Data access methods, devices, media and electronic equipment for multi-tenant systems

Abstract

This application relates to the field of cloud computing and is applied to ESOP systems. It discloses a data access method, apparatus, computer-readable medium, and electronic device for multi-tenant systems. The method includes: encrypting tenant data in a multi-tenant system using a key corresponding to the tenant, obtaining encrypted data for the tenant, wherein the keys for each tenant in the multi-tenant system are unique; receiving a data query instruction and verifying the validity of the tenant's identity information in the data query instruction; if the data query instruction passes the validity verification, performing a data query operation on the encrypted data according to the data query instruction to obtain a query result; decrypting the query result using the key corresponding to the target tenant, with the tenant sending the data query instruction as the target tenant, and outputting the decrypted result. This method avoids unauthorized access to data and greatly improves the reliability, security, and fault tolerance of data storage in multi-tenant systems.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of cloud computing, in particular to a data access method and device of a multi-tenant system, a computer readable medium and an electronic device. BACKGROUND

[0002] SaaS (Software-as-a-Service) is one of the service modes of cloud computing. SaaS platform providers deploy application software on their own servers, and different customers can purchase the services they need from the SaaS platform according to their actual work needs.

[0003] However, due to program failure or malicious operation, etc., a customer may access the data of other customers in the SaaS platform in some way, which may cause data leakage, posing a serious threat to the data security of the SaaS platform. SUMMARY

[0004] In the technical field of cloud computing, the ESOP system is applied, multiple security guarantees are provided, including single encryption, multiple copy storage, access control and other technical means to ensure data security; through identity authentication, IP limitation, access control and other means to ensure account security; through company administrator permission grading, setting multiple permission ranges, recording change operations, providing modification record viewing and other means to ensure business security; through multiple storage servers, ensuring data security and stability, tracking and discovering system vulnerabilities, real-time upgrading and repairing and other technical means to ensure system security.

[0005] In order to solve the above technical problems, the purpose of the present application is to provide a data access method and device of a multi-tenant system, a computer readable medium and an electronic device.

[0006] According to an aspect of an embodiment of the present application, a data access method of a multi-tenant system is provided, the method comprising:

[0007] encrypting the data of a tenant in a multi-tenant system according to a key corresponding to the tenant, to obtain encrypted data of the tenant, wherein the keys of the tenants in the multi-tenant system are all different;

[0008] receiving a data query instruction and performing a legality check of tenant identity information on the data query instruction;

[0009] if the data query instruction passes the legality check, performing a data query operation on the encrypted data according to the data query instruction to obtain a query result;

[0010] decrypting the query result according to a key corresponding to a target tenant which sent the data query instruction, and outputting the decryption result.

[0011] According to an aspect of an embodiment of the present application, a data access apparatus of a multi-tenant system is provided, and the apparatus comprises:

[0012] An encryption module is configured to encrypt data of a tenant in the multi-tenant system according to a key corresponding to the tenant, to obtain encrypted data of the tenant, wherein the keys of the tenants in the multi-tenant system are all different;

[0013] A legality verification module is configured to receive a data query instruction, and perform legality verification of tenant identity information on the data query instruction;

[0014] A query module is configured to, if the data query instruction passes the legality verification, perform a data query operation on the encrypted data according to the data query instruction, to obtain a query result;

[0015] A decryption module is configured to, taking a tenant sending the data query instruction as a target tenant, perform a decryption operation on the query result according to a key corresponding to the target tenant, and output a decryption result.

[0016] According to an aspect of an embodiment of the present application, a computer readable medium having a computer program stored thereon is provided, and the computer program is executed by a processor to implement the method described in the above embodiment.

[0017] According to an aspect of an embodiment of the present application, an electronic device is provided, comprising: one or more processors; a storage apparatus configured to store one or more programs, which, when executed by the one or more processors, cause the one or more processors to implement the method described in the above embodiment.

