A data isolation method, system and computer readable storage medium

Abstract

The application provides a data isolation method, system and medium, the method comprising: a warehouse providing end setting a tenant environment in a data warehouse; configuring data transmission permission of the tenant environment, and setting the configured tenant environment as a data sandbox, so as to authorize a user end renting the data sandbox to perform data import on the data sandbox, and authorize a management end managing the data sandbox to perform data export on the data sandbox; starting the data sandbox, so that the data sandbox isolates data of each user end in the data sandbox by using multi-tenant isolation technology. The application can realize the function of the data sandbox by using the tenant environment with special permission setting on the basis of the multi-tenant technology, not only ensures that user data receives controlled processing in the special tenant environment and is controlled output by the management end, but also does not need to perform independent logical isolation on multiple levels such as calculation, storage and network of the data warehouse, thereby effectively reducing the implementation cost of the data sandbox.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data isolation, in particular to a data isolation method, system and computer readable storage medium. BACKGROUND

[0002] A sandbox is a virtual system program, which allows users to run programs in an isolated sandbox environment under controlled conditions and output running results. In an enterprise-level data warehouse, the sandbox can also be referred to as a data sandbox. In the related art, the implementation of the data sandbox requires independent logical isolation of multiple levels such as computing, storage and network of the data warehouse, and the implementation scheme is complex and has high cost. SUMMARY

[0003] The purpose of the present application is to provide a data isolation method, system and computer readable storage medium, which can realize the function of the data sandbox by using a tenant environment with special permission settings on the basis of multi-tenant technology, thereby effectively reducing the implementation cost of the data sandbox.

[0004] To solve the above technical problems, the present application provides a data isolation method, comprising:

[0005] The warehouse providing end sets a tenant environment in the data warehouse;

[0006] The data transmission permission of the tenant environment is configured, and the configured tenant environment is set as a data sandbox to authorize a user end renting the data sandbox to import data into the data sandbox, and to authorize a management end managing the data sandbox to export data from the data sandbox;

[0007] The data sandbox is started to isolate the data of each user end in the data sandbox by using multi-tenant isolation technology.

[0008] Optionally, the user end renting the data sandbox imports data into the data sandbox, comprising:

[0009] The user end configures a source database for the data sandbox; the source database is located outside the data warehouse or in another tenant environment in the data warehouse;

[0010] Data in the source database is imported into the data sandbox.

[0011] Optionally, the user end configures a source database for the data sandbox, comprising:

[0012] The user end configures the source database for the data sandbox by configuring a data import link.

[0013] Optionally, the management end managing the data sandbox performs data export on the data sandbox, comprising:

[0014] The management end configures a target trusted database for the data sandbox; the target trusted database is located outside the data warehouse or in other tenant environments within the data warehouse;

[0015] Data in the data sandbox is exported to the target trusted database.

[0016] Optionally, the management end configures a target trusted database for the data sandbox, comprising:

[0017] The management end configures the target trusted database for the data sandbox by configuring a data export link.

[0018] The application further provides a data isolation system, comprising: a warehouse providing end, a user end, a management end and a data warehouse, wherein,

[0019] The warehouse providing end is used for setting a tenant environment in the data warehouse; configuring data transmission permissions of the tenant environment, and setting the configured tenant environment as a data sandbox to authorize the user end renting the data sandbox to perform data import on the data sandbox and authorize the management end managing the data sandbox to perform data export on the data sandbox; starting the data sandbox to make the data sandbox isolate data of each user end within the data sandbox by using a multi-tenant isolation technology;

[0020] The user end is used for performing data import on the data sandbox after renting the data sandbox;

[0021] The management end is used for performing data export on the data sandbox after managing the data sandbox;

[0022] The data warehouse is used for storing the tenant environment.

[0023] Optionally, the user end is further used for configuring a source database for the data sandbox; the source database is located outside the data warehouse or in other tenant environments within the data warehouse; and data in the source database is imported into the data sandbox.

[0024] Optionally, the user end is further used for configuring the source database for the data sandbox by configuring a data import link.

[0025] Optionally, the management end is further used for configuring a target trusted database for the data sandbox; the target trusted database is located outside the data warehouse or in other tenant environments within the data warehouse; and data in the data sandbox is exported to the target trusted database.

