Permission design method, system, device and storage medium based on SaaS multi-tenancy

Abstract

The present application discloses a permission design method, system, device and storage medium based on SaaS multi-tenant, the method comprising the following steps: creating a Users table to store users under each tenant; creating a Roles table to store system roles; creating a Permissions table to store the permission points corresponding to each of the system roles; creating a User_roles_mapping table to store the corresponding relationship between the user and the system role; creating an Accounts table to store accessible data sets; creating an Operation table to store the corresponding relationship between the accessible data sets and the system roles; and allocating user permissions according to the Users table, Roles table, Permissions table, User_roles_mapping table, Accounts table and Operation table. Through the present application, a more scientific and reasonable permission allocation method is provided, which decouples roles, functional permissions and data permissions to a greater extent in the context of multi-tenants, multi-roles and multi-data.

Description

Technical Field

[0001] The present invention relates to the field of rights management technology. More specifically, the present invention relates to a rights design method, system, device, and storage medium based on SaaS multi-tenancy. Background Art

[0002] SaaS (the abbreviation of Software-as-a-Service) means software as a service, that is, providing software services through the Internet. SaaS application software has three modes: free, paid, and value-added. The payment is usually an "all-inclusive" fee, which includes the usual application software license fee, software maintenance fee, and technical support fee, which are unified into a monthly rental fee for each user. SaaS is not only suitable for small and medium-sized enterprises, but all sizes of enterprises can benefit from SaaS.

[0003] At present, the SaaS market has repeatedly become the focus of media and capital attention. Almost every enterprise has a platform dream, and domestic enterprises are also vigorously developing SaaS platforms. In this process, SaaS platforms form a set of business processes or operating specifications in their respective business verticals. SaaS platform suppliers deploy application software on their own servers. Customers can order the required application software services from manufacturers through the Internet according to actual work needs, pay fees to manufacturers according to the amount of ordered services and the length of time, and obtain services provided by SaaS platform suppliers through the Internet.

[0004] In the design method of permission management of SaaS software, the more commonly used design mode is the RBAC model. RBAC is Role-Based Access Control. Its basic principles are:

[0005] 1) Various permissions for system operations are not directly granted to specific users, but a role set is established between the user set and the permission set;

[0006] 2) Each role corresponds to a set of corresponding permissions. Once a user is assigned an appropriate role, the user has all the operation permissions of this role.

[0007] This design pattern can play its advantages when data permissions and functional permissions are strongly related, and decouple permissions and users to the greatest extent. However, when functional permissions and data permissions are loosely related, it cannot meet usage needs. Summary of the invention

[0008] The embodiment of the present application provides a permission design method based on SaaS multi-tenancy to at least solve the problem of subjective factors in related technologies.

[0009] The present invention provides a permission design method based on SaaS multi-tenants, the method comprising the following steps:

[0010] User table creation steps: Create a Users table to store users under each tenant;

[0011] Steps to create the role table: Create the Roles table to store system roles;

[0012] Permission point setting step: create a Permissions table to store the permission points corresponding to each of the system roles;

[0013] User role mapping step: create a User_roles_mapping table to store the mapping relationship between the user and the system role;

[0014] Data storage steps: Create the Accounts table to store accessible data sets;

[0015] Data role correspondence step: creating an Operation table to store the correspondence between the accessible data sets and the system roles;

[0016] Permission setting step: user permissions are allocated according to the Users table, Roles table, Permissions table, User_roles_mapping table, Accounts table, and Operation table.

[0017] As a further improvement of the present invention, the system roles include but are not limited to: super administrator, administrator, and collaborator.

[0018] As a further improvement of the present invention, the user rights of the super administrator are to create users, access data, read and write all data in the system, and delegate data rights.

[0019] As a further improvement of the present invention, the user rights of the administrator include user creation, read permission, write permission and authority delegation for data authorized by the super administrator.

[0020] As a further improvement of the present invention, the user rights of the collaborator are read rights and write rights, or read-only rights, for the data authorized by the administrator.

[0021] As a further improvement of the present invention, the permission point setting step further includes binding the permission point with the accessible data set.

