A multi-tenant multi-application autonomous development management method and system under a group

Abstract

The application discloses a kind of multi-tenant multi-application autonomous development management method and system under group, comprising: creating main tenant for group, and setting administrator account to main tenant;Sub-tenants for subordinate units are set by administrator account, corresponding tenant resources are allocated to each sub-tenant, and the sub-tenant is associated with the corresponding organization;According to the function set of main tenant and sub-tenant, the application under main tenant and sub-tenant is developed respectively, and the development authority and access authority of each application are allocated, each sub-tenant has the development authority and access authority under the tenant and main tenant, and the sub-tenants are isolated from each other;The developed application is published. The tenant of main substructure realizes effective management of group to subordinate unit, group has unified management ability to the key data of all sub-tenants, data isolation is formed between each subordinate unit, and the data security of group subordinate unit is guaranteed.

Description

Technical Field

[0001] This invention relates to the field of multi-tenant development and management technology, and in particular to a multi-tenant, multi-application self-development and management method and system for a group. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] Typically, a large corporation comprises numerous independent subsidiaries, each with its own data confidentiality and security requirements. Therefore, when a corporation needs to build a software system, it must employ data isolation to ensure the confidentiality and security of each subsidiary's data, necessitating a multi-tenant architecture. However, due to the master-slave relationship between the corporation and its subsidiaries, while ensuring data isolation for each subsidiary, the corporation also needs unified management and monitoring capabilities for critical data across the entire system. Furthermore, the corporation's business operations require subsidiaries to have access to and be able to operate on the data.

[0004] While traditional multi-tenant models can achieve data isolation, they fail to provide the group with overall system management capabilities. Subsidiaries also face difficulties accessing group business operations, making them unsuitable for the group's actual scenario. Furthermore, due to the complexity and diversity of the group's organizational structure and division of labor, uniformly built applications cannot meet the needs of all organizations. Each subsidiary needs to perform customized development to meet its own individual requirements, and traditional development methods often result in resource waste during customization. Summary of the Invention

[0005] To address the aforementioned issues, this invention proposes a multi-tenant, multi-application self-developed management method and system for a group. Through a master-sub-tenant structure, the group can effectively manage its subordinate units, and the group has unified management capabilities over the key data of all sub-tenants. Data isolation is formed between various subordinate units, ensuring the data security of the group's subordinate units.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] In a first aspect, the present invention provides a multi-tenant, multi-application self-developed management method for a group, comprising:

[0008] Create a primary tenant for the group and set up an administrator account for the primary tenant;

[0009] The administrator account sets up sub-tenants for subordinate units, assigns corresponding tenant resources to each sub-tenant, and associates the sub-tenants with the corresponding organizational structures.

[0010] Based on the functional sets of the main tenant and sub-tenants, applications are developed under the main tenant and sub-tenants respectively, and development permissions and access permissions are assigned to each application. Each sub-tenant has development permissions and access permissions under its own tenant and under the main tenant, and the sub-tenants are isolated from each other.

[0011] Release the developed application.

[0012] As an alternative implementation, the subtenant can be switched to the main tenant, thereby granting the subtenant access to the main tenant.

[0013] As an alternative implementation, tenant resources under the main tenant are distributed to sub-tenants, thereby enabling sub-tenants to access the main tenant.

[0014] As an alternative implementation method, when developing an application, a submodule is generated for each application to ensure code isolation between tenants.

[0015] As an alternative implementation, the application's package path is generated based on the application and tenant's identifiers, and each application is unique.

[0016] As an alternative implementation, the development permissions are allocated to the developers of the sub-tenants as the application development permissions of the main tenant, and the application development permissions of the sub-tenants are only allocated to the developers under this tenant.

[0017] As an alternative implementation, the access permissions allow subtenant users to access applications under the main tenant, while applications under the subtenant are only accessible to users of that tenant.

[0018] As an alternative implementation, application development also includes application export and import. After packaging the application information into a compressed package, the files in the compressed package are encrypted and then exported. The exported application is then imported into the required application, and anti-tampering verification is performed during the import process.

[0019] Secondly, this invention provides a multi-tenant, multi-application, self-developed management system for a group, comprising:

[0020] The primary tenant creation module is configured to create primary tenants for the group and set up administrator accounts for the primary tenants;

[0021] The subtenant module is configured to set up subtenants for subordinate units through an administrator account, assign corresponding tenant resources to each subtenant, and associate the subtenant with the corresponding organizational structure;

[0022] The application development module is configured to develop applications under the main tenant and sub-tenants respectively based on the function sets of the main tenant and sub-tenants, and to assign development permissions and access permissions to each application. Each sub-tenant has development permissions and access permissions under its own tenant and under the main tenant, and the sub-tenants are isolated from each other.

