Data sharing system and data sharing method

Abstract

The present invention provides a data sharing system and a data sharing method. The data sharing system includes a storage device and a processor. The processor executes multiple modules stored in the storage device. When a first Software as a Service (SaaS) application sends a data sharing request to a second SaaS application based on first tenant identification data, a mutual trust relationship service module receives a mutual trust relationship confirmation request transmitted by the second SaaS application to confirm the mutual trust relationship based on the mutual trust relationship data. When the mutual trust relationship confirmation is passed, the mutual trust relationship service module obtains virtual user identification data from the tenant management service module and provides the virtual user identity data to the second SaaS application, so that the second SaaS application obtains data permissions based on the second tenant identification data and the virtual user identification data, and shares specific data with the first SaaS application based on the data permissions.

Description

TECHNICAL FIELD

[0001] The present application relates to a data exchange technology, in particular to a data sharing system and a data sharing method. BACKGROUND

[0002] Under the software as a service (SaaS) software architecture, general users (or tenants) do not need to purchase software by themselves, and instead rent web software functions as needed to carry out enterprise operation and management. Under this mode, enterprise users do not need to build and manage software and its running environment, eliminating the need to purchase and maintain software and its necessary running equipment, so that enterprises can more flexibly use the required software functions. However, in most SaaS environments, the same service will have operations from multiple tenants, and data isolation is needed between different tenants to avoid important data leakage. However, in some scenarios, there may be a need for tenants to share certain data.

[0003] However, in order to meet such a demand, a corresponding cross-tenant data sharing method needs to be designed under the multi-tenant SaaS architecture. The current cross-tenant data access scheme is based on relational database design and is planned based on data structure and interdependence between data to achieve cross-tenant data access effects under various exceptions of tenant data isolation. In other words, for example, users need to perform additional association queries when obtaining data, which may damage the multi-tenant data isolation mechanism that ensures data security, and the performance is also relatively unstable. Moreover, under the distributed micro-service architecture commonly used in today's SaaS environment, these designs also make it more difficult to manage the permissions of services, and increase the complexity of human settings, thereby increasing the possibility of vulnerabilities in the overall system. SUMMARY

[0004] The present application is directed to a data sharing system and a data sharing method, which can safely and quickly share data belonging to different tenants.

[0005] According to an embodiment of the present application, a data sharing system includes a storage device and a processor. The storage device stores a plurality of modules. The processor is coupled to a first software as a service application, a second software as a service application and the storage device, and executes the plurality of modules. The plurality of modules include a mutual trust relationship service module and a tenant management service module. When the first software as a service application sends a data sharing request to the second software as a service application based on first tenant identification data, the mutual trust relationship service module receives a mutual trust relationship confirmation request transmitted by the second software as a service application to confirm mutual trust relationship based on mutual trust relationship data. When the mutual trust relationship confirmation is passed, the mutual trust relationship service module obtains virtual user identification data from the tenant management service module, and provides virtual user identification data to the second software as a service application to enable the second software as a service application to obtain data authority based on second tenant identification data and the virtual user identification data, and share specific data to the first software as a service application according to the data authority.

[0006] According to an embodiment of the present application, a data sharing method includes the following steps: when a first software as a service application sends a data sharing request to a second software as a service application based on first tenant identification data, receiving a mutual trust relationship confirmation request transmitted by the second software as a service application to confirm mutual trust relationship based on mutual trust relationship data through a mutual trust relationship service module; and when the mutual trust relationship confirmation is passed, obtaining virtual user identification data from a tenant management service module through the mutual trust relationship service module, and providing virtual user identification data to the second software as a service application to enable the second software as a service application to obtain data authority based on second tenant identification data and the virtual user identification data, and share specific data to the first software as a service application according to the data authority.

[0007] Based on the above, the data sharing system and the data sharing method of the present application can enable tenants to safely and quickly obtain specific data belonging to another tenant by establishing virtual user identities.

