Multi-tenant data isolation method, server, system and storage medium

Abstract

The present disclosure provides a multi-tenant data isolation method, server, system and storage medium, the method comprising: receiving a data operation sent by a client where a current tenant is located, the data operation including the identity of the current tenant; obtaining a routing strategy and a sharding strategy corresponding to the identity of the current tenant based on the identity of the current tenant; determining a data storage space corresponding to the routing strategy and the sharding strategy based on the routing strategy and the sharding strategy; performing data operations on the data storage space; wherein the routing strategy includes a mapping relationship between the identities of all tenants and a tenant logic table, and the sharding strategy includes a mapping relationship between the tenant logic table and the data storage space.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and more specifically, to a multi-tenant data isolation method, server, system, and storage medium. Background Art

[0002] Data isolation is a critical design requirement in SaaS software systems. Its primary purpose is to ensure that different tenants using the same software system experience exclusive access to the entire system. This is primarily reflected in the fact that performance is not impacted and data is not visible to each other. Mainstream multi-tenant isolation solutions are categorized into physical database isolation, logical database isolation, and data tag isolation.

[0003] In implementing the concepts of this disclosure, the inventors discovered at least the following issues in the related art: Physical database isolation isolates data at the physical layer, which offers high isolation but also high costs. Logical database isolation creates a database instance for each tenant, with all instances sharing a physical database server or cluster. This solution offers slightly higher isolation but moderate costs. Data tag isolation tags each tenant's data with a tenant ID and logically isolates it through data middleware. This solution offers the lowest cost but also the lowest degree of isolation. Summary of the Invention

[0004] In view of this, the present disclosure provides a multi-tenant data isolation method, server, system and storage medium.

[0005] One aspect of the present disclosure provides a multi-tenant data isolation method, applied to a software-as-a-service application server, the method comprising:

[0006] Receive a data operation sent by a client where the current tenant is located, where the data operation includes an identity identifier of the current tenant;

[0007] According to the identity identifier of the current tenant, obtaining a routing policy and a sharding policy corresponding to the identity identifier of the current tenant from pre-stored routing policies and sharding policies;

[0008] Determining, according to the routing strategy and the sharding strategy, a data storage space in the database corresponding to the routing strategy and the sharding strategy;

[0009] performing the data operation on the data storage space;

[0010] The routing strategy includes a mapping relationship between the identities of all tenants and the tenant logic table, and the sharding strategy includes a mapping relationship between the tenant logic table and the data storage space.

[0011] According to an embodiment of the present disclosure, determining, according to the routing policy and the sharding policy, the data storage space in the database corresponding to the routing policy and the sharding policy includes:

[0012] Obtaining a logical table corresponding to the identity of the current tenant according to a mapping relationship between the tenant's identity stored in the routing policy and the tenant logical table;

[0013] According to the mapping relationship between the tenant logic table and the data storage space stored in the sharding strategy, the data storage space corresponding to the tenant logic table corresponding to the identity identifier of the current tenant in the database is determined.

[0014] According to an embodiment of the present disclosure, before performing the data operation on the data storage space, the method includes:

[0015] Determining an operation type of the data operation;

[0016] The performing the data operation on the data storage space includes:

[0017] When the operation type is a read operation, reading data corresponding to the read operation from the data storage space;

[0018] When the operation type is a write operation, data corresponding to the write operation is written into the data storage space.

[0019] According to an embodiment of the present disclosure, it further includes:

[0020] Receive routing and sharding strategies from the server where the tenant data configuration center is located;

[0021] Storing the routing strategy and the sharding strategy to obtain the pre-stored routing strategy and the sharding strategy;

[0022] The tenant data configuration center stores all routing strategies and sharding strategies.

[0023] According to an embodiment of the present disclosure, the middle layer of the software-as-a-service application server stores routing policies and sharding policies of all tenants.

[0024] According to an embodiment of the present disclosure, it further includes:

[0025] When restarting an existing SaaS application or adding a new SaaS application, all routing and sharding policies are obtained from the tenant data configuration center;

[0026] According to all the acquired routing policies and sharding policies, the routing policies and sharding policies of all tenants stored in the middle layer of the software as a service application server are updated.