[0023] The application publishing module is configured to publish the developed application.

[0024] Thirdly, the present invention provides an electronic device including a memory and a processor, and computer instructions stored in the memory and running on the processor, wherein the computer instructions, when executed by the processor, perform the method described in the first aspect.

[0025] Fourthly, the present invention provides a computer-readable storage medium for storing computer instructions, which, when executed by a processor, perform the method described in the first aspect.

[0026] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0027] This invention proposes a multi-tenant, multi-application self-developed management method and system for a group. Through a master-sub-tenant structure, the group can effectively manage its subordinate units. The group has unified management capabilities over the key data of all sub-tenants, and data isolation is formed between various subordinate units to ensure the data security of the group's subordinate units.

[0028] This invention proposes a multi-tenant, multi-application self-developed management method and system for a group. The main tenant administrator can configure whether sub-tenants can access the main tenant and which business resources they can access. This satisfies the needs of subordinate units to access group business scenarios while ensuring flexibility and security. It enables subordinate units of the group to support access to some of the group's main business, and all important data is stored in the main tenant's data source, ensuring the security and controllability of important data.

[0029] This invention proposes a multi-tenant, multi-application autonomous development management method and system for a group. By isolating different applications in a modular way, different applications will not affect each other during development and release, which facilitates refined management and improves development efficiency. Moreover, the import and export of applications enhances code reusability and avoids the waste of some development resources.

[0030] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0031] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0032] Figure 1 This is a schematic diagram of the subtenant creation process provided in Embodiment 1 of the present invention;

[0033] Figure 2 This is a diagram of a multi-tenant, multi-application system architecture provided in Embodiment 1 of the present invention. Detailed Implementation

[0034] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0035] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0036] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments of the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. Furthermore, it should be understood that the terms “comprising” and “having”, and any variations thereof, are intended to cover non-exclusive inclusion, for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0037] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0038] Example 1

[0039] This embodiment provides a method for the independent development and management of multi-tenant, multi-application systems within a group, including:

[0040] Create a primary tenant for the group and set up an administrator account for the primary tenant;

[0041] The administrator account sets up sub-tenants for subordinate units, assigns corresponding tenant resources to each sub-tenant, and associates the sub-tenants with the corresponding organizational structures.

[0042] Based on the functional sets of the main tenant and sub-tenants, applications are developed under the main tenant and sub-tenants respectively, and development permissions and access permissions are assigned to each application. Each sub-tenant has development permissions and access permissions under its own tenant and under the main tenant, and the sub-tenants are isolated from each other.

[0043] Release the developed application.

[0044] In this embodiment, tenants are divided into primary tenants and sub-tenants. Primary tenants are used for the group, and sub-tenants are used for the group's subordinate units. Each tenant has an independent data source, and the data sources of sub-tenants are isolated from each other and cannot be shared.

[0045] The master-subtenant relationship is designed primarily to meet the group's need to manage and monitor key data from all its subsidiaries. The key data resides under the master tenant's data source and can only be accessed through system interfaces, preventing subsidiaries from directly manipulating the database and ensuring the group's control over the key data.

[0046] After the system initialization is complete, the system has only one main tenant and only one main data source corresponding to the main tenant. All other sub-tenants and their corresponding data sources are created by the administrator user of the main tenant.

[0047] In this embodiment, the main tenant's administrator accounts include a security officer, a system administrator, and a security auditor. These three administrator accounts have different permissions and are mutually restrictive to ensure the security and stability of the system.

[0048] In this embodiment, the main tenant's security officer account has two functions: data source management and tenant management.

[0049] Among them, the data source management function can maintain the connection information of the data source in the system, and the well-maintained data source can be used as the data source for newly created sub-tenants;

[0050] The tenant management feature allows you to create sub-tenants, such as Figure 1 As shown, when creating a subtenant, it is associated with the data source maintained in the data source management, that is, each subtenant is assigned the corresponding tenant resources;

[0051] The tenant management function also allows configuration of whether subtenants can access the main tenant. If this setting is enabled when access to group business is required, users under the subtenant can switch to the main tenant to access group business. Since whether subtenants can access the main tenant and see which group business is controlled by the three administrator accounts of the main tenant, there will be no security issues.