[0022] Based on the same inventive concept, the present invention also discloses a SaaS multi-tenant-based permission design system based on any one of the inventions.

[0023] The SaaS multi-tenant-based permission design system includes:

[0024] User table creation module, creates the Users table to store users under each tenant;

[0025] Role table creation module, creates the Roles table to store system roles;

[0026] The permission point setting module creates a Permissions table to store the permission points corresponding to each of the system roles;

[0027] The user role mapping module creates a User_roles_mapping table to store the mapping relationship between the user and the system role;

[0028] The data storage module creates the Accounts table to store accessible data sets;

[0029] The data role corresponding module creates an Operation table to store the corresponding relationship between the accessible data set and the system role;

[0030] The permission setting module allocates user permissions according to the Users table, Roles table, Permissions table, User_roles_mapping table, Accounts table, and Operation table.

[0031] As a further improvement of the present invention, the permission point setting module further includes binding the permission point with the accessible data set.

[0032] In addition, to achieve the above-mentioned purpose, the present invention also provides a device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the SaaS multi-tenant-based permission design method when executing the computer program.

[0033] In addition, to achieve the above-mentioned purpose, the present invention also provides a storage medium on which a computer program is stored, and when the program is executed by a processor, the permission design method based on SaaS multi-tenants is implemented.

[0034] Compared with the prior art, the present invention has the following beneficial effects:

[0035] A permission design method based on SaaS multi-tenancy is proposed, providing a more scientific and reasonable permission allocation method, decoupling roles, functional permissions, and data permissions to a greater extent in the context of multi-tenants, multi-roles, and multi-data; solving the decoupling between roles, users, data, and functions, which is more flexible and easier to expand and maintain. The details of one or more embodiments of the present application are presented in the following drawings and descriptions to make other features, purposes, and advantages of the present application more concise and easy to understand. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0037] Figure 1 This is an overall flow chart of a permission design method based on SaaS multi-tenants provided by an embodiment of the present invention;

[0038] Figure 2 It is a table relationship diagram of the permission design based on SaaS multi-tenancy disclosed in this embodiment;

[0039] Figure 3 This is a structural framework diagram of a permission design system based on SaaS multi-tenants provided in this embodiment;

[0040] Figure 4 is a framework diagram of a computer device according to an embodiment of the present invention.

[0041] In the above picture:

[0042] 1. User table creation module; 2. Role table creation module; 3. Permission point setting module; 4. User role corresponding module; 5. Data storage module; 6. Data role corresponding module; 7. Permission setting module; 80. Bus; 81. Processor; 82. Memory; 83. Communication interface. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. Based on the embodiments provided in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0044] Obviously, the drawings described below are only some examples or embodiments of the present application. For ordinary technicians in this field, the present application can also be applied to other similar scenarios based on these drawings without creative work. In addition, it can also be understood that although the efforts made in this development process may be complicated and lengthy, for ordinary technicians in this field related to the content disclosed in this application, some changes in design, manufacturing or production based on the technical content disclosed in this application are just conventional technical means, and should not be understood as insufficient content disclosed in this application.

[0045] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those of ordinary skill in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0046] Unless otherwise defined, the technical terms or scientific terms involved in this application should be understood by people with ordinary skills in the technical field to which this application belongs. The words "one", "a", "a", "the" and the like involved in this application do not indicate a quantity limitation, and may indicate the singular or plural. The terms "include", "comprise", "have" and any of their variations involved in this application are intended to cover non-exclusive inclusions; for example, a process, method, system, product or device that includes a series of steps or modules (units) is not limited to the listed steps or units, but may also include steps or units that are not listed, or may also include other steps or units inherent to these processes, methods, products or devices. The words "connect", "connected", "coupled" and the like involved in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. The "multiple" involved in this application refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there may be three relationships, for example, "A and / or B" can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects before and after are in an "or" relationship. The terms "first", "second", "third", etc. involved in this application are only used to distinguish similar objects, and do not represent a specific ordering of the objects.