[0018] The technical solution provided by the embodiment of the present application can include the following beneficial effects:

[0019] For the data access method, apparatus, computer readable medium and electronic device of the multi-tenant system provided by the present application, the method comprises the following steps: encrypting data of a tenant in a multi-tenant system according to a key corresponding to the tenant, to obtain encrypted data of the tenant, wherein the keys of the tenants in the multi-tenant system are all different; receiving a data query instruction, and performing legality verification of tenant identity information on the data query instruction; if the data query instruction passes the legality verification, performing a data query operation on the encrypted data according to the data query instruction, to obtain a query result; taking a tenant sending the data query instruction as a target tenant, performing a decryption operation on the query result according to a key corresponding to the target tenant, and outputting a decryption result.

[0020] Under this method, the legality of tenant identity information of the data query instruction is verified after the data query instruction is received, and only when the data query instruction passes the legality verification, the data query operation is performed, so that it is ensured that the tenant cannot query the data of other tenants, and the data is prevented from being accessed by unauthorized access. On this basis, the data of each tenant in the multi-tenant system is encrypted by using a key specific to the tenant, and after the query result is obtained, the query result is decrypted according to the key corresponding to the target tenant sending the data query instruction. When the tenant sending the data query instruction is inconsistent with the real tenant of the data requested by the data query instruction, the query result cannot be successfully decrypted, thereby further preventing the data from being accessed by unauthorized access. Therefore, by combining the two means of encrypting the data of the tenant using a specific key and verifying the legality of the tenant identity information of the data query instruction, the reliability, security and fault tolerance of the data storage in the multi-tenant system are greatly improved.

[0021] It should be understood that the foregoing general description and the following detailed description are only exemplary and do not limit the present application. BRIEF DESCRIPTION OF DRAWINGS

[0022] The accompanying drawings, which are incorporated into and form part of the specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the application.

[0023] Figure 1 A schematic diagram of an exemplary system architecture to which the technical solutions of the embodiments of the present application can be applied is shown;

[0024] Figure 2 A flowchart of a data access method of a multi-tenant system according to an embodiment of the present application is shown;

[0025] Figure 3 A schematic diagram of the principle of physical isolation and database isolation according to an embodiment of the present application is shown;

[0026] Figure 4 A flowchart of the details of step 230 in the method according to an embodiment of the present application is shown; Figure 2 A flowchart of the details of step 230 in the method according to an embodiment of the present application is shown;

[0027] Figure 5 A flowchart of the details of step 230 in the method according to an embodiment of the present application is shown; Figure 2 A flowchart of the details of step 230 in the method according to an embodiment of the present application is shown;

[0028] Figure 6 A flowchart of the details of step 230 in the method according to an embodiment of the present application is shown; Figure 5 A flowchart of the details of step 230 in the method according to an embodiment of the present application is shown;

[0029] Figure 7A schematic diagram of the interaction flow of a data access method for a multi-tenant system according to an embodiment of this application is shown;

[0030] Figure 8 A schematic diagram illustrating the process of performing database permission verification and tenant identity information legality verification according to an embodiment of this application is shown;

[0031] Figure 9 A block diagram of a data access apparatus for a multi-tenant system according to an embodiment of this application is shown;

[0032] Figure 10 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application is shown. Detailed Implementation

[0033] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the invention as detailed in the appended claims.

[0034] Furthermore, the accompanying drawings are merely illustrative of this application and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities.

[0035] A multi-tenant system is a system that utilizes multi-tenancy technology, a software architecture technique that explores and implements how to share the same system or program components in a multi-user environment. For example, SaaS services are a typical example of a multi-tenant system.

[0036] In the equity incentive field, a tenant refers to a listed or soon-to-be-listed company that rents an equity incentive SaaS service. The SaaS service then hosts the grant information for specific employees under the tenant. However, employee grant information, like employee salaries, is highly sensitive. If tenant A were to gain access to tenant B's data due to a program malfunction or malicious operation, it would be a major incident, damaging the SaaS service provider's reputation and potentially leading to legal liability.

[0037] In related technologies, after logging in, a tenant saves their current tenant ID to the session. A common method for data isolation is to include the current session's tenant ID in the query criteria, thus filtering out data from non-tenants and preventing unauthorized data access.