[0008] In order to make the above features and advantages of the present application more apparent, the following embodiments are specifically described below, and the accompanying drawings are described in detail as follows. BRIEF DESCRIPTION OF DRAWINGS

[0009] Figure 1 is a block diagram of a data sharing system of an embodiment of the present application;

[0010] Figure 2 is a flowchart of a data sharing method of an embodiment of the present application;

[0011] Figure 3 is a flowchart of a mutual trust relationship application of an embodiment of the present application;

[0012] Figure 4 is a flowchart of establishing authorization data of an embodiment of the present application;

[0013] Figure 5 is a flowchart of obtaining sharing data of an embodiment of the present application.

[0014] BRIEF DESCRIPTION OF DRAWINGS

[0015] 100: a data sharing system;

[0016] 110: a processor;

[0017] 120: a storage module;

[0018] 121: a trust relationship service module;

[0019] 122: a tenant management module;

[0020] 123: a data sharing service module;

[0021] 124: a data authority service module;

[0022] 210: a first software as a service application;

[0023] 220: a second software as a service application;

[0024] 301: a first tenant;

[0025] 302: a second tenant;

[0026] S210-S240, S301-S308, S401-S412, S501, S512: steps. DETAILED DESCRIPTION

[0027] Reference will now be made to the exemplary embodiments of the present application, examples of which are illustrated in the accompanying drawings. Whenever possible, the same reference numerals are used in the drawings and the description to refer to the same or like parts.

[0028] Figure 1 is a block diagram of a data sharing system of an embodiment of the present application. Referring to FIG. 1, Figure 1The data sharing system 100 comprises a processor 110 and a storage module 120. The processor 110 is coupled to the storage module 120. The storage module 120 stores a mutual trust relationship service module 121, a tenant management module 122, a data sharing service module 123, and a data authority module 124. The processor 110 is further coupled to a first software as a service (SaaS) application 210 and a second SaaS application 220. In this embodiment, the data sharing system 100 can be implemented in a SaaS server, and the SaaS server further comprises the first SaaS application 210 and the second SaaS application 220. In an embodiment, the first SaaS application 210 and the second SaaS application 220 can also be stored in the storage module 120. In another embodiment, the mutual trust relationship service module 121, the tenant management module 122, the data sharing service module 123, and the data authority module 124 can also be respectively arranged in a plurality of different servers, without being limited to the architecture shown in the figure. Figure 1

[0029] It is worth noting that in this embodiment, a tenant (e.g. an enterprise) or a user (e.g. an employee of the enterprise) can operate the first SaaS application 210 and the second SaaS application 220 to implement relevant enterprise business management functions and exchange or share business data, but the present application is not limited thereto. In some embodiments of the present application, the first SaaS application 210 and the second SaaS application 220 described below can belong to the same or different applications, which can be determined according to the actual application scenario. In this embodiment, the mutual trust relationship service module 121, the tenant management module 122, the data sharing service module 123, and the data authority module 124 can be implemented in, for example, a program language such as JSON (JavaScript Object Notation), XML (Extensible Markup Language), or YAML, but the present application is not limited thereto.

[0030] ​In this embodiment, the processor 110 may, for example, include a central processing unit (CPU), or other programmable general purpose or special purpose microprocessors (Microprocessor), digital signal processors (Digital Signal Processor, DSP), application specific integrated circuits (Application Specific Integrated Circuits, ASIC), programmable logic devices (Programmable Logic Device, PLD), other similar processing circuitry, or a combination of these devices. The storage module 120 may, for example, include a memory (Memory) and / or a database, wherein the memory may, for example, be a non-volatile memory (Non-Volatile Memory, NVM). The storage module 120 may store relevant programs, modules, systems or algorithms for implementing embodiments of the present application, for the processor 110 to access and execute to implement the relevant functions and operations described in embodiments of the present application.

[0031] In this embodiment, when a tenant (Tenant) operates a first software as a service application 210 and desires to obtain specific data of another tenant in a second software as a service application 220, the first software as a service application 210 can securely and quickly obtain the specific data of another tenant in the second software as a service application 220 through the trust relationship service module 121, the tenant management module 122, the data sharing service module 123 and the data permission module 124, without destroying the original data isolation between different tenants.