[0047] The present invention is described in detail below in conjunction with the various embodiments shown in the accompanying drawings, but it should be noted that these embodiments are not limitations of the present invention, and any equivalent transformations or substitutions in functions, methods, or structures made by ordinary technicians in the field based on these embodiments are all within the scope of protection of the present invention.

[0048] Before elaborating on each embodiment of the present invention in detail, the core inventive concept of the present invention is summarized and elaborated in detail through the following several embodiments.

[0049] The present invention can design user permissions based on SaaS multi-tenancy, and solve the problem of how to decouple roles, functional permissions, and data permissions to a greater extent in the context of multi-tenants, multi-roles, and multi-data.

[0050] Embodiment 1:

[0051] Reference Figure 1 to Figure 2 As shown, this example discloses a specific implementation method of a permission design method based on SaaS multi-tenancy (hereinafter referred to as the "method").

[0052] Specifically, refer to Figure 1 and Figure 2 As shown, the method disclosed in this embodiment mainly includes the following steps:

[0053] Step S1: Create a Users table to store users under each tenant.

[0054] Specifically, tenants can be understood as customers deployed in the cloud. For example, the current school card management is usually done by a company, and the school does not need to do any local deployment. This company serves many schools, so the school is a tenant for the company.

[0055] Specifically, there are three types of SaaS multi-tenant architectures: independent databases; shared databases, isolated data architecture; and shared databases, shared data architecture. Independent databases store different tenant data in different databases; shared databases, isolated data architecture means that all tenant data is placed in the same database, but different tenants use different data tables; shared databases, shared data architecture means that all tenants use the same database and the same tables.

[0056] Then execute step S2 to create a Roles table to store system roles.

[0057] Specifically, in some of the embodiments, the system roles include but are not limited to: super administrator, administrator, and collaborator.

[0058] Specifically, in some of the embodiments, the permissions of different system roles are set as follows:

[0059] 1) Super administrator, the owner of the highest authority: can create users, access data, have read and write permissions for all data in the system, and delegate permissions for some data;

[0060] 2) Administrator with management authority: can create users, have read and write authority over data authorized by the super administrator, and delegate authority over authorized data;

[0061] 3) Collaborator: Read and write permissions to data authorized by the administrator, or read-only permissions.

[0062] Then, step S3 is executed to create a Permissions table to store the permission points corresponding to each of the system roles.

[0063] Specifically, in some of the embodiments, the Permissions table stores the permission points corresponding to each role, such as external data access permission and new user creation permission.

[0064] Then, step S4 is executed to create a User_roles_mapping table to store the corresponding relationship between the user and the system role.

[0065] Then, step S5 is executed to create an Accounts table to store the accessible data set.

[0066] Then, step S6 is executed to create an Operation table to store the corresponding relationship between the accessible data set and the system role.

[0067] Specifically, in some of the embodiments, the Operation table stores the correspondence between data sets and roles, that is, the permissions of each role on the data set (readable, writable or read-only). For example, the super administrator has the permissions to read and write data set X. Since Zhang San's role is the super administrator, Zhang San can access and operate data set X when he logs in.

[0068] Specifically, in some of the embodiments, the method can also bind the permission point to the accessible data set, that is, through the function and data binding method. For example, in the Permissions permission table, the function and data are bound, for example, permission point 1 is specified as data access function + create new user function + data set X readable and writable function + data set Y readable and writable function, and permission point 2 is specified as data access function + create new user function + data set M readable and writable function + data set N readable and writable function.

[0069] A permission design method based on SaaS multi-tenancy disclosed in the embodiment of the present application provides a more scientific and reasonable permission allocation method, which decouples roles, functional permissions, and data permissions to a greater extent in the context of multi-tenants, multi-roles, and multi-data; solves the decoupling between roles, users, data, and functions, and is more flexible, easier to expand and maintain.

[0070] Details of one or more embodiments of the present application are set forth in the following drawings and description to make other features, objects, and advantages of the present application more readily apparent.