[0038] However, this technology still has the following drawbacks:

[0039] 1. Low tolerance for error

[0040] (1) Due to negligence, the developer wrote the code and the query conditions of the query command did not include the tenant ID, which led to data overreach.

[0041] (2) When developers directly manipulate the database, improper operation may affect the data of unrelated tenants. For example, a tenant may request to change their A to B, but due to improper operation, all tenants' A is changed to B.

[0042] 2. Database resource contention

[0043] A tenant's operation involving a large amount of data consumed a significant amount of database performance, causing other tenants to experience slow loading speeds.

[0044] Therefore, this application first provides a data access method for a multi-tenant system. The data access method for a multi-tenant system provided by this application can overcome the above defects and greatly reduce the possibility of data unauthorization.

[0045] The implementation terminal of this application can be any device with computing, processing and communication functions. The device can be connected to external devices to receive or send data. Specifically, it can be a portable mobile device, such as a smartphone, tablet, laptop, PDA (Personal Digital Assistant), etc., or a fixed device, such as a computer device, field terminal, desktop computer, server, workstation, etc., or a collection of multiple devices, such as the physical infrastructure of cloud computing or server cluster.

[0046] Optionally, the implementation terminal of this application can be a server or a cloud computing physical infrastructure.

[0047] Figure 1 A schematic diagram of an exemplary system architecture to which the technical solutions of the embodiments of this application can be applied is shown. For example... Figure 1As shown, the system architecture 100 includes a personal computer 110 and a cloud 120. The cloud 120 includes a server 121 and a database 122. The personal computer 110 and the cloud 120, as well as the server 121 and database 122 within the cloud 120, are connected via communication links, which can be used to send or receive data. A multi-tenant system is deployed on the cloud 120. The business programs configured on the server 121 can provide SaaS services externally. The server 121 is the implementation terminal in this embodiment. Users of the personal computer 110 can access the server 121 in the cloud 120 to use the SaaS service and store user data in the database 122 through the server 121. When the data access method for a multi-tenant system provided in this application is applied... Figure 1 In the system architecture shown, a process can be as follows: First, server 121 encrypts the data of each tenant in database 122 using a tenant-specific key. Next, when a user of personal computer 110 accesses server 121 in cloud 120, server 121 establishes a session with personal computer 110 and initializes a connection to a specific database. At this point, server 121 receives the query command submitted by the user. Then, server 121 determines whether the user of the session has connection permissions to this database. If so, server 121 further verifies whether the query command carries a tenant ID and whether the tenant ID in the query command is equal to the tenant ID of the session. If both verifications pass, the query command is executed in database 122. Then, server 121 obtains the query result returned by database 122, determines the corresponding key based on the tenant ID of the current session, and decrypts the query result. Finally, server 121 returns the decrypted result to the user of personal computer 110, thus completing the process of a tenant accessing data in the multi-tenant system.

[0048] In this embodiment of the application, the server 121 can determine whether the user of the session has permission to connect to this database through the following example.

[0049] S1. Input the collected user voice data into the voice activity detection model for denoising to obtain denoised data;

[0050] S2. Extract voiceprint features from the denoised data using the Mel frequency cepstral coefficient model, and establish a voiceprint feature vector corresponding to the speech data based on the voiceprint features.

[0051] S3. Input the voiceprint feature vector into a pre-trained Gaussian mixture model to obtain the Gaussian voiceprint vector of the tested object.

[0052] S4. Compare the Gaussian voiceprint vector with the preset standard voiceprint vector to generate the permission judgment result;

[0053] Specifically, the distance between the current Gaussian voiceprint vector and the user's corresponding pre-stored standard voiceprint vector is calculated using a predetermined distance calculation formula, so as to determine the difference between the two data quantities by the distance between the vectors.

[0054] Optionally, the distance between the two vectors can be calculated using the Jaccard distance formula:

[0055]

[0056]

[0057] Specifically, the proportion of the intersection element of two sets X and Y in the union of X and Y is calculated. If the calculated coefficient value is larger, the permission is granted; if the calculated coefficient value is smaller, the permission is denied.