[0052] After maintaining the tenant resources of the subtenants, the subtenants need to be associated with the corresponding organizations to take effect. The creation of organizations and the association of tenants are carried out through the security officer account. Therefore, through the collaborative work of the security officer and system administrator accounts, the creation and activation of subtenants are realized, ensuring the security and stability of the subtenant creation process.

[0053] After associating a subtenant with its corresponding organization, all users under the organization associated with the subtenant belong to that subtenant. Key data such as organizations, personnel, and users are stored under the main data source, while the sub-data source is used to store the organization's business data and user permission data.

[0054] In this embodiment, an application is a collection of functions under each tenant. A tenant can have multiple applications, and an application can carry one or more functions. Administrators of both the main tenant and sub-tenants can create applications for their respective tenants.

[0055] When an application is created, a submodule is generated in the code. The number of submodules generated corresponds to the number of applications, ensuring code isolation between tenants. The application's package path is generated based on the application and tenant identifiers, making each application unique. After both applications and tenants are initialized, the overall architecture of the multi-tenant, multi-application system is as follows: Figure 2 As shown.

[0056] In this embodiment, during application development, development permissions and access permissions are allocated on an application-by-application basis according to the actual situation. Each application has its own team members, and developers can only view and modify applications that they have permission to access.

[0057] Regarding development permissions, the application development permissions of the main tenant can be assigned to developers of all sub-tenants, while the application development permissions of a sub-tenant can only be assigned to developers within that tenant.

[0058] Regarding access permissions, subtenant users can access applications under the main tenant, while applications under a subtenant can only be accessed by users of that tenant.

[0059] In this embodiment, users under a subtenant can access the main tenant's application in the following two ways:

[0060] The first method is to switch tenants. After logging in, users are provided with an entry point to switch tenants. After the user switches, the user's sub-tenant becomes the main tenant, and the user can see the applications under the main tenant according to the assigned permissions.

[0061] Whether a user under a subtenant can switch tenants is configured in the tenant management system through the main tenant's security officer account; when using this method, the access permissions of the main application are controlled by the main tenant.

[0062] The second method involves application decentralization, where resources corresponding to the main tenant's application are decentralized to sub-tenants. For sub-tenants, these resources are identical to those of the main tenant, and can be allocated to users using the same configuration as the sub-tenant's application. In this method, the access permissions for the main application are controlled by the sub-tenant itself.

[0063] In this embodiment, the application also provides the functions of exporting and importing offline packages. Specifically, if an existing application needs to be reused, the application's code, workflow, resource permissions, database structure, and other information can be packaged into a compressed file and exported using the application export function. Then, it can be imported into the application that needs it. All files in the compressed file are encrypted, and anti-tampering verification is performed during import. Only application packages exported by the system and that have not been tampered with can be imported normally. Moreover, the import of applications is not limited to any tenant. Applications from any tenant can be imported into the tenant that needs to be imported. Only the tenant administrator can operate on the import and export of applications. Developers cannot operate on them to ensure the security of the application.

[0064] In this embodiment, when an application is released, the application that needs to be upgraded and released is packaged into an application deployment package, placed on the server, and incrementally released.

[0065] Example 2

[0066] This embodiment provides a multi-tenant, multi-application, self-developed management system for a group, including:

[0067] The primary tenant creation module is configured to create primary tenants for the group and set up administrator accounts for the primary tenants;

[0068] The subtenant module is configured to set up subtenants for subordinate units through an administrator account, assign corresponding tenant resources to each subtenant, and associate the subtenant with the corresponding organizational structure;

[0069] The application development module is configured to develop applications under the main tenant and sub-tenants respectively based on the function sets of the main tenant and sub-tenants, and to assign development permissions and access permissions to each application. Each sub-tenant has development permissions and access permissions under its own tenant and under the main tenant, and the sub-tenants are isolated from each other.

[0070] The application publishing module is configured to publish the developed application.

[0071] It should be noted that the above modules correspond to the steps described in Embodiment 1, and the examples and application scenarios implemented by the above modules and the corresponding steps are the same, but are not limited to the content disclosed in Embodiment 1. It should also be noted that the above modules, as part of the system, can be executed in a computer system such as a set of computer-executable instructions.

[0072] In further embodiments, the following is also provided:

[0073] An electronic device includes a memory and a processor, as well as computer instructions stored in the memory and running on the processor, wherein the computer instructions, when executed by the processor, perform the method described in Embodiment 1. For brevity, further details are omitted here.

[0074] It should be understood that in this embodiment, the processor can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc.