[0026] The application further provides a computer readable storage medium, wherein computer executable instructions are stored in the computer readable storage medium, and the computer executable instructions are loaded and executed by a processor to implement the data isolation method.

[0027] The application provides a data isolation method, which comprises the following steps of: a warehouse providing end setting a tenant environment in a data warehouse; configuring data transmission permissions of the tenant environment, and setting the configured tenant environment as a data sandbox to authorize a user end renting the data sandbox to perform data import on the data sandbox and authorize a management end managing the data sandbox to perform data export on the data sandbox; and starting the data sandbox to make the data sandbox isolate data of each user end in the data sandbox by using a multi-tenant isolation technology.

[0028] It can be seen that, when setting the data sandbox, the warehouse providing end of the application first sets a tenant environment, which can realize isolation management of data of each user in the environment by using the multi-tenant isolation technology; after the setting is completed, the warehouse providing end further configures data transmission permissions of the environment, and sets the configured tenant environment as a data sandbox to ensure that the user end renting the environment can only import data into the sandbox, and the management end managing the environment can export data in the sandbox. In other words, the application can realize the function of the data sandbox by using the tenant environment with special permissions on the basis of the multi-tenant technology, which not only ensures that user data receives controlled processing in the special tenant environment and is controlled output by the management end, but also does not need to perform independent logical isolation on multiple levels such as calculation, storage and network of the data warehouse, thereby effectively reducing the implementation cost of the data sandbox. The application further provides a data isolation system and a computer readable storage medium, which have the above beneficial effects. BRIEF DESCRIPTION OF DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description only constitute the embodiments of the application, and for those skilled in the art, other drawings can be obtained without creative labor on the basis of the provided drawings.

[0030] Figure 1 A flow chart of a data isolation method provided by the embodiments of the application;

[0031] Figure 2 A schematic diagram of a data sandbox provided by the embodiments of the application;

[0032] Figure 3 A structural block diagram of a data isolation system provided by the embodiments of the application. DETAILED DESCRIPTION

[0033] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the following will clearly and completely describe the technical solutions in the embodiments of the present application with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0034] A sandbox is a virtual system program, which allows users to run programs in an isolated and controlled sandbox environment and output running results under controlled conditions. In an enterprise-level data warehouse, the sandbox can also be referred to as a data sandbox. In the related art, the implementation of the data sandbox needs to perform independent logical isolation on multiple levels such as computing, storage and network of the data warehouse, and the implementation scheme is complex and has a high cost. Therefore, the present application can implement the function of the data sandbox by using a tenant environment with special permission settings on the basis of multi-tenant technology, thereby effectively reducing the implementation cost of the data sandbox. Please refer to Figure 1 , Figure 1 A flowchart of a data isolation method provided by an embodiment of the present application, which can include the following steps.

[0035] S101, the warehouse providing end sets a tenant environment in the data warehouse.

[0036] Multi-tenant technology, also known as multi-rental technology, is a software architecture technology, which explores and implements how to share the same system or program component in a multi-user environment and still ensure the isolation of data between users. In the present application, a tenant environment is used as the basis of the data warehouse, wherein the tenant environment is a system environment implemented by using multi-tenant technology, which can provide business services for multiple users and isolate data of each user by using multi-tenant technology. Since the data of each user can be isolated by the tenant environment, the tenant environment can ensure that the user data is not accessed by a third party, thereby achieving the effect of isolating the third party by the data sandbox; at the same time, since the tenant environment can provide computing, storage and network environment for users, the data sandbox obtained by modifying the tenant environment can also provide computing, storage and network environment for users.

[0037] It should be noted that the embodiments of the present application do not limit the setting mode of the tenant environment, and the related technologies of the multi-tenant technology can be referred to. The embodiments of the present application do not limit the number of users that can access each tenant environment, and the number can be set according to actual application requirements. The embodiments of the present application do not limit the maximum number of tenant environments that can be set as data sandboxes in a single data warehouse, which can be one or multiple, and can also be set according to actual application requirements.

[0038] S102, configure data transmission permissions of the tenant environment, and set the configured tenant environment as a data sandbox, to authorize a user end that rents the data sandbox to perform data import on the data sandbox, and authorize a management end that manages the data sandbox to perform data export on the data sandbox.