[0027] Another aspect of the present disclosure provides a software-as-a-service application server, comprising:

[0028] A receiving module, configured to receive a data operation sent by a client where the current tenant is located, wherein the data operation includes an identity identifier of the current tenant;

[0029] An acquisition module is used to acquire, according to the identity identifier of the current tenant, a routing policy and a sharding policy corresponding to the identity identifier of the current tenant from pre-stored routing policies and sharding policies;

[0030] A determination module, configured to determine, in accordance with the routing strategy and the sharding strategy, a data storage space corresponding to the routing strategy and the sharding strategy in a preset database;

[0031] An operation module, configured to perform the data operation on the data storage space;

[0032] The routing strategy includes a mapping relationship between the identities of all tenants and the tenant logic table, and the sharding strategy includes a mapping relationship between the tenant logic table and the data storage space.

[0033] According to an embodiment of the present disclosure, the determination module includes:

[0034] an acquiring unit, configured to acquire a tenant logical table corresponding to the identity identifier of the current tenant according to a mapping relationship between the tenant identity identifier and the tenant logical table stored in the routing policy;

[0035] A determination unit is used to determine the data storage space corresponding to the tenant logical table corresponding to the identity identifier of the current tenant in the database according to the mapping relationship between the tenant logical table and the data storage space stored in the sharding strategy.

[0036] According to an embodiment of the present disclosure, the software as a service application server further includes:

[0037] An operation type determination module is used by the intermediate layer to determine the operation type of the data operation.

[0038] The operation module is specifically configured to: when the operation type is a read operation, read the data corresponding to the read operation from the data storage space; when the operation type is a write operation, write the data corresponding to the write operation into the data storage space.

[0039] According to an embodiment of the present disclosure, the software as a service application server further includes:

[0040] The policy receiving module is used to receive the routing policy and sharding policy sent by the server where the tenant data configuration center is located;

[0041] The policy storage module is used to store the routing policy and the sharding policy to obtain the pre-stored routing policy and the sharding policy.

[0042] According to an embodiment of the present disclosure, the middle layer of the software-as-a-service application server stores routing policies and sharding policies of all tenants.

[0043] According to an embodiment of the present disclosure, further comprising:

[0044] The policy acquisition module is used to obtain all routing policies and sharding policies from the tenant data configuration center when restarting an existing Software as a Service application or adding a new Software as a Service application.

[0045] The updating module is used to update the routing strategies and sharding strategies of all tenants stored in the middle layer of the software as a service application server according to all the acquired routing strategies and sharding strategies.

[0046] Another aspect of the present disclosure provides a software-as-a-service application server, comprising:

[0047] one or more processors;

[0048] a memory for storing one or more programs,

[0049] When the one or more programs are executed by the one or more processors, the one or more processors implement the multi-tenant data isolation method as described above.

[0050] Another aspect of the present disclosure provides a computer-readable storage medium storing computer-executable instructions, which are used to implement the method described above when executed.

[0051] Another aspect of the present disclosure provides a system comprising:

[0052] The client and SaaS application servers where the tenants reside;

[0053] The software-as-a-service application server is the software-as-a-service application server described above.

[0054] According to an embodiment of the present disclosure, after receiving the data operation sent by the client where the current tenant is located, the routing strategy and sharding strategy corresponding to the identity of the current tenant are obtained. The routing strategy includes the mapping relationship between the identity of all tenants and the logical table, and the sharding strategy includes the mapping relationship between the logical table and the data storage space. That is, the tenant logical table corresponding to the tenant's identity is searched in the routing strategy, and then the data operation space corresponding to the tenant logical table is searched in the sharding strategy, and then data operations are performed on the data storage space to achieve data isolation of the tenant. That is, different data isolation schemes can be adopted for different tenants. There is no need to isolate the data from a physical level, and there is no need to create examples. The cost is low and the isolation is high. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] The above and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0056] Figure 1a Schematically illustrates an exemplary system architecture to which a multi-tenant data isolation method according to an embodiment of the present disclosure can be applied;

[0057] Figure 1b The following schematically shows an architecture diagram of a SaaS application server according to an embodiment of the present disclosure;

[0058] Figure 2 The following schematically shows a flow chart of a multi-tenant data isolation method according to an embodiment of the present disclosure;

[0059] Figure 3 Schematically shows a flow chart of a method for determining data storage space according to an embodiment of the present disclosure;