[0032] Figure 2 is a flowchart of a data sharing method of an embodiment of the present application. Referring to Figure 1 and Figure 2, the data sharing system 100 can perform the following steps S210-S240. In this embodiment, a first software-as-a-service application 210 can be operated by a tenant and first tenant identification data can be inputted, which can include, for example, tenant identity information. At step S210, when the first software-as-a-service application 210 sends a data sharing request to a second software-as-a-service application 220 based on the first tenant identification data, the trusted relationship service module 121 can receive a confirmation of a trusted relationship requirement transmitted by the second software-as-a-service application 220 to confirm a trusted relationship according to trusted relationship data. At step S220, when the trusted relationship confirmation is passed, the trusted relationship service module 121 can obtain virtual user identification data from the tenant management service module 122 and provide the virtual user identification data to the second software-as-a-service application 220. The virtual user identification data is pre-established by the tenant and another tenant after mutual approval.

[0033] At step S230, the data sharing service module 123 can obtain a sharing data confirmation request transmitted by the second software-as-a-service application 220 and return confirmation information to the second software-as-a-service application 220. At step S240, the data permission service module 124 can obtain a data permission obtaining request transmitted by the second software-as-a-service application 220 and return authorization data to the second software-as-a-service application 220. In this way, the second software-as-a-service application 220 can obtain data permission according to the authorization data and can provide specific data belonging to another tenant to the first software-as-a-service application 210 based on the data permission. The data sharing system and the data sharing method of this embodiment can enable the first software-as-a-service application 210 and the second software-as-a-service application 220 to securely and quickly exchange data between different tenants.

[0034] Figure 3 is a flowchart of a trusted relationship application of an embodiment of the present application. Referring to Figure 1 and Figure 3In step S301, the first tenant 301 can input the first tenant identification data to the first software-as-a-service application 210 and operate the first software-as-a-service application 210 to issue a trust relationship application. In step S302, the first software-as-a-service application 210 issues a trust relationship application request to the second software-as-a-service application 220. In step S303, the second software-as-a-service application 220 can notify the second tenant 302. In step S304, the second tenant 302 can input the second tenant identification data to the second software-as-a-service application 220 and agree to the trust relationship application. In step S305, the second software-as-a-service application 220 can provide the first tenant identification data and the second tenant identification data to the trust relationship service module 121 so that the trust relationship service module 121 can establish trust relationship data according to the first tenant identification data and the second tenant identification data.

[0035] In the present embodiment, the trust relationship data can for example include trust relationship identification data (trust ID), first tenant identification data (tenant ID1), second tenant identification data (tenant ID2), and trust relationship status information (trust Status). The trust relationship status information is for example used to represent information such as application, valid, rejection, and / or invalid. In an embodiment, the trust relationship data can further for example include first party user identification data (userID1) belonging to the first tenant 301, second party user identification data (userID2) belonging to the second tenant 302, and additional description information (desc).

[0036] In step S306, when the trust relationship service module 121 establishes the trust relationship data, the trust relationship service module 121 transmits a virtual user establishment request to the tenant management service module 122 so that the tenant management service module 122 establishes virtual user identification data. In step S307, the second software-as-a-service application 220 can provide trust relationship establishment success information to the first software-as-a-service application 210. In step S308, the first software-as-a-service application 210 can for example display the trust relationship establishment success information to the first tenant 301 through a corresponding operation interface or user interface.

[0037] In this way, the data sharing system 100 can establish trust relationship data for the first tenant 301 and the second tenant 302, and virtual user identification data for subsequent establishment of authorization data and obtaining of shared data.