[0071] Embodiment 2:

[0072] In combination with the permission design method based on SaaS multi-tenants disclosed in Example 1, this embodiment discloses a specific implementation example of a permission design system based on SaaS multi-tenants (hereinafter referred to as the "system").

[0073] Reference Figure 3 As shown, the system comprises:

[0074] User table creation module 1, creates the Users table to store users under each tenant;

[0075] Role table creation module 2, creates the Roles table to store system roles;

[0076] The permission point setting module 3 creates a Permissions table to store the permission points corresponding to each of the system roles;

[0077] User role mapping module 4, creates a User_roles_mapping table to store the mapping relationship between the user and the system role;

[0078] Data storage module 5, creates the Accounts table to store accessible data sets;

[0079] The data role corresponding module 6 creates an Operation table to store the corresponding relationship between the accessible data set and the system role;

[0080] The authority setting module 7 allocates user authority according to the Users table, Roles table, Permissions table, User_roles_mapping table, Accounts table, and Operation table.

[0081] Specifically, in some of the embodiments, the permission point setting module 3 further includes binding the permission point with the accessible data set.

[0082] For the technical solutions of the other identical parts of the permission design system based on SaaS multi-tenants disclosed in this embodiment and the permission design method based on SaaS multi-tenants disclosed in the first embodiment, please refer to the description in the first embodiment, which will not be repeated here.

[0083] Embodiment three:

[0084] Combination Figure 4 As shown, this embodiment discloses a specific implementation of a computer device. The computer device may include a processor 81 and a memory 82 storing computer program instructions.

[0085] Specifically, the processor 81 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0086] Among them, the memory 82 may include a large-capacity memory for data or instructions. By way of example and not limitation, the memory 82 may include a hard disk drive (HDD), a floppy disk drive, a solid-state drive (SSD), a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive, or a combination of two or more of these. Where appropriate, the memory 82 may include a removable or non-removable (or fixed) medium. Where appropriate, the memory 82 may be inside or outside the data processing device. In a specific embodiment, the memory 82 is a non-volatile memory. In a specific embodiment, the memory 82 includes a read-only memory (ROM) and a random access memory (RAM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically alterable ROM (EAROM) or a flash memory (FLASH), or a combination of two or more of these. Under appropriate circumstances, the RAM can be a static random access memory (SRAM) or a dynamic random access memory (DRAM), wherein the DRAM can be a fast page mode dynamic random access memory (FPMDRAM), an extended data output dynamic random access memory (EDODRAM), a synchronous dynamic random access memory (SDRAM), etc.

[0087] The memory 82 may be used to store or cache various data files required for processing and / or communication, as well as possible computer program instructions executed by the processor 81 .

[0088] The processor 81 implements any one of the SaaS multi-tenant-based permission design methods in the above embodiments by reading and executing computer program instructions stored in the memory 82 .

[0089] In some of these embodiments, the computer device may further include a communication interface 83 and a bus 80. Figure 4 As shown, the processor 81, the memory 82, and the communication interface 83 are connected via a bus 80 and communicate with each other.

[0090] The communication interface 83 is used to implement communication between the modules, devices, units and / or equipment in the embodiment of the present application. The communication interface 83 can also implement data communication with other components such as: external devices, image / data acquisition equipment, databases, external storage, and image / data processing workstations.

[0091] The bus 80 includes hardware, software or both, and couples the components of the computer device to each other. The bus 80 includes but is not limited to at least one of the following: a data bus, an address bus, a control bus, an expansion bus, and a local bus. By way of example and not limitation, bus 80 may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an InfiniBand interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses or a combination of two or more of these. Where appropriate, bus 80 may include one or more buses. Although embodiments of the present application describe and illustrate a particular bus, the present application contemplates any suitable bus or interconnect.

[0092] The computer equipment can implement permission design based on SaaS multi-tenancy, thereby realizing the combination Figure 1 Describe the method.

[0093] In addition, in combination with the permission design method based on SaaS multi-tenants in the above embodiment, the embodiment of the present application can provide a computer-readable storage medium for implementation. The computer-readable storage medium stores computer program instructions; when the computer program instructions are executed by the processor, any one of the permission design methods based on SaaS multi-tenants in the above embodiment is implemented.