[0058] It should be understood that Figure 1 The number of personal computers, servers, and databases shown is merely illustrative. Depending on implementation needs, any number of personal computers, servers, and databases can be used. For example, server 121 could be a server cluster consisting of multiple servers.

[0059] It should be noted that, Figure 1 The example shown is only one embodiment of this application, although in Figure 1 In this embodiment, the device receiving the query instruction, the device verifying connection permissions and tenant ID, and the device encrypting and decrypting the data are the same device. However, in other embodiments of this application or in specific applications, the device receiving the query instruction, the device verifying connection permissions and tenant ID, and the device encrypting and decrypting the data can be different devices. For example, the device decrypting the data can be a machine located outside the device receiving the query instruction. Figure 1 In this embodiment, the database and the device receiving the query command are different devices. However, in other embodiments of this application, the database may also be set to be local to the device receiving the query command. This application does not limit the scope of protection in any way, nor should it restrict the scope of protection of this application.

[0060] Furthermore, it is readily understood that the data access method for the multi-tenant system provided in this application embodiment is generally executed by a server, and correspondingly, the data access device for the multi-tenant system is generally located in the server. However, in other embodiments of this application, other types of terminal devices may also have similar functions to the server, thereby executing the data access scheme for the multi-tenant system provided in this application embodiment.

[0061] Figure 2A flowchart illustrating a data access method for a multi-tenant system according to an embodiment of this application is shown. The data access method for the tenant system provided in this embodiment can be executed by a server and can be applied to equity incentive SaaS services. Figure 2 As shown, the following steps may be included:

[0062] In step 210, the tenant's data is encrypted in the multi-tenant system according to the key corresponding to the tenant to obtain the tenant's encrypted data. The keys of the tenants in the multi-tenant system are all different.

[0063] Tenant data can be of various types, such as sensitive tenant information. Each tenant in the tenant system has a unique key; that is, for any given tenant's key, no other tenant in the system can have the same key. In other words, each tenant's key is specific to that tenant. Tenant A's key cannot unlock tenant B's data.

[0064] The key here can be either a key for a symmetric encryption algorithm or a public or private key for an asymmetric encryption algorithm.

[0065] In one embodiment of this application, the key corresponding to the tenant in the multi-tenant system is randomly generated by the multi-tenant system for the tenant.

[0066] In this embodiment of the application, by using a randomly generated key to encrypt the tenant's data, the security of data storage can be improved, and unauthorized access to the data can be prevented.

[0067] In one embodiment of this application, the key corresponding to a tenant in a multi-tenant system is updated periodically.

[0068] In this embodiment of the application, by periodically updating the keys corresponding to tenants, the keys of each tenant are not static. Even if the keys are leaked, they will quickly become invalid, further reducing the possibility of unauthorized access to data.

[0069] The encrypted data obtained from tenants can be stored in a database or other types of storage tools. When the encrypted data is stored in a database, the database can be a relational database such as MySQL, or a non-relational database such as Redis.

[0070] In one embodiment of this application, encrypted data is stored in a database, and the encrypted data of each tenant in a multi-tenant system is stored by a database specific to that tenant.

[0071] In other words, in a multi-tenant system, each tenant has a corresponding database, and this database belongs only to its unique tenant; different tenants have different databases. Each tenant can correspond to one or more databases.

[0072] In this embodiment of the application, since each tenant uses a separate database, the data between tenants does not affect each other, and the probability of developer error is also reduced.

[0073] In one embodiment of this application, the multi-tenant system includes one or more independent machine tenants, and the encrypted data of the independent machine tenants is stored by machines specific to the independent machine tenant.

[0074] Specifically, a machine specific to a particular machine tenant refers to a machine that stores only the data of that particular machine tenant. A particular machine tenant may have one or more machines specific to that particular machine tenant.

[0075] The machines here can be servers, server clusters, or other devices with storage capabilities. In a multi-tenant system, all tenants can be independent machine tenants, or only a portion of the tenants can be independent machine tenants.