[0038] Figure 4 is a flowchart of establishing authorization data according to an embodiment of the present disclosure. Referring to FIG. 3B, Figure 1 and Figure 4The present example illustrates the process of establishing authorization data. In step S401, the first tenant 301 can input first tenant identification data to the first software-as-a-service application 210 and operate the first software-as-a-service application 210 to issue a request to establish authorization data. In step S402, the first software-as-a-service application 210 sends an authorization data establishment request to the second software-as-a-service application 220 based on the first tenant identification data. In step S403, the second software-as-a-service application 220 can notify the second tenant 302. In step S404, the second tenant 302 can input second tenant identification data to the second software-as-a-service application 220 and agree to establish authorization data. In step S405, the data sharing service module 123 receives a confirmation of the requirement for mutual trust relationship from the second software-as-a-service application 220 and performs mutual trust relationship confirmation. The data sharing service module 123 can compare the first tenant identification data and the second tenant identification data by using the mutual trust relationship data previously established by the mutual trust relationship service module 121 to determine whether the first tenant 301 and the second tenant 302 have a mutual trust relationship. When the mutual trust relationship confirmation is passed, in step S406, the data sharing service module 123 requests the tenant management service module 122 to provide the virtual user identification data previously generated. The tenant management service module 122 can obtain the virtual user identification data previously established according to the second tenant identification data and the mutual trust relationship data. In step S407, the tenant management service module 122 obtains the virtual user identification data from the data sharing service module 123. In step S408, the data sharing service module 123 requests the data authority service module 124 to establish authority. The data authority service module 124 generates authorization data according to the second tenant identification data and the virtual user identification data. The authorization data is used for the virtual user.

[0039] In this embodiment, the authorization data can include, for example, virtual user identification data (shareID), mutual trust relationship identification data (trustID), first tenant identification data (data sharing receiver (receiverTanentID)), second tenant identification data (data sharing provider (providerTanentID)), and sharing data information (resource). The sharing data information can refer to information of resources and / or services to be shared, for example. In an embodiment, the authorization data can further include, for example, data sharing start time (startDate), data sharing end time (endDate), and data sharing status (authStatus). The data sharing status can be used to indicate information such as application in progress, valid, rejected, and / or invalid, for example. In another embodiment, the authorization data can further include, for example, first party user identification data (data shared receiver user (receiverUserID)) belonging to the first tenant 301, second party user identification data (data sharing provider user (providerUserID)) belonging to the second tenant 302, additional data permission definition (dataRange), and additional description information (desc).

[0040] At step S409, the data permission service module 124 can notify the data sharing service module 123 that the authorization data is successfully established. At step S410, the data sharing service module 123 can notify the second software as a service application 220 that the authorization data is successfully established. At step S411, the second software as a service application 220 can notify the first software as a service application 210 that the authorization data is successfully established. At step S412, the first software as a service application 210 can display authorization data establishment success information to the first tenant 301, for example, through a corresponding operation interface or user interface.

[0041] In this way, the data sharing system 100 can establish authorization data for data sharing between the first tenant 301 and the second tenant 302 for subsequent operations to obtain shared data.

[0042] Figure 5 is a flowchart of an embodiment of the present application for obtaining shared data. Referring to Figure 1 and Figure 5The present example illustrates the process of obtaining shared data. In step S501, the first tenant 301 can input the first tenant identification data to the first software-as-a-service application 210 and operate the first software-as-a-service application 210 to issue a request for data sharing. In step S502, the first software-as-a-service application 210 sends a data sharing request to the second software-as-a-service application 220 based on the first tenant identification data. In step S503, the trusted relationship service module 121 receives a confirmation of the trusted relationship requirement transmitted by the second software-as-a-service application 220 to confirm the trusted relationship based on the trusted relationship data. The trusted relationship service module 121 can compare the first tenant identification data and the second tenant identification data based on the previously established trusted relationship data to determine whether the first tenant 301 and the second tenant 302 have a trusted relationship. When the trusted relationship is confirmed, in step S504, the trusted relationship service module 121 requests the tenant management service module 122 to provide the virtual user identification data. In step S505, the trusted relationship service module 121 can obtain the virtual user identification data from the tenant management service module 122. In step S506, the trusted relationship service module 121 provides the virtual user identification data to the second software-as-a-service application 220.

