A user-based service isolation method, apparatus, device and medium

Abstract

This disclosure provides a user-based service isolation method, apparatus, device, and medium. One specific implementation of the method includes: in response to a target user's login, constructing a user object corresponding to the target user, constructing a service container, binding the user object to the service container, and creating a service instance corresponding to the target user within the service container; in response to a target user's logout, destroying the user object and the service container. This method can solve the functional failure problem caused by untimely user switching.

Description

Technical Field

[0001] This disclosure relates to the field of computer services and container technology, and in particular to a user-based service isolation method, apparatus, device, and medium. Background Technology

[0002] Currently, applications often need to switch between different user accounts and process user data based on the current user. However, due to reasons such as concurrent and asynchronous execution of application code, when an application switches from an old user to a new user, it is prone to problems such as the old user not being switched in time or the parallel code based on the old user not having finished executing, resulting in the processing of incorrect user data and thus causing functional failures. Summary of the Invention

[0003] This disclosure describes a user-based service isolation method, apparatus, device, and medium.

[0004] According to the first aspect, a user-based service isolation method is provided, comprising: in response to the login of a target user, constructing a user object corresponding to the target user, and constructing a service container, binding the user object to the service container, and creating a service instance corresponding to the target user in the service container; in response to the logout of the target user, destroying the user object and the service container.

[0005] According to a second aspect, a user-based service isolation device is provided, the device comprising: a first response unit configured to, in response to a target user's login, construct a user object corresponding to the target user, construct a service container, bind the user object to the service container, and create a service instance corresponding to the target user in the service container; and a second response unit configured to, in response to a target user's logout, destroy the user object and the service container.

[0006] According to a third aspect, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed in a computer, causes the computer to perform the method described in the first aspect.

[0007] According to a fourth aspect, an electronic device is provided, including a memory and a processor, wherein the memory stores executable code, and the processor executes the executable code to implement the method described in the first aspect.

[0008] This disclosure provides a user-based service isolation method, apparatus, device, and medium. First, in response to a target user's login, a user object corresponding to the target user is constructed, and a service container is constructed. The user object is bound to the service container, and a service instance corresponding to the target user is created within the service container. Then, in response to a target user's logout, the user object and its service container are destroyed. Using any one of the above-described methods, apparatus, storage media, and electronic devices, functional failures caused by untimely user switching can be resolved. Attached Figure Description

[0009] Figure 1 This diagram illustrates a problem with the user switching functionality in a timely manner.

[0010] Figure 2 A flowchart illustrating a user-based service isolation method according to an embodiment of the present disclosure is shown;

[0011] Figure 3 A schematic diagram illustrating the creation and destruction of user containers according to an embodiment of this disclosure;

[0012] Figure 4 This illustration shows a diagram of sending a user identifier to a global service instance in another embodiment of this disclosure;

[0013] Figure 5 A schematic block diagram of a user-based service isolation device according to an embodiment of the present disclosure is shown;

[0014] Figure 6 A schematic diagram of the structure of an electronic device suitable for implementing embodiments of the present disclosure is shown;

[0015] Figure 7 A schematic diagram of the structure of a storage medium suitable for implementing embodiments of the present disclosure is shown. Detailed Implementation

[0016] The technical solutions provided in this specification will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the relevant invention and not intended to limit the invention. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other.

[0017] In the description of the implementations disclosed herein, the term "comprising" and similar terms should be understood as open inclusion, i.e., "including but not limited to". The term "based on" should be understood as "at least partially based on". The term "one / an implementation" or "the implementation" should be understood as "at least one / an implementation". The term "some implementations" should be understood as "at least some implementations". Other explicit and implicit definitions may also be included below.

[0018] As mentioned earlier, applications often need to switch between different user accounts and process user data based on the current user. However, this approach has the following problems: when switching from an old user to a new user, the application may process incorrect user data because the old user's data was not switched in time. Alternatively, the application may malfunction due to reasons such as the parallel code based on the old user not having finished executing. These problems can be collectively referred to as the user switching delay problem.

[0019] The aforementioned problem arises because the service instances typically used for user data processing, such as reading user data or executing user business logic, are global instances. A global instance here refers to a service instance that can exist throughout the entire application's lifecycle. These global instances usually determine which specific user's data to operate on based on, depending on the variable settings of the current user. However, the settings for the current user and the data processing performed on that user within the global instance are often delayed or parallel. Consequently, even when the actual user has switched, the settings for the current user and the data processing performed on that user, or some data processing, within the global instance may still be based on the user before the switch, leading to functional malfunctions (such as incorrect data display or incorrect data processing results). Figure 1 This diagram illustrates a problem related to users switching between features in a timely manner. For example... Figure 1 As shown in (a), for example, after switching from user A to user B, the user interface should display user B's data. However, because the current user settings in the global service instance are not updated in a timely manner, for example, the current user may still be user A for a period of time, and thus the user interface may still display user A's data or part of the data for that period of time. Figure 1 As shown in (b), for example, after switching user A to user B, the business process should be processed based on user B's data. However, due to the current user settings not being updated in a timely manner in the global service instance or the business process itself being executed asynchronously, the business process will still be processed based on user A's data for a period of time.