[0060] Figure 4 Schematically shows a flow chart of a multi-tenant data isolation method according to another embodiment of the present disclosure;

[0061] Figure 5 Schematically shows a flow chart of a multi-tenant data isolation method according to another embodiment of the present disclosure;

[0062] Figure 6 A block diagram schematically illustrates a software-as-a-service application server according to an embodiment of the present disclosure; and

[0063] Figure 7 A block diagram of a software as a service application server according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0064] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present disclosure. In the detailed description below, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0065] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise," "include," etc. used herein indicate the presence of the features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0066] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0067] When expressions such as “at least one of A, B, and C, etc.” are used, they should generally be interpreted in accordance with the meaning commonly understood by those skilled in the art (e.g., “a system having at least one of A, B, and C” should include but is not limited to systems having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, and C, etc.). When expressions such as “at least one of A, B, or C, etc.” are used, they should generally be interpreted in accordance with the meaning commonly understood by those skilled in the art (e.g., “a system having at least one of A, B, or C” should include but is not limited to systems having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, and C, etc.).

[0068] Before introducing the present disclosure, the technical terms involved in the disclosure are first explained.

[0069] Software as a Service (SaaS) is an application model that provides software services over the internet. Tenants can subscribe to software services provided by SaaS platform providers on an on-demand basis based on their needs. Typically, a single SaaS application can serve multiple tenants simultaneously.

[0070] A tenant is an enterprise, organization, or group that subscribes to and uses software services provided by a SaaS platform provider. Each tenant has a unique tenant ID. Multiple tenants can use a single SaaS application simultaneously.

[0071] The embodiments of the present disclosure provide a multi-tenant data isolation method, device, server, system and storage medium applied to a SaaS application server. The multi-tenant data isolation method includes receiving a data operation sent by a client where the current tenant is located, the data operation including the identity of the tenant, obtaining a routing strategy and a sharding strategy corresponding to the identity of the current tenant based on the identity of the current tenant, determining a data storage space corresponding to the routing strategy and the sharding strategy in a preset database based on the routing strategy and the sharding strategy, and performing the data operation on the data storage space. The routing strategy includes a mapping relationship between the tenant's identity and the tenant's logical table, and the sharding strategy includes a mapping relationship between the tenant's logical table and the data storage space.

[0072] In the present disclosure, SaaS applications, routing policies and sharding policies, and data operation spaces can be deployed on the same server, or they can be deployed on different servers. For example, SaaS applications, routing policies and sharding policies, and data operation spaces are all deployed on server 1. For another example, SaaS applications are deployed on server 1, routing policies and sharding policies are deployed on server 2, and data operation spaces are deployed on server 3. For another example, SaaS applications, routing policies and sharding policies are deployed on server 1, and data operation spaces are deployed on server 2. For another example, SaaS applications are deployed on server 1, routing policies and sharding policies, and data operation spaces are deployed on server 2. The present disclosure does not impose any restrictions on this. It is understandable that when SaaS applications, routing policies and sharding policies, and data operation spaces are deployed on different servers, different servers are connected through the same local area network.

[0073] In this disclosure, routing policies and sharding policies for different tenants can be deployed separately on the same server or on different servers. For example, for tenants A and B, the routing policy and sharding policy for tenant A can be deployed on server 4, and the routing policy and sharding policy for tenant B can be deployed on server 5. For another example, for tenants A and B, the routing policy and sharding policy for both tenants A and B can be deployed on server 4. This disclosure does not impose any restrictions on this.

[0074] In this disclosure, multiple data operation spaces can be deployed on the same server or on different servers. For example, for data operation spaces A and B, data operation space A is deployed on server 6. For another example, for data operation space A, data operation space A is deployed on server 7. For another example, for data operation space B, data operation space A is deployed on server 8. This disclosure does not impose any restrictions on this.

[0075] Figure 1a The following schematically illustrates an exemplary system architecture 100 to which a multi-tenant data isolation method according to an embodiment of the present disclosure can be applied. Figure 1a The examples shown are merely examples of system architectures to which the embodiments of the present disclosure may be applied, to help those skilled in the art understand the technical content of the present disclosure, but do not mean that the embodiments of the present disclosure may not be used in other devices, systems, environments or scenarios.