[0043] When the second software-as-a-service application 220 obtains the virtual user identification data, in step S507, the data sharing service module 123 can obtain a shared data confirmation request transmitted by the second software-as-a-service application 220 to confirm the existence of the data or resources to be shared based on the first tenant identification data and the second tenant identification data. In step S508, the data sharing service module 123 can transmit confirmation information to the second software-as-a-service application 220.

[0044] When the second software-as-a-service application 220 obtains the virtual user identification data and the confirmation information, in step S509, the data permission service module 124 can obtain a data permission obtaining request transmitted by the second software-as-a-service application 220. In step S510, the data permission service module 124 can obtain the authorization data of the virtual user based on the virtual user identification data and the second tenant identification data and transmit the authorization data to the second software-as-a-service application 220. In step S511, the second software-as-a-service application 220 can obtain the corresponding data permission based on the authorization data and share specific data to the first software-as-a-service application 210 based on the data permission. In step S512, the first software-as-a-service application 210 can display the relevant application information of the specific data to the first tenant 301, for example, through the corresponding operation interface or user interface.

[0045] In this way, the data sharing system 100 can securely and quickly share data belonging to different tenants, and can achieve convenient data exchange functions and maintain secure data isolation effects. The data sharing system 100 can have cross-tenant data sharing functions.

[0046] In summary, the data sharing system and the data sharing method of the present application can pre-establish mutual trust relationship data and authorization data for different tenants to achieve two confirmation mechanisms, and can maintain good data isolation between different tenants. When a tenant wants to obtain data of another tenant and / or another software as a service application through a software as a service application, the data sharing system and the data sharing method of the present application can securely and quickly obtain specific data of another tenant and / or another software as a service application through mutual trust relationship confirmation operations and sharing data authorization operations.

[0047] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A data sharing system, characterized in that: include: a storage device for storing a plurality of modules; as well as a processor coupled to the first SaaS application, the second SaaS application, and the storage device, and executing the plurality of modules, wherein the plurality of modules include a mutual trust relationship service module and a tenant management service module; When the first SaaS application sends a data sharing request to the second SaaS application based on the first tenant identification data, the mutual trust relationship service module receives the mutual trust relationship confirmation request transmitted by the second SaaS application, and compares the first tenant identification data belonging to the first tenant and the second tenant identification data belonging to the second tenant with the mutual trust relationship data to confirm the mutual trust relationship. When the mutual trust relationship is confirmed, the mutual trust relationship service module obtains virtual user identification data from the tenant management service module and provides the virtual user identity data to the second Software as a Service application, so that the second Software as a Service application obtains data permissions based on the second tenant identification data and the virtual user identification data, and shares specific data belonging to the second tenant with the first Software as a Service application according to the data permissions.

2. The data sharing system according to claim 1, wherein: The multiple modules also include a data sharing service module, When the second SaaS application obtains the virtual user identification data, the data sharing service module obtains a data sharing confirmation request sent by the second SaaS application and returns a confirmation message to the second SaaS application.

3. The data sharing system according to claim 2, wherein: The multiple modules also include a data authority service module, When the second SaaS application obtains the virtual user identification data and the confirmation information, the data permission service module obtains the data permission request transmitted by the second SaaS application and returns authorization data to the second SaaS application.

4. The data sharing system according to claim 3, wherein: When the first Software as a Service application sends a mutual trust relationship application request to the second Software as a Service application based on the first tenant identification data, the mutual trust relationship service module receives the mutual trust relationship establishment request transmitted by the second Software as a Service application to establish the mutual trust relationship data based on the first tenant identification data and the second tenant identification data.

5. The data sharing system according to claim 4, wherein: When the mutual trust relationship service module establishes the mutual trust relationship data, the mutual trust relationship service module transmits a virtual user creation request to the tenant management service module, so that the tenant management service module creates the virtual user identification data.

6. The data sharing system according to claim 5, wherein: When the first SaaS application sends an authorization data establishment request to the second SaaS application based on the first tenant identification data, the data sharing service module receives the mutual trust relationship confirmation request transmitted by the second SaaS application and performs mutual trust relationship confirmation. When the mutual trust relationship is confirmed, the data sharing service module obtains the virtual user identification data from the tenant management service module and obtains the authorization data from the data authority service module.