[0039] Further, in order to ensure that the data in the data sandbox can be imported by the user and can be exported under controlled conditions, the embodiments of the present application specially configure the data transmission permissions of the tenant environment. Specifically, the embodiments of the present application adjust the data transmission permissions of the tenant environment to the user end and the management end, to limit the user end to only input data into the tenant environment, and the management end can export the data in the tenant environment. After the above adjustment, the tenant environment specially adjusted in this way can realize the basic function of the data sandbox, that is, the user end can import data into the data sandbox for operation, but cannot export the data, and the management end can export the data from the data sandbox under controlled conditions. Since the tenant environment can also provide the data sandbox with the ability of isolation from the third party, as well as the computing, storage and network environment, the tenant environment with adjusted data permissions can realize the function of the data sandbox, and can effectively reduce the implementation complexity and cost of the data sandbox.

[0040] Further, it should be noted that the embodiments of the present application do not limit the data source used by the user end, and the data source can be located in the data warehouse or outside the data warehouse. The embodiments of the present application do not limit the specific form of the data source, which can be a general storage medium or a database. Considering that the storage capacity of the database is large, in the embodiments of the present application, the data source can be a database. Further, the database can be an independent database outside the data warehouse, or a database in other tenant environments in the data warehouse. It should be noted that the embodiments of the present application do not limit whether the other tenant environments in the data warehouse are common tenant environments or data sandboxes as described in the embodiments of the present application. It can be understood that if the administrator of the other data sandbox in the data warehouse also rents the data sandbox, the administrator can also import the data of the other data sandbox into the data sandbox.

[0041] In a possible case, the user end that rents the data sandbox imports data into the data sandbox, comprising:

[0042] Step 11: The user end configures a source database for the data sandbox; the source database is located outside the data warehouse or in other tenant environments within the data warehouse;

[0043] Step 12: Data in the source database is imported into the data sandbox.

[0044] Further, the user end can directly connect the source database to the data sandbox by configuring a database link. The specific configuration method of the database link is not limited in the embodiment of the present application, and can be referred to related technologies of the database.

[0045] In a possible case, the user end configures a source database for the data sandbox, which can include:

[0046] Step 21: The user end configures a source database for the data sandbox by configuring a data import link.

[0047] Further, the embodiment of the present application also does not limit the data destination provided by the management end. The data destination can be located inside or outside the data warehouse. The specific form of the data destination is not limited in the embodiment of the present application, for example, can be a common storage medium or a database. Considering that the storage capacity of the database is large, therefore, in the embodiment of the present application, the data destination can be a database. It should be noted that, in order to protect the security of user data, the target database as the data destination should be a trusted database, that is, configured with related security protection mechanisms, for example, set with a password or access permission, and the specific security protection mechanism can be referred to related technologies of the database. Further, the database can be an independent database outside the data warehouse or a database in other tenant environments within the data warehouse.

[0048] In a possible case, the management end managing the data sandbox performs data export on the data sandbox, which can include:

[0049] Step 31: The management end configures a target trusted database for the data sandbox; the target trusted database is located outside the data warehouse or in other tenant environments within the data warehouse.

[0050] Step 32: Data in the data sandbox is exported to the target trusted database.

[0051] Further, the management end can also connect the target trusted database to the data sandbox by configuring a database link.

[0052] In a possible case, the management end configures a target trusted database for the data sandbox, which can include:

[0053] Step 41: The management end configures a target trusted database for the data sandbox by configuring a data export link.

[0054] S103, start the data sandbox, so that the data sandbox isolates the data of each user end by using the multi-tenant isolation technology.

[0055] Since the tenant environment can provide isolation in computing, storage and network environment for users by using the multi-tenant isolation technology, the data sandbox based on the tenant environment can also isolate the data of each user end by using the multi-tenant isolation technology. The specific isolation manner can refer to the related content of the multi-tenant isolation technology.