[0076] like Figure 1a As shown, the system architecture 100 according to this embodiment may include terminal devices 101, 102, and 103 where multiple tenants are located, a network 104, and a SaaS application server 105. The network 104 is used as a medium for providing a communication link between the terminal devices 101, 102, and 103 and the SaaS application server 105. The network 104 may include various connection types, such as wired and / or wireless communication links, etc.

[0077] Users can use terminal devices 101, 102, and 103 to interact with SaaS application server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, and / or social platform software (for example only).

[0078] The terminal devices 101, 102, 103 may be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, etc. The terminal devices 101, 102, 103 may access the SaaS services provided by the SaaS application server 105 via the Internet.

[0079] The SaaS application server 105 can be used to provide software services to tenants, and for each SaaS application, isolate the data of multiple tenants according to the tenants. Figure 1bAs shown, the SaaS application server 105 may include an application layer, a middle layer, and a database. The application layer receives data operations sent by the tenant's client, and the data operations include the tenant's identity. The middle layer pre-stores a routing strategy and a sharding strategy. The routing strategy includes a mapping relationship between the identities of all tenants and the tenant's logical table, and the sharding strategy includes a mapping relationship between the tenant's logical table and the data storage space.

[0080] It should be understood that Figure 1a The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.

[0081] Figure 2 The flowchart of the multi-tenant data isolation method according to an embodiment of the present disclosure is schematically shown.

[0082] like Figure 2 As shown, the method includes operations S201 to S204. Operation S201 can be performed by the application layer of the SaaS server, and operations S202 to S204 can be performed by the middle layer of the SaaS server.

[0083] In operation S201 , a data operation sent by a client where a current tenant is located is received, where the data operation includes an identity identifier of the current tenant.

[0084] In operation S202, according to the identity identifier of the current tenant, a routing policy and a sharding policy corresponding to the identity identifier of the current tenant are obtained from pre-stored routing policies and sharding policies.

[0085] In operation S203 , a data storage space corresponding to the routing policy and the sharding policy is determined according to the routing policy and the sharding policy.

[0086] In operation S204 , data operation is performed on the data storage space.

[0087] The routing strategy includes the mapping relationship between the tenant's identity and the tenant's logical table, and the sharding strategy includes the mapping relationship between the tenant's logical table and the data storage space.

[0088] In this disclosure, a data operation is one that requires distinguishing between different tenants, meaning that the data corresponding to the data operation is data corresponding to different tenants. The data operation includes the identity of the current tenant, either directly including the identity of the current tenant in the data operation or including information including the identity of the current tenant in the data operation.

[0089] In the present disclosure, after receiving the data operation sent by the client where the current tenant is located, the application layer of the SaaS application server sends the data operation to the middle layer of the SaaS application server. The middle layer parses the data operation to obtain the identity of the current tenant.

[0090] In the present disclosure, each tenant has a set of tenant logic tables and data storage space corresponding to itself, that is, each tenant's identity corresponds to a set of tenant logic tables, and a set of tenant logic tables corresponds to a data storage space. Routing strategies and sharding strategies can be stored in the middle layer, or in the database of a certain server, that is, the middle layer obtains routing strategies and sharding strategies from itself, or obtains routing strategies and sharding strategies from a certain database, that is, the SaaS application is visible to the tenant logic table, and the middle layer that obtains the tenant logic table isolates the SaaS application and the database in the SaaS application server.

[0091] According to the present disclosure, the middle layer finds the routing strategy and sharding strategy corresponding to the identity of the current tenant based on the obtained identity of the current tenant, and according to the mapping relationship between the identity of all tenants stored in the routing strategy and the tenant logic table, and the mapping relationship between the tenant logic table stored in the sharding strategy and the data storage space, first finds the tenant logic table corresponding to the identity of the current tenant in the routing strategy, and then finds the data storage space corresponding to the tenant logic table in the sharding strategy, and implements data operations in the data storage space, thereby achieving data isolation for multiple tenants. At the same time, the SaaS application and the database in the SaaS application server are isolated through the middle layer, and the SaaS application is only visible to the tenant logic table of the routing strategy in the middle layer, and different data isolation schemes can be configured for each tenant. There is no need to isolate the data at the physical level, and there is no need to create instances, so the cost is low and the isolation is high.

[0092] Reference below Figure 3 , combined with specific embodiments Figure 2 The method shown is further explained.