[0075] Memory may include read-only memory and random access memory, and provides instructions and data to the processor. A portion of memory may also include non-volatile random access memory. For example, memory may also store information about the device type.

[0076] A computer-readable storage medium for storing computer instructions, which, when executed by a processor, perform the method described in Embodiment 1.

[0077] The method in Example 1 can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor. The software modules can reside in readily available storage media in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method. To avoid repetition, a detailed description is not provided here.

[0078] Those skilled in the art will recognize that the units, i.e., algorithm steps, of the various examples described in connection with this embodiment can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0079] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. A self-developed management method for multi-tenant, multi-application applications within a group, characterized in that: include: Create a primary tenant for the group and set up an administrator account for the primary tenant; The administrator account sets up sub-tenants for subordinate units, assigns corresponding tenant resources to each sub-tenant, and associates the sub-tenants with the corresponding organizational structures; when developing applications, a sub-module is generated for each application to ensure code isolation between tenants; The application's package path is generated based on the application and tenant's identifiers, and each application's path is unique. Based on the functional sets of the primary tenant and sub-tenants, applications are developed separately for the primary tenant and sub-tenants, and development and access permissions are assigned to each application. Each sub-tenant has development and access permissions for both its own tenant and the primary tenant, and sub-tenants are isolated from each other. Sub-tenant users can access applications in the primary tenant in the following two ways: The first method is to switch tenants. By switching a sub-tenant to a master tenant, the sub-tenant gains access to the master tenant and can see the applications under the master tenant based on the assigned permissions. In one approach, whether a user under a subtenant can switch tenants is configured in the tenant management system through the security officer account of the main tenant. In this approach, the access permissions of the main application are controlled by the main tenant. The second approach is to distribute the tenant resources under the main tenant to the subtenants, so that the subtenants have the right to access the main tenant. The resources are then distributed to users in the same way as the subtenant applications. In this approach, the access permissions of the main application are controlled by the subtenants themselves. The development permissions are allocated by the main tenant to the developers of the sub-tenants, and the application development permissions of the sub-tenants are only allocated to the developers under this tenant. The access permissions are that subtenant users can access applications under the main tenant, while applications under the subtenant can only be accessed by users of that tenant. Release the developed application.

2. The multi-tenant, multi-application self-developed management method under a group as described in claim 1, characterized in that, Application development also includes application export and import. After packaging the application information into a compressed package, the files in the compressed package are encrypted and then exported. The exported application is then imported into the required application, and anti-tampering verification is performed during the import process.

3. A self-developed management system for multiple tenants and multiple applications within a group, characterized in that: include: The primary tenant creation module is configured to create primary tenants for the group and set up administrator accounts for the primary tenants; The subtenant module is configured to set up subtenants for subordinate units through the administrator account, assign corresponding tenant resources to each subtenant, and associate the subtenant with the corresponding organizational structure; when developing applications, a submodule is generated for each application to ensure code isolation between tenants; The application's package path is generated based on the application and tenant's identifiers, and each application's path is unique. The application development module is configured to develop applications for the main tenant and sub-tenants respectively, based on the functional sets of the main tenant and sub-tenants. Development and access permissions are assigned to each application. Each sub-tenant has development and access permissions for both its own tenant and the main tenant, and sub-tenants are isolated from each other. Sub-tenant users can access the main tenant's applications in the following two ways: The first method is to switch tenants. By switching a sub-tenant to a master tenant, the sub-tenant gains access to the master tenant and can see the applications under the master tenant based on the assigned permissions. In one approach, whether a user under a subtenant can switch tenants is configured in the tenant management system through the security officer account of the main tenant. In this approach, the access permissions of the main application are controlled by the main tenant. The second approach is to distribute the tenant resources under the main tenant to the subtenants, so that the subtenants have the right to access the main tenant. The resources are then distributed to users in the same way as the subtenant applications. In this approach, the access permissions of the main application are controlled by the subtenants themselves. The development permissions are allocated by the main tenant to the developers of the sub-tenants, and the application development permissions of the sub-tenants are only allocated to the developers under this tenant. The access permissions are that subtenant users can access applications under the main tenant, while applications under the subtenant can only be accessed by users of that tenant. The application publishing module is configured to publish the developed application.

4. An electronic device, characterized in that, It includes a memory and a processor, as well as computer instructions stored in the memory and running on the processor, which, when executed by the processor, perform the method according to any one of claims 1-2.

5. A computer-readable storage medium, characterized in that, Used to store computer instructions, which, when executed by a processor, perform the method described in any one of claims 1-2.

Images