7. The data sharing system according to claim 6, wherein: The tenant management service module obtains the virtual user identification data according to the second tenant identification data and the mutual trust relationship data, and the data authority service module generates the authorization data according to the second tenant identification data and the virtual user identification data.

8. The data sharing system according to claim 4, wherein: The mutual trust relationship data includes mutual trust relationship identification data, the first tenant identification data, the second tenant identification data, and mutual trust relationship status information.

9. The data sharing system according to claim 8, wherein: The authorization data includes the virtual user identification data, the mutual trust relationship identification data, the first tenant identification data, the second tenant identification data, and shared data information.

10. The data sharing system according to claim 9, wherein: The authorization data also includes data sharing start time, data sharing end time and data sharing status.

11. A data sharing method, characterized in that: include: When a first SaaS application sends a data sharing request to a second SaaS application based on the first tenant identification data, the mutual trust relationship service module receives a mutual trust relationship confirmation request transmitted by the second SaaS application, and compares the first tenant identification data belonging to the first tenant and the second tenant identification data belonging to the second tenant with the mutual trust relationship data to confirm the mutual trust relationship; as well as When the mutual trust relationship is confirmed, the mutual trust relationship service module obtains virtual user identification data from the tenant management service module, and provides the virtual user identity data to the second Software as a Service application, so that the second Software as a Service application obtains data permissions based on the second tenant identification data and the virtual user identification data, and shares specific data belonging to the second tenant with the first Software as a Service application according to the data permissions.

12. The data sharing method according to claim 11, wherein: The step of enabling the second software-as-a-service application to obtain the data permission based on the second tenant identification data and the virtual user identification data includes: When the second SaaS application obtains the virtual user identification data, the data sharing service module obtains the data sharing confirmation request sent by the second SaaS application and returns confirmation information to the second SaaS application.

13. The data sharing method according to claim 12, wherein: The step of enabling the second software-as-a-service application to obtain the data permission based on the second tenant identification data and the virtual user identification data further includes: When the second SaaS application obtains the virtual user identification data and the confirmation information, the data permission service module obtains the data permission request transmitted by the second SaaS application and returns authorization data to the second SaaS application.

14. The data sharing method according to claim 13, wherein: Also includes: When the first Software as a Service application sends a mutual trust relationship application request to the second Software as a Service application based on the first tenant identification data, the mutual trust relationship service module receives the mutual trust relationship establishment request transmitted by the second Software as a Service application to establish the mutual trust relationship data based on the first tenant identification data and the second tenant identification data.

15. The data sharing method according to claim 14, wherein: Also includes: When the mutual trust relationship service module establishes the mutual trust relationship data, the mutual trust relationship service module transmits a virtual user creation request to the tenant management service module, so that the tenant management service module creates the virtual user identification data.

16. The data sharing method according to claim 15, wherein: Also includes: When the first SaaS application sends an authorization data establishment request to the second SaaS application based on the first tenant identification data, receiving, through the data sharing service module, a mutual trust relationship confirmation request transmitted by the second SaaS application and performing mutual trust relationship confirmation; as well as When the mutual trust relationship is confirmed, the virtual user identification data is obtained from the tenant management service module through the data sharing service module, and the authorization data is obtained from the data authority service module.

17. The data sharing method according to claim 16, wherein: Also includes: Obtaining the virtual user identification data according to the second tenant identification data and the mutual trust relationship data by the tenant management service module; as well as The authorization data is generated by the data authority service module according to the second tenant identification data and the virtual user identification data.

18. The data sharing method according to claim 14, wherein: The mutual trust relationship data includes mutual trust relationship identification data, the first tenant identification data, the second tenant identification data, and mutual trust relationship status information.

19. The data sharing method according to claim 18, wherein: The authorization data includes the virtual user identification data, the mutual trust relationship identification data, the first tenant identification data, the second tenant identification data, and shared data information.

20. The data sharing method according to claim 19, wherein: The authorization data also includes data sharing start time, data sharing end time and data sharing status.

Images