[0076] In this embodiment of the application, by configuring an independent machine for at least one tenant in the multi-tenant system, and having these machines store data separately for the tenant, the performance of the database machines among the tenants does not affect each other. This also ensures data security.

[0077] In one embodiment of this application, the amount of data of an independent machine tenant is greater than the amount of data of other tenants in a multi-tenant system.

[0078] In a multi-tenant system, independent machine tenants can be determined based on the amount of data each tenant has. For example, tenants with a data volume greater than a predetermined data volume threshold can be identified as independent machine tenants, and then these independent machine tenants can be migrated to a separate machine.

[0079] In this embodiment of the application, by identifying only tenants with a sufficient amount of data as independent machine tenants and allocating separate machines for storing data to these tenants, the performance of database machines among tenants is not affected by each other and data security is guaranteed, while reducing the machine setup cost and achieving a balance between cost and performance.

[0080] Figure 3 A schematic diagram illustrating the principles of physical isolation and database isolation according to an embodiment of this application is shown. Figure 3As shown, in a multi-tenant system, each tenant uses a separate database. The databases for tenants A, B, and C are respectively the A tenant database, B tenant database, and C tenant database. The A tenant database and the B tenant database are located on machine a, while the C tenant database is located on machine b. This is because the C tenant has a larger amount of data, so the tenant with the larger amount of data uses a separate machine for storage.

[0081] Figure 3 The document also shows a public database, which is the System database. It can store various data other than the tenant's encrypted data. For example, it can store system configuration data that is not related to the tenant, as well as the database permissions of each tenant in a multi-tenant system.

[0082] Please continue reading. Figure 2 In step 230, a data query instruction is received, and the legality of the tenant identity information is verified for the data query instruction.

[0083] Data query commands can be, for example, SQL (Structured Query Language).

[0084] The legality verification in this application embodiment can be performed through one of the following examples.

[0085] First, randomly select a divisor to perform division on the received number during verification. Observe the number of binary digits of the selected divisor (let's say 'a' bits). Then, add 'a-1' bits of '0' to the data bits to be sent (let's say 'b' bits). Next, divide this new number (with 'a-1' bits added, totaling b+a-1 bits) by the original divisor using modulo-2 division. The remainder is the checksum. Append this checksum to the original data to construct a new number and send it to the receiving end. Finally, at the receiving end, divide this new number by the previously selected divisor using modulo-2 division. If there is no remainder, it indicates that the number was transmitted without error; otherwise, an error has occurred.

[0086] Figure 4 An embodiment according to this application is shown. Figure 2 A flowchart detailing the steps preceding step 230 and the specifics of step 230. (See attached flowchart.) Figure 4 As shown, it includes the following steps:

[0087] In step 220, a session with the tenant is established, and a connection to the target database is initialized.

[0088] The target database can be a database specified by the tenant or a pre-defined database.

[0089] Step 230 may specifically include the following steps:

[0090] In step 231, when a data query instruction is received from the tenant in the session, it is determined whether the tenant has connection permissions to the target database.

[0091] Connection permissions for each tenant can be pre-saved, and the specific connection permission can be found based on the tenant ID. Tenant connection permissions can be stored in a public database. Tenant connection permissions can be adjusted based on tenant requests.

[0092] In one embodiment of this application, when a data query instruction is received from a tenant in a session, determining whether the tenant has connection permission to the target database includes: when a data query instruction is received from a tenant in a session, determining whether the target database is a public database, wherein a public database is a database in a multi-tenant system that does not store the tenant's encrypted data; if the target database is not a public database, then determining whether the tenant has connection permission to the target database.

[0093] When the target database is a public database, the verification can be passed directly, and the validity of the tenant identity information can be verified for the data query command without determining whether the tenant has connection permissions to the target database. In addition, when the target database is a public database, the data query operation can be performed directly according to the data query command without performing other verifications.

[0094] In step 232, if the tenant has connection permissions to the target database, the validity of the tenant's identity information is verified for the data query command.

[0095] In this embodiment of the application, before verifying the legality of the tenant's identity information in the data query command, it is first determined whether the tenant has the connection permission to the target database. Only when the tenant has the connection permission to the target database is the legality of the tenant's identity information verified in the data query command performed. This further reduces the possibility of unauthorized access to tenant data and can reduce accidents caused by faults.