[0020] To address the aforementioned technical problems, this disclosure provides a user-based service isolation method. In one embodiment, upon user login, a user object and a service container are constructed, and the user object is bound to the service container. Then, a service instance corresponding to the user is created within the service container, allowing the service instance to process the user's data. Upon user logout, the user object, service container, and service instance corresponding to the target user are destroyed. The advantage of this method is that, on the one hand, by using user objects, service containers, and service instances corresponding to each user, the data processing for each user is isolated, rather than executing the data processing for all users through a single global instance. This fundamentally eliminates the problem of incorrect user data processing due to delayed user switching caused by the reliance of a single global instance on the current user's settings in existing solutions. On the other hand, because the global service instance in existing solutions depends on the current user and cannot distinguish between different users, it is difficult to meet the requirement of simultaneous login for multiple users. Through the method in subsequent embodiments, service instances can be created separately for multiple users, and these service instances can be isolated through multiple containers, thereby supporting simultaneous login for multiple users and ensuring that the service instances corresponding to each user do not mistakenly process the data of other users.

[0021] The following describes the detailed process of this method.

[0022] Figure 2 A flowchart illustrating a user-based service isolation method according to an embodiment of this disclosure is shown. Figure 3 As shown, the method includes at least the following steps:

[0023] Step S201: In response to the login of the target user, construct a user object corresponding to the target user and construct a service container, bind the user object to the service container, and create a service instance corresponding to the target user in the service container;

[0024] Step S203: In response to the logout of the target user, destroy the user object and the service container.

[0025] First, in step S201, in response to the login of the target user, a user object corresponding to the target user can be constructed, and a service container can be constructed. The user object is bound to the service container, and a service instance corresponding to the target user is created in the service container. In different embodiments, the target user can be different specific users, and this description does not limit this. A user object refers to a program object (Object) corresponding to the target user. A user object can encapsulate the user's data into a whole. Conventionally, a program object can include attribute data or functions. In different embodiments, the attribute data of the user object can include different specific data of the target user. In one embodiment, the attribute data of the user object can at least include the target user's user identifier, or user ID.

[0026] Container technology is a sandboxing technology that creates an isolated environment by running programs within containers. Different specific container technologies can be used in different implementations, and this specification does not limit this. A service can be a program running in the system. A service container is a container in which service instances can run. By constructing a user object and a service container corresponding to the target user, and binding the user object to the service container, a service container for the target user is actually created. Creating a service instance within this service container isolates the created service instance for the target user within that service container. This allows the service instance to process only the target user's data and business logic, preventing service instances outside the container from processing the target user's data and business logic. Figure 3 This diagram illustrates the creation and destruction of user containers according to embodiments of this disclosure. Figure 3 In one embodiment, for example, when user A logs in, a user object a and a user container 1 corresponding to user A can be created, and user object a can be bound to user container 1. Then, user container 1 is established on service instance 1 for data processing corresponding to user A.

[0027] In different embodiments, the created service instance can be used to perform different data processing procedures, such as performing business logic processing based on user data or displaying a user interface; this specification does not limit this. The specific functional components included in the service instance can also differ in different embodiments. For example, in one embodiment, the service instance may include a user interface component for displaying, for example, user data. In another embodiment, the service instance may include a service logic component for performing business logic processing corresponding to the user. In yet another embodiment, the service instance may include both a user interface component and a service logic component.

[0028] Then, in step S203, in response to the target user logging out, the user object and the service container are destroyed.

[0029] In this step, when the target user logs out, the user object corresponding to the target user and the user container bound to that user object can be destroyed. In one embodiment, in response to the destruction of the service container, the service instance in the service container, i.e., the service instance corresponding to the target user, can also be released. Figure 3 As shown, for example, when user A logs out, the user object a corresponding to user A and user container 1 can be destroyed, and service instance 1 in user container 1 can be released.

[0030] By creating and destroying service containers corresponding to users (e.g., target users) upon login and logout, a service container corresponding to the user's lifecycle, or simply a user container, is actually constructed. Since the user container is bound to an immutable user object, and the lifecycle of the user container is consistent with the creation and destruction lifecycle of the bound user object, the service instances created in the user container are essentially service instances for the same user. This ensures that service instances in the user container will not access or process data of other users. This fundamentally eliminates the problem of incorrect user data manipulation by a single global instance when switching users, a problem inherent in existing solutions. Furthermore, in different embodiments, multiple service instances can be created in the user container, each used for different data processing for the target user. Since they are all service instances for the same user, these service instances can call each other without the problem of incorrect user data manipulation.