[0094] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0095] In summary, the beneficial effect of the present invention is that a permission design method based on SaaS multi-tenants is proposed, which provides a more scientific and reasonable permission allocation method, decouples roles, functional permissions, and data permissions to a greater extent in the context of multi-tenants, multi-roles, and multi-data; solves the decoupling between roles, users, data, and functions, and is more flexible, easier to expand and maintain.

[0096] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A permission design method based on SaaS multi-tenancy, characterized in that: The steps include: User table creation steps: Create a Users table to store users under each tenant; Steps to create the role table: Create the Roles table to store system roles; Permission point setting step: create a Permissions table to store the permission points corresponding to each of the system roles, and bind the permission points to the accessible data sets; User role mapping step: create a User_roles_mapping table to store the mapping relationship between the user and the system role; Data storage steps: Create the Accounts table to store accessible data sets; Data role correspondence step: creating an Operation table to store the correspondence between the accessible data sets and the system roles; Permission setting step: assigning user permissions according to the Users table, Roles table, Permissions table, User_roles_mapping table, Accounts table, and Operation table; The system roles include: super administrator, administrator, and collaborator. The super administrator's user rights include user creation, data access, read and write permissions to all data in the system, and data delegation. The administrator's user rights include user creation, read and write permissions to data authorized by the super administrator, and delegation of permissions. The collaborator's user rights include read and write permissions to data authorized by the administrator, or read-only permissions. The permission point is bound to the accessible data set by binding functions and data. In the Permissions permission table, the functions and data are bound, and permission point 1 is specified as data access function, creating a new user function, data set X readable and writable function, and data set Y readable and writable function. Permission point 2 is specified as data access function, creating a new user function, data set M readable and writable function, and data set N readable and writable function. Among them, the SaaS multi-tenant architecture includes: independent database, shared database, isolated data architecture, shared database, shared data architecture. Specifically, the independent database means that different tenant data is placed in different databases, the shared database, isolated data architecture means that all tenant data is placed in the same database, but different tenants use different data tables, and the shared database, shared data architecture means that all tenants use the same database and the same table.

2. A permission design system based on SaaS multi-tenancy, characterized in that: include: User table creation module, creates the Users table to store users under each tenant; Role table creation module, creates the Roles table to store system roles; A permission point setting module, which creates a Permissions table to store the permission points corresponding to each of the system roles, and the permission point setting module also includes binding the permission points to the accessible data set; The user role mapping module creates a User_roles_mapping table to store the mapping relationship between the user and the system role; The data storage module creates the Accounts table to store accessible data sets; The data role corresponding module creates an Operation table to store the corresponding relationship between the accessible data set and the system role; The permission setting module allocates user permissions according to the Users table, Roles table, Permissions table, User_roles_mapping table, Accounts table, and Operation table; The system roles include: super administrator, administrator, and collaborator. The super administrator's user rights include user creation, data access, read and write permissions to all data in the system, and data delegation. The administrator's user rights include user creation, read and write permissions to data authorized by the super administrator, and delegation of permissions. The collaborator's user rights include read and write permissions to data authorized by the administrator, or read-only permissions. The permission point is bound to the accessible data set by binding functions and data. In the Permissions permission table, the functions and data are bound, and permission point 1 is specified as data access function, creating a new user function, data set X readable and writable function, and data set Y readable and writable function. Permission point 2 is specified as data access function, creating a new user function, data set M readable and writable function, and data set N readable and writable function. Among them, the SaaS multi-tenant architecture includes: independent database, shared database, isolated data architecture, shared database, shared data architecture. Specifically, the independent database means that different tenant data is placed in different databases, the shared database, isolated data architecture means that all tenant data is placed in the same database, but different tenants use different data tables, and the shared database, shared data architecture means that all tenants use the same database and the same table.

3. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the permission design method based on SaaS multi-tenancy as described in claim 1 is implemented.

4. A storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the permission design method based on SaaS multi-tenancy as described in claim 1 is implemented.

Images