[0096] Figure 5 An embodiment according to this application is shown. Figure 2 A flowchart detailing step 230 is provided. Please refer to it. Figure 5 As shown, step 230 may also include the following steps:

[0097] In step 233', it is determined whether the tenant identity information in the data query instruction is consistent with the tenant identity information in the current session.

[0098] In data query commands, filter criteria are used to extract records that meet specified conditions. The filter criteria for data query commands require the tenant ID. A session is established with the tenant based on their identification information.

[0099] In this embodiment of the application, by verifying the tenant ID carried in the filtering conditions of the data query command, the possibility of data unauthorization is greatly reduced.

[0100] Figure 6 An embodiment according to this application is shown. Figure 5 A flowchart of the steps preceding step 233'. Please refer to [link / reference]. Figure 6 As shown, before step 233', step 230 may also include the following steps:

[0101] In step 231', it is determined whether the data table requested by the data query instruction is a system table.

[0102] If the data table requested by the data query command is not a system table, the step of determining whether the data query command carries tenant identity information is executed; that is, if not, step 232' is executed. When the data table requested by the data query command is a system table, the validation can be passed directly, and the data query command can be executed.

[0103] In step 232', it is determined whether the data query instruction carries tenant identity information.

[0104] If so, proceed to step 233'.

[0105] In other words, when the data query command carries tenant identity information, the step of determining whether the tenant identity information in the data query command is consistent with the tenant identity information in the current session is executed.

[0106] In this embodiment of the application, before determining whether the tenant identity information in the data query instruction is consistent with the tenant identity information in the current session, it is first determined whether the data query instruction carries tenant identity information. Since the amount of computation required to determine whether the data query instruction carries tenant identity information is much less than the amount of computation required to determine whether the tenant identity information in the data query instruction is consistent with the tenant identity information in the current session, the amount of computation required for data access can be reduced to a certain extent, thereby saving computational overhead.

[0107] If the business application malfunctions and accidentally points the database connection to another tenant's database or uses an omitted tenant ID as a filtering condition, the anomaly can be detected through steps 232' and 233'.

[0108] Please continue readingFigure 2 In step 240, if the data query instruction passes the validity check, the encrypted data is queried according to the data query instruction to obtain the query result.

[0109] If a data query command fails the validity check, an exception can be thrown.

[0110] In step 250, the tenant who sent the data query instruction is taken as the target tenant, the query result is decrypted according to the key corresponding to the target tenant, and the decryption result is output.

[0111] In other words, the corresponding key is looked up based on the tenant ID of the session. If the encrypted data is obtained using an asymmetric encryption algorithm, and the encryption was performed using the public key corresponding to the target tenant, then the decryption operation can be performed using the private key corresponding to the target tenant.

[0112] An exception can also be thrown if the query results cannot be decrypted.

[0113] When the tenant sending the data query command is different from the actual tenant of the data requested by the data query command, the query result cannot be successfully decrypted.

[0114] Figure 7 A schematic diagram illustrating the interaction flow of a data access method for a multi-tenant system according to an embodiment of this application is shown. Please refer to... Figure 7 As shown, SaaS multi-tenant data isolation in equity incentives involves entities such as users, business programs, database operation verification, encryption / decryption machines, and data. The specific process is as follows: First, the user performs an operation; then, the business program initializes a database connection based on the session's tenant ID and performs a data query operation; next, the database operation verification entity verifies whether the session's tenant has the necessary database connection permissions. If so, it checks if the query command uses the current session's tenant ID as a filter condition. If so, the query command is executed in the database; after execution, the database returns the query results to the business program, allowing the business program to obtain the results; then, the business program needs to decrypt the data by sending a request carrying the data to the encryption / decryption machine; next, the encryption / decryption machine prepares a key based on the session's tenant ID, uses the key to decrypt, and returns the decryption result to the business program, thus completing the decryption; finally, the business program returns the decryption result to the user and displays it on the interface. In this way, the user can obtain the data access results.