[0031] In some scenarios, applications may also contain user-related global service instances. As mentioned earlier, global service instances often process user data based on their corresponding current user. To prevent user data processing errors caused by delayed switching of the current user within a global service instance, in one embodiment, after the target user logs in, if the target interface of a pre-running global service instance is called, the target user's user identifier is passed to the target interface. The target interface can determine whether the current user corresponding to the global service instance is correct based on the user identifier of the current user corresponding to the global service instance and the user identifier of the target user. In one specific embodiment, if the user identifier of the current user corresponding to the global service instance is different from the user identifier of the target user, the current user is determined to be incorrect; if the user identifier of the current user corresponding to the global service instance is the same as the user identifier of the target user, the current user is determined to be correct. In another specific embodiment, the target interface can perform corresponding error handling, for example, by displaying an error message indicating that the current user is incorrect. The target interface of the global service instance is the application programming interface of the global service instance. An Application Programming Interface (API) can be a predefined function within a global service instance. Calling the API allows access to the business functions provided by the global service instance. In different specific embodiments, the specific API provided by the global service instance may differ and can be used to provide different specific business functions; this specification does not impose any limitations on this.

[0032] Figure 4 This illustration shows a diagram of sending a user identifier to a global service instance in another embodiment of this disclosure. For example... Figure 4 In the illustrated embodiment, for example, after user A logs in, when the application programming interface (API) of the global instance is called, user A's ID can be sent to the called API. The called API can then determine whether the ID of the current user of the global service instance is the same as user A's ID. If the result is the same, it means the current user of the global service instance is correct, and the global service instance can continue to operate normally without additional processing. If the result is different, it means the current user of the global service instance is incorrect, and an error message such as "current user incorrect" can be thrown.

[0033] In some scenarios, software vendors also want applications to have the ability to allow multiple users to log in simultaneously. As mentioned earlier, existing user data processing often relies on the current user and cannot distinguish between different users, making it difficult to achieve simultaneous login for multiple users. To enable simultaneous login for multiple users, in one embodiment, multiple objects corresponding to each user can be constructed, as well as multiple containers. The multiple objects are bound to the multiple containers, and service instances corresponding to each user are created in the multiple containers. In this way, multiple logged-in users can each have a corresponding service instance, and the service instances of different users run in different user containers. This not only supports multiple user logins but also isolates the service instances used for user data processing for different users, preventing the problem of different user service instances accidentally manipulating the user data of other users.

[0034] Figure 5 A schematic block diagram of a user-based service isolation apparatus according to an embodiment of the present disclosure is shown. The apparatus is used to perform, for example... Figure 3 The method shown is as follows: Figure 5 As shown, the device 500 includes:

[0035] The first response unit 501 is configured to, in response to the login of a target user, construct a user object corresponding to the target user, construct a service container, bind the user object to the service container, and create a service instance corresponding to the target user in the service container;

[0036] The second response unit 502 is configured to destroy the user object and the service container in response to the logout of the target user.

[0037] This disclosure also provides an electronic device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, it implements, as described above. Figure 2 The method shown.

[0038] The following can also be referenced Figure 6 It shows a structural schematic diagram of an electronic device 800 suitable for implementing embodiments of the present application. Figure 6 The electronic device 600 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0039] like Figure 6As shown, electronic device 600 may include a processing device (e.g., a central processing unit, graphics processing unit, etc.) 601. The aforementioned processing device 601 may be a general-purpose processor, a digital signal processor (DSP), a microprocessor, or a microcontroller, and may further include an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can perform various appropriate actions and processes based on a program stored in read-only memory (ROM) 602 or a program loaded from storage device 608 into random access memory (RAM) 603. RAM 603 also stores various programs and data required for the operation of electronic device 600. Processing device 601, ROM 602, and RAM 603 are interconnected via bus 604. Input / output (I / O) interface 605 is also connected to bus 604.

[0040] Typically, the following devices can be connected to I / O interface 605: input devices 606 including, for example, touchscreens, touchpads, keyboards, mice, etc.; output devices 607 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 608 including, for example, magnetic tapes, hard disks, etc.; and communication devices 606. Communication device 609 allows electronic device 600 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 7 An electronic device 600 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively. Figure 6 Each box shown can represent a device or multiple devices as needed.

[0041] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, it performs the functions defined in the user-based service isolation method provided in embodiments of this application.