[0056] Based on the above embodiment, when setting the data sandbox, the warehouse providing end first sets the tenant environment, which can realize isolation management of the data of each user in the environment by using the multi-tenant isolation technology. After the setting is completed, the warehouse providing end also configures the data transmission permission of the environment, and sets the configured tenant environment as the data sandbox, so as to ensure that the user end renting the environment can only import data into the sandbox, and the management end managing the environment can export the data in the sandbox. In other words, the application can realize the function of the data sandbox by using the tenant environment with special permission setting on the basis of the multi-tenant technology, which not only ensures that the user data receives controlled processing in the special tenant environment and is controlled output by the management end, but also does not need to perform independent logical isolation on multiple levels such as computing, storage and network of the data warehouse, thereby effectively reducing the implementation cost of the data sandbox.

[0057] The above data isolation method is introduced below based on a specific data flow diagram. Please refer to Figure 2 , Figure 2 A schematic diagram of the data sandbox provided by the embodiment of the application. The data sandbox based on the tenant environment can be realized by the following manner:

[0058] 1. Classify the data links in the tenant and other data sources, and divide the data links into two categories according to the direction of data into the data warehouse, that is, import and export. The import link is responsible for importing data from other media into the data warehouse, and the export link is responsible for exporting data from the data warehouse.

[0059] 2. Add the role of the sandbox super administrator in the permission configuration of the sandbox, and the permission is that the sandbox super administrator can configure the export link, so that the data export is completely controlled by the sandbox super administrator. Meanwhile, other personnel do not have the permission to configure the export link.

[0060] 3. The permission of data sharing between tenants is only owned by the super administrator of the sandbox.

[0061] Specifically, in the data sandbox based on the tenant environment, Figure 2In the embodiment, the administrator of the data sandbox A is the administrator A, and the administrator of the data sandbox B is the administrator B. The data of the data sandbox A can be imported into the data sandbox A by the user terminal from an external data source or from other tenant environments, and the data of the data sandbox A can be exported from the data sandbox A to an external data source or other tenant environments by the administrator A. Of course, if the administrator B also rents the data sandbox A, that is, the administrator B belongs to the user terminal that rents the data sandbox A, the administrator B can also import the data of the data sandbox B into the data sandbox B, and the administrator A can also import the data of the data sandbox A into the data sandbox B.

[0062] The data isolation system and the computer readable storage medium provided by the embodiment of the application are described below. The data isolation system and the computer readable storage medium described below can be correspondingly referred to the data isolation method described above.

[0063] Please refer to Figure 3 , Figure 3 A structure block diagram of the data isolation system provided by the embodiment of the application is shown in FIG. 1. The system can include a warehouse providing terminal 301, a user terminal 302, a management terminal 303 and a data warehouse 304, wherein,

[0064] The warehouse providing terminal 301 is configured to set a tenant environment in the data warehouse 304, configure data transmission permissions of the tenant environment, and set the configured tenant environment as a data sandbox to authorize the user terminal 302 that rents the data sandbox to import data into the data sandbox, and authorize the management terminal 303 that manages the data sandbox to export data from the data sandbox, and start the data sandbox to isolate the data of each user terminal 302 in the data sandbox by using a multi-tenant isolation technology.

[0065] The user terminal 302 is configured to import data into the data sandbox after renting the data sandbox.

[0066] The management terminal 303 is configured to export data from the data sandbox after managing the data sandbox.

[0067] The data warehouse 304 is configured to store the tenant environment.

[0068] Optionally, the user terminal 302 is further configured to configure a source database for the data sandbox. The source database is located outside the data warehouse 304 or in other tenant environments in the data warehouse 304. The data in the source database is imported into the data sandbox.

[0069] Optionally, the user terminal 302 is further configured to configure the source database for the data sandbox by configuring a data import link.

[0070] Optionally, the management terminal 303 is further configured to configure a target trusted database for the data sandbox, the target trusted database being located outside the data warehouse 304 or in other tenant environments inside the data warehouse 304, and export data in the data sandbox to the target trusted database.

[0071] Optionally, the management terminal 303 is further configured to configure a target trusted database for the data sandbox by configuring a data export link.

[0072] The embodiment of the present application further provides a computer readable storage medium, and the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the data isolation method of any of the above embodiments.

[0073] Since the embodiments of the computer readable storage medium part correspond to the embodiments of the data isolation method part, the embodiments of the computer readable storage medium part are described in the description of the embodiments of the data isolation method part, and are not described here.