[0093] Figure 3 The flowchart of the method for determining data storage space according to an embodiment of the present disclosure is schematically shown.

[0094] like Figure 3 As shown, operation S203 includes operation S301 and operation S302, and operation S301 and operation S302 can be performed by the middle layer of the SaaS application server.

[0095] In operation S301 , a tenant logic table corresponding to the current tenant's identity is obtained according to a mapping relationship between the tenant's identity stored in a routing policy and the tenant logic table.

[0096] In operation S302, the data storage space corresponding to the tenant logical table corresponding to the identity of the current tenant in the database is determined according to the mapping relationship between the tenant logical table and the data storage space stored in the sharding strategy.

[0097] In the present disclosure, routing strategies and sharding strategies can be stored in the form of tables or key-value pairs. For example, the tenant's identity is ID_A, the tenant logic table corresponding to the tenant's identity ID_A is Log_A, and the data storage space corresponding to the tenant logic table Log_A is Add_A. Then, the routing strategy of the tenant stored in the form of a key-value pair is (ID_A, Log_A), and the sharding strategy of the tenant stored in the form of a key-value pair is (Log_A, Add_A). See Table 1 for routing strategies stored in the form of a table, and see Table 2 for sharding strategies stored in the form of a table.

[0098] Table 1

[0099]

[0100]

[0101] Table 2

[0102] Logical table Data storage space Log_A Add_A Log_B Add_B ...... ......

[0103] In the present disclosure, the middle layer finds the current tenant's identity in the routing policy, and then finds the tenant logical table corresponding to the current tenant's identity based on the mapping relationship between the current tenant's identity and the tenant logical table in the routing policy. The middle layer then finds the tenant logical table in the sharding policy, and finds the data storage space corresponding to the tenant logical table based on the mapping relationship between the tenant logical table and the data storage space in the sharding policy.

[0104] Figure 4 A flowchart of a multi-tenant data isolation method according to another embodiment of the present disclosure is schematically shown.

[0105] like Figure 4 As shown, based on Figure 2 Based on the embodiment, the method further includes operations S401 to S403, and operations S401 to S403 can be performed by the middle layer of the SaaS application server.

[0106] In operation S201 , a data operation sent by a client where a current tenant is located is received, where the data operation includes an identity identifier of the current tenant.

[0107] In operation S202, according to the identity identifier of the current tenant, a routing policy and a sharding policy corresponding to the identity identifier of the current tenant are obtained from pre-stored routing policies and sharding policies.

[0108] In operation S203 , a data storage space corresponding to the routing policy and the sharding policy is determined according to the routing policy and the sharding policy.

[0109] In operation S401 , an operation type of a data operation is determined.

[0110] In operation S402 , when the operation type is a read operation, data corresponding to the read operation is read from the data storage space.

[0111] In operation S403 , when the operation type is a write operation, data corresponding to the write operation is written into the data storage space.

[0112] In the present disclosure, when the operation type is a read operation, the middle layer obtains the tenant logical table corresponding to the current tenant's identity from the routing policy, then obtains the data storage space corresponding to the tenant logical table from the sharding policy, then finds the data storage space in the database and reads the corresponding data from the data storage space. When the operation type is a write operation, the middle layer obtains the tenant logical table corresponding to the current tenant's identity from the routing policy, then obtains the data storage space corresponding to the tenant logical table from the sharding policy, then finds the data storage space in the database and writes the corresponding data of the write operation into the data storage space.

[0113] Figure 5 A flowchart of a multi-tenant data isolation method according to another embodiment of the present disclosure is schematically shown.

[0114] In an embodiment of the present disclosure, the software-as-a-service application server further includes a tenant data control layer.

[0115] like Figure 5 As shown, based on Figure 2 Based on the embodiment, the method further includes operations S501 and S502. Operations S501 and S502 may be performed by an intermediate layer.

[0116] In operation S501, a routing policy and a sharding policy sent by a server where a tenant data configuration center is located are received.

[0117] In operation S502, the routing strategy and sharding strategy are stored to obtain the pre-stored routing strategy and sharding strategy.

[0118] Among them, the tenant data configuration center stores all routing policies and sharding policies.

[0119] In this disclosure, administrators can set up routing and sharding policies for tenants, specifically mapping tenant identities to their logical tables, and mapping tenant logical tables to data storage spaces in the database. These policies are then sent to the middle layer for all tenants. The tenant data configuration center can then push these policies to the middle layer of the SaaS application server.