[0042] This disclosure also provides a computer-readable storage medium storing a computer program thereon, which, when executed in a computer, causes the computer to perform the functions provided in the embodiments of this application. Figure 2 The user-based service isolation method shown. Figure 7 This is a schematic diagram illustrating a storage medium for implementing an embodiment of this application. For example, such as... Figure 7 As shown, the storage medium 700 can be a non-transitory computer-readable storage medium used to store non-transitory computer-executable instructions 701. When the non-transitory computer-executable instructions 701 are executed by a processor, the user-based service isolation method provided in the embodiments of this application can be implemented. For example, when the non-transitory computer-executable instructions 701 are executed by a processor, one or more steps in the user-based service isolation method provided in the embodiments of this application can be performed. For example, the storage medium 700 can be applied in the above-mentioned electronic device. For example, the storage medium 700 can include the memory in the electronic device. The description of the storage medium 700 can be found in the description of the memory in the embodiments of the electronic device, and will not be repeated here. The specific functions and technical effects of the storage medium 700 can be found in the description of the user-based service isolation method provided in the embodiments of this application, and will not be repeated here.

[0043] It should be noted that the computer-readable medium described in the embodiments of this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a memory card of a smartphone, a storage component of a tablet computer, a portable computer disk, a hard disk of a personal computer, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In the embodiments of this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In the embodiments of this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. The transmitted data signal can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (Radio Frequency), etc., or any suitable combination thereof.

[0044] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device. The aforementioned computer-readable medium carries one or more programs, which, when executed by the server, cause the electronic device to implement the user-based service isolation method provided in the embodiments of this application.

[0045] Computer program code for performing the operations of embodiments of this disclosure can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0046] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions. The units described in the embodiments of the present disclosure may be implemented in software or hardware. The names of the units do not necessarily constitute a limitation on the unit itself. The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), Systems-on-Chip (SOCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0047] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments for storage media and computing devices are basically similar to the method embodiments, so they are described more simply; relevant parts can be referred to the descriptions of the method embodiments.

[0048] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above-described features with (but not limited to) technical features with similar functions disclosed in this disclosure. Furthermore, although the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in sequential order. In certain environments, multitasking and parallel processing may be advantageous. Similarly, although several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this disclosure. Certain features described in the context of a single embodiment may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0049] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative examples of implementing the claims. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made based on the technical solutions of the present invention should be included within the scope of protection of the present invention.

Claims

1. A user-based service isolation method, comprising: In response to the login of a target user, a user object corresponding to the target user is constructed. The attribute data of the user object includes at least the user identifier of the target user. A service container is constructed, the user object is bound to the service container, and a service instance corresponding to the target user is created in the service container. After the target user logs in, if the target interface of a pre-running global service instance is called, the user identifier of the target user is passed to the target interface. The target interface determines whether the current user corresponding to the global service instance is correct based on the user identifier of the current user corresponding to the global service instance and the user identifier of the target user; In response to the target user logging out, the user object and the service container are destroyed.

2. The method according to claim 1, wherein, The service instance includes: user interface components and / or service logic components.

3. The method according to claim 1, further comprising: In response to the destruction of the service container, the service instance corresponding to the target user is released.

4. The method according to claim 1, wherein, The global service instance determines whether the current user corresponding to the global service instance is correct based on the user identifier of the current user corresponding to the global service instance and the user identifier of the target user, including: If the user identifier of the current user corresponding to the global service instance is different from the user identifier of the target user, then the current user is determined to be incorrect. If the user identifier of the current user corresponding to the global service instance is the same as the user identifier of the target user, then the current user is determined to be correct.

5. The method according to claim 1, further comprising: After determining that the current user is incorrect, the target interface throws a message indicating that the current user is incorrect.

6. The method according to claim 1, further comprising: Construct multiple objects corresponding to multiple users, and construct multiple containers, bind the multiple objects to the multiple containers, and create service instances corresponding to the multiple users in the multiple containers.

7. A user-based service isolation device, the device comprising: The first response unit is configured to, in response to the login of a target user, construct a user object corresponding to the target user, wherein the attribute data of the user object includes at least the user identifier of the target user, construct a service container, bind the user object to the service container, and create a service instance corresponding to the target user in the service container; The first response unit is further configured to, after the target user logs in, if the target interface of a pre-running global service instance is called, pass the user identifier of the target user to the target interface; The target interface determines whether the current user corresponding to the global service instance is correct based on the user identifier of the current user corresponding to the global service instance and the user identifier of the target user; The second response unit is configured to destroy the user object and the service container in response to the logout of the target user.

8. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method of any one of claims 1-6.

9. An electronic device comprising a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of any one of claims 1-6.

Images