[0115] Figure 8 A schematic diagram illustrating the process of performing database permission verification and tenant identity information validity verification according to an embodiment of this application is shown. Please refer to... Figure 8As shown, the process includes the following steps: First, a tenant is created, a database A is created for the tenant, and the database permissions of tenant A are saved to a public database. Then, when the tenant connects to the database, it first determines whether the target database is a public database. If it is, the verification passes; if not, it determines whether the current tenant has the permissions for the target database. If the current tenant has the permissions for the target database, the verification passes; otherwise, the verification fails. Next, after the verification passes, the verification query command carries the tenant ID as a filtering condition, and the query command is executed after the verification passes.

[0116] exist Figure 8 In the validation process, the part where the query command carries the tenant ID as a filtering condition can include the following steps: First, before executing the query command, it checks whether the target table is a system table. If it is, the validation passes; otherwise, it checks whether the query command carries the tenant ID. If the query command does not carry the tenant ID, the validation fails. If the query command carries the tenant ID, it further checks whether the tenant ID in the query command is equal to the session's tenant ID. If they are, the validation passes; otherwise, the validation fails. Finally, the query command is executed after the validation passes.

[0117] In summary, the data access method for a multi-tenant system provided in this application ensures data isolation from multiple dimensions, including machine, database, data, and verification. As long as any one of these dimensions remains functional, unauthorized data access is impossible. This multi-dimensional approach reduces the risk of incidents caused by malfunctions. For highly sensitive equity incentive data, isolation is achieved across multiple tenants, maximizing the prevention of unauthorized data access, database resource contention, and data interoperability. Therefore, compared to ordinary data isolation, the solution in this application offers higher reliability, security, and fault tolerance.

[0118] This application also provides a data access device for a multi-tenant system. The following are embodiments of the device provided in this application.

[0119] Figure 9 A block diagram of a data access apparatus for a multi-tenant system according to an embodiment of this application is shown. Figure 9 As shown, the device 900 includes:

[0120] The encryption module 910 is configured to encrypt the tenant's data in a multi-tenant system according to the key corresponding to the tenant, to obtain the encrypted data of the tenant, wherein the keys of the tenants in the multi-tenant system are all different;

[0121] The legality verification module 920 is configured to receive a data query instruction and perform legality verification of the tenant identity information in the data query instruction;

[0122] The query module 930 is configured to perform a data query operation on the encrypted data according to the data query instruction if the data query instruction passes the validity check, and obtain the query result.

[0123] The decryption module 940 is configured to target the tenant who sent the data query instruction as the target tenant, decrypt the query result according to the key corresponding to the target tenant, and output the decryption result.

[0124] Figure 10 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application is shown.

[0125] It should be noted that, Figure 10 The computer system 1000 of the electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0126] like Figure 10 As shown, the computer system 1000 includes a Central Processing Unit (CPU) 1001, which can perform various appropriate actions and processes based on programs stored in Read-Only Memory (ROM) 1002 or programs loaded from storage portion 1008 into Random Access Memory (RAM) 1003, such as performing the methods described in the above embodiments. Various programs and data required for system operation are also stored in RAM 1003. The CPU 1001, ROM 1002, and RAM 1003 are interconnected via bus 1004. An Input / Output (I / O) interface 1005 is also connected to bus 1004.

[0127] The following components are connected to I / O interface 1005: an input section 1006 including a keyboard, mouse, etc.; an output section 1007 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 1008 including a hard disk, etc.; and a communication section 1009 including a network interface card such as a LAN (Local Area Network) card, modem, etc. The communication section 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to I / O interface 1005 as needed. Removable media 1011, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 1010 as needed so that computer programs read from them can be installed into storage section 1008 as needed.

[0128] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 1009, and / or installed from removable medium 1011. When the computer program is executed by central processing unit (CPU) 1001, it performs various functions defined in the system of this application.

[0129] It should be noted that the computer-readable medium shown in the embodiments of this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such transmitted data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.

[0130] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0131] The units described in the embodiments of this application can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the specific unit itself.

