user's role in the user's request are read and queried in the identity table. First, several groups of tenants are determined based on the type of service requested. Then, a user's tenant is determined based on the user's access role and borrowed to generate an access request. The tenant's access request is sent to the first service unit, which stores the service data. Determine whether the tenant has permission to access the service data of the first service unit; If the user has permission to access the service data of the first service unit, then determine whether the service data requested in the access request is stored in the first service unit being accessed. If the requested service data is stored in the first service unit being accessed, then the requested service data is retrieved from the first service unit. If the requested service data is not stored in the first service unit being accessed, then the second service unit that is connected to the first service unit is accessed through the communication template, and the requested service data is obtained from the second service unit. Return the acquired service data to the user; The step of determining the user's tenant based on the type of service requested by the user and the user's role, and generating an access request, specifically includes: Based on the type of service requested by the user and the service data corresponding to the service type, the data types included in the service accessed by the user are determined. The service data is distributed and stored according to the service type, and interacts with the outside world as resources on different service units. Determine the data type the user intends to access based on the user's role and the data types included in the service; Based on the user's role and the type of data they intend to access, determine the frequency of their access and the amount of data they interact with in order to identify the tenant to which the user belongs. Here, a user is associated with a tenant, and a tenant is associated with one or more users at the same time. The user accesses the first data unit by renting a tenant identity. Bind users to their respective tenants and generate access requests based on the tenant's identity; Based on the user's role and the data types included in the service, the specific data types that the user intends to access include: Record the data type accessed by each role by analyzing the field information manipulated during each access; Count the number of accesses of the same role and the access frequency. Based on the access frequency, determine the data type that the current role intends to access from the data types included in the service.

2. The service isolation data transmission method according to claim 1, characterized in that: Sending the tenant's access request to the first service unit specifically involves balancing the tenant's access load across the nodes in the first service unit based on the frequency and number of interactions of the tenant's access request.

3. The service isolation data transmission method according to claim 1, characterized in that: The first service unit stores associated data related to the first service unit and its correspondence with the second service unit; the step of accessing the second service unit, which is communicatively connected to the first service unit, through a communication template, and obtaining the requested service data from the second service unit specifically includes: Based on the correspondence between the associated data of the first service unit and the second service unit, determine the second service unit where the service data requested by the tenant is stored; The first service unit establishes a link with the second service unit through a preset communication protocol and sends the requested service data and the correspondence between the requested service data and the first service unit, so that the second service unit can determine the correspondence between the requested service data and the first service unit. Receive the service data requested by the second service unit.

4. The service isolation data transmission method according to any one of claims 1 to 3, characterized in that: The service data includes primary data and secondary data, wherein the secondary data has the same data type and content as the primary data; the step of obtaining the requested service data from the first service unit specifically includes: Identify the category of service data requested by the access request stored on the first service unit; If it is subordinate data, determine the second service unit for the corresponding primary data storage based on the subordinate data; The subordinate data will be synchronized with the main data on the second server module; The synchronized slave data will be returned to the tenant.

5. A service-isolated data transmission device, characterized in that, The service isolation data transmission device implements the steps of the service isolation data transmission method as described in any one of claims 1 to 4, and the service isolation data transmission device includes: The generation module is used to determine the user's tenant based on the type of service the user requests to access and the user's role, and to generate an access request. The request module is used to send the tenant's access request to the first service unit, which stores service data; it is also used to return the obtained service data to the user. The judgment module is used to determine whether the tenant has permission to access the service data of the first service unit. If the user has permission to access the service data of the first service unit, it then determines whether the service data requested in the access request is stored in the accessed first service unit; and The acquisition module retrieves the requested service data from the first service unit if the requested service data is stored in the first service unit being accessed; otherwise, it accesses the second service unit that is connected to the first service unit via a communication template and retrieves the requested service data from the second service unit.

6. A computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the service isolation data transmission method as described in any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the service isolation data transmission method as described in any one of claims 1 to 4.

Images