[0120] Furthermore, the tenant data configuration center stores the routing and sharding strategies of all tenants for backup and to prevent data loss.

[0121] According to the present disclosure, by setting up a tenant data control layer, setting tenant routing and sharding strategies through the tenant data control layer, and then sending all tenant routing and sharding strategies to the middle layer of the SaaS application server, administrators can configure different data isolation solutions for each tenant through the tenant data configuration center.

[0122] In one embodiment of the present disclosure, the middle layer of the SaaS server stores the routing policies and sharding policies of all tenants. When the middle layer needs to obtain the tenant logic table and data storage space corresponding to the current tenant's identity, it can directly obtain the routing policies and sharding policies corresponding to the current tenant's identity from the routing policies and sharding policies of all tenants stored in the middle layer, without having to obtain them from the tenant data configuration center.

[0123] In one of the embodiments of the present disclosure, when an existing Software as a Service application is restarted or a new Software as a Service application is added, all routing policies and sharding policies are obtained from the tenant data configuration center, and the routing policies and sharding policies of all tenants stored in the middle layer of the Software as a Service application server are updated according to all the obtained routing policies and sharding policies.

[0124] Furthermore, for the routing and sharding strategies of newly added tenants, the tenant data configuration center can push the routing and sharding strategies corresponding to the newly added tenants to the middle layer of the SaaS application server. The middle layer can store the newly added routing and sharding strategies so that when obtaining the routing and sharding strategies, they can be obtained directly from the middle layer without having to obtain them from the tenant data configuration center. The tenant data configuration center can also store the newly added routing and sharding strategies to prevent the middle layer from losing the newly added routing and sharding strategies.

[0125] See also Figure 6 , Figure 6 A block diagram of a software as a service application server according to an embodiment of the present disclosure is schematically shown.

[0126] like Figure 6As shown, the SaaS application server 600 includes: a receiving module 610 , an acquiring module 620 , a determining module 630 , and an operating module 640 .

[0127] The receiving module 610 is configured to receive a data operation sent by the client where the current tenant is located, where the data operation includes the identity of the current tenant.

[0128] The acquisition module 620 is configured to acquire, based on the identity identifier of the current tenant, a routing policy and a sharding policy corresponding to the identity identifier of the current tenant from pre-stored routing policies and sharding policies.

[0129] The determination module 630 is configured to determine, according to the routing policy and the sharding policy, a data storage space in a preset database corresponding to the routing policy and the sharding policy.

[0130] The operation module 640 is used to perform data operations on the data storage space.

[0131] The routing strategy includes the mapping relationship between the identities of all tenants and the tenant logic table, and the sharding strategy includes the mapping relationship between the tenant logic table and the data storage space.

[0132] In one embodiment of the present disclosure, the determination module 630 includes:

[0133] An acquiring unit, configured to acquire a tenant logical table corresponding to the current tenant's identity according to a mapping relationship between the tenant's identity stored in the routing policy and the tenant logical table;

[0134] The determining unit is used to determine the data storage space corresponding to the tenant logical table corresponding to the identity identifier of the current tenant according to the mapping relationship between the tenant logical table and the data storage space stored in the sharding strategy.

[0135] In one embodiment of the present disclosure, the software-as-a-service application server 600 further includes:

[0136] The operation type determination module is used to determine the operation type of the data operation.

[0137] The operation module 640 is specifically configured to: when the operation type is a read operation, read data corresponding to the read operation from the data storage space; when the operation type is a write operation, write data corresponding to the write operation into the data storage space.

[0138] In one embodiment of the present disclosure, the software-as-a-service application server 600 further includes:

[0139] The policy receiving module is used to receive the routing policy and sharding policy sent by the server where the tenant data configuration center is located;

[0140] The policy storage module is used to store the routing policy and the sharding policy to obtain the pre-stored routing policy and the sharding policy.

[0141] In one embodiment of the present disclosure, the middle layer of the software-as-a-service application server stores the storage routing policies and sharding policies of all tenants.

[0142] In one embodiment of the present disclosure, it further includes:

[0143] The policy acquisition module is used to obtain all routing policies and sharding policies from the tenant data configuration center when restarting an existing Software as a Service application or adding a new Software as a Service application.