[0074] The embodiments in the description are described in a progressive manner, and each embodiment focuses on the difference from other embodiments, and the same or similar parts of each embodiment can be referred to each other. For the device disclosed by the embodiments, since it corresponds to the method disclosed by the embodiments, the description is relatively simple, and the related parts are described in the method part.

[0075] The skilled person can further realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed in the present text can be realized in electronic hardware, computer software or combination of the two. In order to clearly show the interchangeability of hardware and software, the composition and steps of each example are described in the above description. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0076] The steps of the method or algorithm described in combination with the embodiments disclosed in the present text can be directly implemented in hardware, software module executed by a processor, or combination of the two. The software module can be placed in a random access memory (RAM), a memory, a read only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0077] The above describes in detail the data isolation method, system and computer readable storage medium provided by the present application. The principles and implementation modes of the present application are described by applying specific examples in this paper, and the above description of the examples is only used to help understand the method of the present application and its core idea. It should be pointed out that, for ordinary skilled persons in the technical field, some improvements and modifications can be made to the present application without departing from the principles of the present application, and these improvements and modifications also fall within the protection scope of the claims of the present application.

Claims

1. A method of data isolation, comprising: The warehouse providing end sets a tenant environment in a data warehouse; configure the data transmission permission of the tenant environment, and set the configured tenant environment as a data sandbox to authorize the user end renting the data sandbox to import data into the data sandbox and perform operation in the data sandbox, and authorize the management end managing the data sandbox to export data from the data sandbox; the data sandbox is used to run programs in an isolated and controlled sandbox environment for users and output running results under controlled conditions, and the tenant environment is used to provide the data sandbox with the ability to isolate from third parties and computing, storage and network environment; start the data sandbox to isolate the data of each user end in the data sandbox by using multi-tenant isolation technology; the user end renting the data sandbox imports data into the data sandbox, including: the user end configures a source database for the data sandbox; the source database is located outside the data warehouse or in other tenant environments in the data warehouse; import data in the source database into the data sandbox; the management end managing the data sandbox exports data from the data sandbox, including: the management end configures a target trusted database for the data sandbox; the target trusted database is located outside the data warehouse or in other tenant environments in the data warehouse, and the target trusted database is configured with a security protection mechanism; export data in the data sandbox to the target trusted database. The user end configures a source database for the data sandbox, including:

2. The data isolation method of claim 1, wherein, the user end configures the source database for the data sandbox by configuring data import link. The management end configures a target trusted database for the data sandbox, including:

3. The data isolation method of claim 1, wherein, the management end configures the target trusted database for the data sandbox by configuring data export link. The warehouse providing end, the user end, the management end and the data warehouse, wherein 4. A data isolation system, comprising: the warehouse providing end is used to set a tenant environment in a data warehouse; configure the data transmission permission of the tenant environment, and set the configured tenant environment as a data sandbox to authorize the user end renting the data sandbox to import data into the data sandbox and perform operation in the data sandbox, and authorize the management end managing the data sandbox to export data from the data sandbox; the data sandbox is used to run programs in an isolated and controlled sandbox environment for users and output running results under controlled conditions, and the tenant environment is used to provide the data sandbox with the ability to isolate from third parties and computing, storage and network environment; start the data sandbox to isolate the data of each user end in the data sandbox by using multi-tenant isolation technology; the user end is used to import data into the data sandbox and perform operation in the data sandbox after renting the data sandbox; the management end is used to export data from the data sandbox after managing the data sandbox; the data warehouse is used to store the tenant environment; ​ ​ The user terminal is further configured to configure a source database for the data sandbox; the source database is located outside the data warehouse or in another tenant environment within the data warehouse; and data in the source database is imported into the data sandbox. The management terminal is further configured to configure a target trusted database for the data sandbox; the target trusted database is located outside the data warehouse or in another tenant environment within the data warehouse; and data in the data sandbox is exported to the target trusted database; and the target trusted database is configured with a security protection mechanism.

5. The data isolation system of claim 4, wherein, The user terminal is further configured to configure the source database for the data sandbox by configuring a data import link.

6. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer executable instructions, which are loaded and executed by the processor to implement the data isolation method according to any one of claims 1 to 3.

Images