[0132] In one aspect, this application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the methods described in the above embodiments.

[0133] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0134] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, touch terminal, or network device, etc.) to execute the method according to the embodiments of this application.

[0135] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the embodiments disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein.

[0136] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method of data access for a multi-tenant system, the method comprising: The method is performed by a server, and the method comprises: encrypting, by a server, data of a tenant in a multi-tenant system according to a key corresponding to the tenant, to obtain encrypted data of the tenant, wherein the keys of the tenants in the multi-tenant system are all different; the multi-tenant system comprises one or more than one independent machine tenant, and the encrypted data of the independent machine tenant is stored by a machine specific to the independent machine tenant, and the data amount of the independent machine tenant is greater than that of other tenants in the multi-tenant system; establishing a session with the tenant and initializing a connection with a target database; when receiving a data query instruction from the tenant from the session, judging whether the tenant has a connection permission of the target database, the data query instruction being an SQL; if the tenant has the connection permission of the target database, judging whether a data table requested to be queried by the data query instruction is a system table; in a case where it is determined that the data table requested to be queried by the data query instruction is not a system table, judging whether tenant identity information is carried in the data query instruction; in a case where the tenant identity information is carried in the data query instruction, judging whether the tenant identity information in a filtering condition of the data query instruction is consistent with tenant identity information in the current session; wherein when the tenant identity information in the data query instruction is consistent with the tenant identity information in the current session, it is determined that the data query instruction passes a legality check; if the data query instruction passes the legality check, performing a data query operation on the encrypted data according to the data query instruction, to obtain a query result; taking a tenant sending the data query instruction as a target tenant, performing a decryption operation on the query result according to a key corresponding to the target tenant, and outputting a decryption result.

2. The method of claim 1, wherein, The encrypted data is stored in a database, and the encrypted data of each tenant in the multi-tenant system is stored by a database specific to the tenant.

3. The method of claim 2, wherein, The judgment whether the tenant has the connection permission of the target database comprises: when receiving the data query instruction from the tenant from the session, judging whether the target database is a public library, wherein the public library is a database in which encrypted data of a tenant is not stored in the multi-tenant system; if the target database is not the public library, judging whether the tenant has the connection permission of the target database.

4. A data access apparatus of a multi-tenant system, characterized by, The device is arranged in a server, and the device comprises: an encryption module configured to encrypt, by a server, data of a tenant in a multi-tenant system according to a key corresponding to the tenant, to obtain encrypted data of the tenant, wherein the keys of the tenants in the multi-tenant system are all different; the multi-tenant system comprises one or more than one independent machine tenant, and the encrypted data of the independent machine tenant is stored by a machine specific to the independent machine tenant, and the data amount of the independent machine tenant is greater than that of other tenants in the multi-tenant system; The apparatus is further configured to establish a session with the tenant and initialize a connection with the target database; The legality verification module is configured to, when receiving a data query instruction from the tenant from the session, judge whether the tenant has a connection permission of the target database, the data query instruction being an SQL; if the tenant has the connection permission of the target database, judge whether a data table requested to be queried by the data query instruction is a system table; in a case where it is determined that the data table requested to be queried by the data query instruction is not the system table, judge whether tenant identity information is carried in the data query instruction; in a case where the tenant identity information is carried in the data query instruction, judge whether tenant identity information in a filtering condition of the data query instruction is consistent with tenant identity information in a current session; wherein, when the tenant identity information in the data query instruction is consistent with the tenant identity information in the current session, it is determined that the data query instruction passes the legality verification; The query module is configured to, if the data query instruction passes the legality verification, perform a data query operation on the encrypted data according to the data query instruction to obtain a query result; The decryption module is configured to, taking a tenant sending the data query instruction as a target tenant, perform a decryption operation on the query result according to a key corresponding to the target tenant, and output a decryption result.

5. A computer readable medium having stored thereon a computer program, characterized in that, The computer program is executed by a processor to implement the method of any one of claims 1 to 3.

6. An electronic device, comprising: Comprise: One or more processors; A storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the method of any one of claims 1 to 3.

Images