[0144] The updating module is used to update the routing strategies and sharding strategies of all tenants stored in the middle layer of the software as a service application server according to all the acquired routing strategies and sharding strategies.

[0145] According to the modules, submodules, units, and subunits of the embodiments of the present invention, any multiple or at least part of the functions of any multiple thereof can be implemented in one module. According to the modules, submodules, units, and subunits of the embodiments of the present invention, any one or more thereof can be split into multiple modules for implementation. According to the modules, submodules, units, and subunits of the embodiments of the present invention, any one or more thereof can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware of any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation modes of software, hardware, and firmware or in an appropriate combination of any of them. Alternatively, according to the modules, submodules, units, and subunits of the embodiments of the present invention, one or more thereof can be at least partially implemented as a computer program module, which can perform the corresponding function when the computer program module is run.

[0146] For example, any multiple of the receiving module 610, the acquisition module 620, the determination module 630, and the operation module 640 can be combined into one module / unit / sub-unit for implementation, or any one of the modules / units / sub-units can be split into multiple modules / units / sub-units. Alternatively, at least part of the functions of one or more of these modules / units / sub-units can be combined with at least part of the functions of other modules / units / sub-units and implemented in one module / unit / sub-unit. According to an embodiment of the present disclosure, at least one of the receiving module 610, the acquisition module 620, the determination module 630, and the operation module 640 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in an appropriate combination of any of them. Alternatively, at least one of the receiving module 610 , the acquiring module 620 , the determining module 630 , and the operating module 640 may be at least partially implemented as a computer program module, and when the computer program module is executed, the corresponding function may be executed.

[0147] It should be noted that the software as a service application server part in the embodiment of the present disclosure corresponds to the multi-tenant data isolation method part in the embodiment of the present disclosure. The description of the software as a service application server specifically refers to the multi-tenant data isolation method part, which will not be repeated here.

[0148] Figure 7 A block diagram of a Software as a Service application server suitable for implementing the above-described method according to an embodiment of the present disclosure is schematically shown. Figure 7 The software-as-a-service application server shown is only an example and should not limit the functions and scope of use of the embodiments of the present disclosure.

[0149] like Figure 7 As shown, the software as a service application server 700 according to an embodiment of the present disclosure includes a processor 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage part 708 into a random access memory (RAM) 703. The processor 701 may include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (such as an application-specific integrated circuit (ASIC)), etc. The processor 701 may also include an onboard memory for caching purposes. The processor 701 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0150] Various programs and data required for the operation of the system 700 are stored in the RAM 703. The processor 701, ROM 702, and RAM 703 are connected to each other via a bus 704. The processor 701 executes the programs in the ROM 702 and / or RAM 703 to perform various operations of the method flow according to the embodiment of the present disclosure. It should be noted that the programs may also be stored in one or more memories other than the ROM 702 and RAM 703. The processor 701 may also execute the programs stored in the one or more memories to perform various operations of the method flow according to the embodiment of the present disclosure.

[0151] According to an embodiment of the present disclosure, the Software as a Service application server 700 may further include an input / output (I / O) interface 705, which is also connected to the bus 704. The system 700 may further include one or more of the following components connected to the I / O interface 705: an input section 706 including a keyboard, a mouse, etc.; an output section 707 including devices such as a cathode ray tube (CRT), a liquid crystal display (LCD), and speakers; a storage section 708 including a hard disk; and a communication section 709 including a network interface card such as a LAN card or a modem. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. Removable media 711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed in the drive 710 as needed, so that computer programs read therefrom can be installed into the storage section 708 as needed.

[0152] According to an embodiment of the present disclosure, the method flow according to an embodiment of the present disclosure can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 709, and / or installed from the removable medium 711. When the computer program is executed by the processor 701, the above-mentioned functions defined in the system of the embodiment of the present disclosure are executed. According to an embodiment of the present disclosure, the system, equipment, device, module, unit, etc. described above can be implemented by a computer program module.

[0153] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments, or may exist independently and not be incorporated into the device / apparatus / system. The computer-readable storage medium carries one or more programs, and when executed, implements the method according to the embodiments of the present disclosure.

[0154] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium. For example, it may include, but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0155] For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 702 and / or the RAM 703 described above and / or one or more memories other than the ROM 702 and the RAM 703 .

[0156] The present disclosure also provides a system, which can be used as Figure 1a As shown, including:

[0157] The client where the tenant is located and the software as a service application server described in the above embodiment of the present disclosure.

[0158] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the above-mentioned module, program segment, or a part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0159] Those skilled in the art will appreciate that various combinations and / or combinations of features described in the various embodiments and / or claims of this disclosure may be made, even if such combinations or combinations are not explicitly described in this disclosure. In particular, various combinations and / or combinations of features described in the various embodiments and / or claims of this disclosure may be made, without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0160] The embodiments of the present disclosure are described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although each embodiment has been described separately above, this does not mean that the measures in each embodiment cannot be used in combination to advantage. The scope of the present disclosure is defined by the appended claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A multi-tenant data isolation method, applied to a software-as-a-service application server, comprising: Receive a data operation sent by a client where the current tenant is located, where the data operation includes an identity identifier of the current tenant; According to the identity identifier of the current tenant, obtaining a routing policy and a sharding policy corresponding to the identity identifier of the current tenant from pre-stored routing policies and sharding policies, wherein the routing policy includes a mapping relationship between the tenant's identity identifier and a tenant logic table, and the sharding policy includes a mapping relationship between the tenant logic table and a plurality of different data storage spaces; Determining, according to the routing policy and the sharding policy, a data storage space corresponding to the routing policy and the sharding policy, including: obtaining a tenant logical table corresponding to the identity of the current tenant based on a mapping relationship between the tenant's identity stored in the routing policy and the tenant logical table; determining, according to a mapping relationship between the tenant logical table and the data storage space stored in the sharding policy, a data storage space corresponding to the tenant logical table corresponding to the identity of the current tenant; The data operation is performed on the data storage space.

2. The method according to claim 1, before performing the data operation on the data storage space, comprising: Determining an operation type of the data operation; The performing the data operation on the data storage space includes: When the operation type is a read operation, reading data corresponding to the read operation from the data storage space; When the operation type is a write operation, data corresponding to the write operation is written into the data storage space.

3. The method according to claim 1, wherein Also includes: Receive routing and sharding strategies from the server where the tenant data configuration center is located; Storing the routing strategy and the sharding strategy to obtain the pre-stored routing strategy and the sharding strategy; The tenant data configuration center stores all routing strategies and sharding strategies.

4. The method according to claim 1, wherein the middle layer of the software as a service application server stores the routing policies and sharding policies of all tenants.

5. The method according to claim 4, wherein Also includes: When restarting an existing SaaS application or adding a new SaaS application, all routing and sharding policies are obtained from the tenant data configuration center; According to all the acquired routing policies and sharding policies, the routing policies and sharding policies of all tenants stored in the middle layer of the software as a service application server are updated.

6. A software-as-a-service application server comprising: A receiving module, configured to receive a data operation sent by a client where the current tenant is located, wherein the data operation includes an identity identifier of the current tenant; an acquisition module, configured to acquire, based on the identity identifier of the current tenant, a routing policy and a sharding policy corresponding to the identity identifier of the current tenant from pre-stored routing policies and sharding policies, wherein the routing policy includes a mapping relationship between the identities of all tenants and the tenant logic table, and the sharding policy includes a mapping relationship between the tenant logic table and a plurality of different data storage spaces; A determination module, configured to determine, based on the routing strategy and the sharding strategy, a data storage space in a preset database corresponding to the routing strategy and the sharding strategy, comprising: an acquisition unit, configured to acquire, based on a mapping relationship between the tenant's identity stored in the routing strategy and the tenant's logical table, a tenant logical table corresponding to the current tenant's identity; a determination unit, configured to determine, based on a mapping relationship between the tenant logical table and the data storage space stored in the sharding strategy, a data storage space corresponding to the tenant logical table corresponding to the current tenant's identity; An operation module is used to perform the data operation on the data storage space.

7. A software-as-a-service application server comprising: one or more processors; a memory for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the multi-tenant data isolation method according to any one of claims 1 to 5.

8. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, enables the processor to implement the multi-tenant data isolation method according to any one of claims 1 to 5.

9. A system comprising: The client and SaaS application servers where the tenants reside; Wherein, the Software as a Service application server is the Software as a Service application server described in claim 6 or 7 above.

Images