A Data Isolation Method for Distributed Microservice Platforms

Abstract

This invention provides a data isolation method for a distributed microservice platform, belonging to the field of service software technology. By automatically parsing the identifier in user requests and placing it into remote service call requests, tenant identifier data is implicitly passed. Other module services automatically parse and obtain the identifier data through a user tenant identifier parsing tool and place it into database operation statements, thereby achieving tenant data isolation. This shields business processes from the perception of tenants, allowing business developers to focus only on business logic without needing to worry about tenant data isolation.

Description

Technical Field

[0001] This invention relates to a data isolation method for a distributed microservice platform, belonging to the field of service software technology. Background Technology

[0002] Microservices are currently a trend in service software development, with more and more service vendors choosing microservice architectures to build application services. Cloud services are also a major trend; to better utilize server resources and build general-purpose service platforms, serving customers from different companies simultaneously with minimal cost is a popular solution. Cloud platform solutions require user data isolation to avoid interference between user data, and microservice programs increase the difficulty of data isolation. Currently, there are three main data isolation solutions:

[0003] Database isolation; one database per database.

[0004] Relationship table isolation: each is a separate table.

[0005] Intra-table field isolation: All data is in the same business table and is isolated by an identifier field.

[0006] Each of the three solutions has its own advantages and disadvantages: database isolation has high space overhead, low isolation difficulty, and moderate maintenance difficulty; relational table isolation has moderate space overhead and moderate isolation difficulty, but high maintenance difficulty; and field isolation within a table has low space overhead, high isolation difficulty, and low maintenance difficulty.

[0007] Currently, there is a need for a method that retains the advantages of space overhead while reducing the difficulty of isolation, achieving cross-module and cross-service user data isolation with relatively low overhead, and supporting data isolation for a large number of users. Summary of the Invention

[0008] The purpose of this invention is to provide a data isolation method for a distributed microservice platform. This solution is based on the third in-table field isolation scheme to isolate data, which reduces the difficulty of isolation while retaining the advantages of space overhead.

[0009] To achieve the above objectives, the present invention employs the following technical solution:

[0010] Step 1: Data isolation settings. Data is isolated based on the data in a single relational table. All data is stored in a unified relational table and isolated by the set fields.

[0011] Step 2: Parse the user request data, extract the user identifier from the token carried in the user request through the filter, and place the obtained tenant value into the thread context;

[0012] Step 3: Business process processing. Determine whether data isolation is required. If isolation is required, the identification data is automatically injected into the call parameters through the remote call module, and then the identification data is obtained through the data processing module and injected into the data operation statement. If isolation is not required, the identification data is directly obtained through the data processing module and injected into the data operation statement.

[0013] Step 4: Isolate the processed data and return the results.

[0014] Preferably, the specific method for remotely invoking other modules is as follows:

[0015] First, retrieve the identifier data from the program context, then set it into the implicit parameter, and finally call other module services.

[0016] Preferably, the implicit parameter is an additional parameter that carries parameters compared to the explicit parameters declared in a normal method function call, used for remote calls.

[0017] Preferably, after the business process is completed, data that needs to be isolated can be automatically injected with identification data into the call parameters through the remote call module, and can also be processed by calling other module services; data that does not need to be isolated can also be processed directly by calling other module services.

[0018] Preferably, the other modules are as follows:

[0019] Remote call module to obtain identification data;

[0020] The business process is handled by the data processing module, which obtains the identification data and injects it into the data operation statement.

[0021] The processed data is isolated, and the results are returned.

[0022] Preferably, when other modules are remotely invoked, they automatically obtain identification data from implicit parameters and place it in the context.

[0023] Preferably, the specific method of data isolation is as follows:

[0024] Based on the data operation instructions generated according to the business processing flow, the plugin obtains the identifier from the context and injects the identifier data into the operation instructions to limit the data within the scope of the instruction operation. The instructions are then sent to the database for processing to isolate the data.

[0025] The advantages of this invention are as follows: This solution isolates data based on the third in-table field isolation scheme. While retaining the advantages of space overhead, it reduces the difficulty of isolation, achieves cross-module and cross-service user data isolation, and can support data isolation for a large number of users. Data is stored in the same database table, eliminating the need to create additional databases and tables. It can support a large number of users and reduce disk space overhead. At the same time, it can automatically parse, transmit, and use identifiers for data isolation, data operations, and data queries, decoupling data isolation from business processes. Business developers only need to focus on business processes and do not need to worry about user data isolation. Attached Figure Description

[0026] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used together with the embodiments of the invention to explain the invention and do not constitute a limitation thereof.

[0027] Figure 1 This is a schematic diagram of the process structure of the present invention.

[0028] Figure 2 This is a schematic diagram of the cross-module calling scenario of the present invention. Detailed Implementation

[0029] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0030] Example 1

[0031] A data isolation method for a distributed microservice platform. This method passes tenant identification information through implicit parameters. The receiver automatically parses and injects this information into data operation statements using a parsing tool, thereby achieving user data isolation in a distributed microservice and decoupling data isolation operations from business processes, simplifying development.

[0032] Step 1: Data isolation settings. Data is isolated based on the data in individual relational tables, storing all data in a unified relational table and isolating it through a defined field; the defined field is "tenant," as detailed below:

[0033] Tenant A query / delete / update data where data.tenant = 'tenantA'

[0034] Step 2: Parse the user request data. Using a filter, extract the user identifier from the token carried in the user request and place the obtained tenant value into the thread context. An example of the token is as follows:

[0035] token:

[0036] eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsInRlbmFudCI6InRlbmFudEEifQ.eyJzdWIiOiIxMjM0NTY3ODkwIiw ibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.isHol-0ltyMTloclT-HOWCSJv81hKEhmgZaqyrAG7po

[0037] After analysis:

[0038] {

[0039] "alg": "HS256",

[0040] "typ": "JWT",

[0041] "tenant": "tenantA"

[0042] }

[0043] Step 3: Business process processing. Determine whether data isolation is required. If isolation is required, remotely call other modules to automatically inject the identification data into the call parameters, and then obtain the identification data through the data processing module and inject it into the data operation statement. If isolation is not required, directly obtain the identification data through the data processing module and inject it into the data operation statement.

[0044] The specific method by which the remote call module calls other modules is as follows:

[0045] First, retrieve the identifier data from the program context, then set it into the implicit parameter, and finally call other module services.

[0046] The implicit parameters are the additional parameters that are explicitly declared in a normal method function call, used to carry extra parameters during remote calls. When other modules are remotely called, they automatically retrieve the identification data from the implicit parameters and place it in the context.

[0047] Step 4: Isolate the processed data and return the results.

[0048] The specific methods for data isolation are as follows:

[0049] Based on the data operation instructions generated from the business processing flow, a plugin retrieves an identifier from the context and injects this identifier data into the operation instructions. This limits the data to be operated on by the instructions, and the instructions are then sent to the database for processing to achieve data isolation. An example of a data isolation instruction is as follows:

[0050] query / update / delete data where data.tenant = 'tenantA';

[0051] Example 2

[0052] The specific steps for cross-module invocation of the next distributed microservice platform data isolation method are as follows:

[0053] Step 1: Data isolation settings. Data is isolated based on the data in a single relational table. All data is stored in a unified relational table and isolated by the set fields.

[0054] Step 2: Parse the user request data, extract the user identifier from the token carried in the user request through the filter, and place the obtained tenant value into the thread context;

[0055] Step 3: Business process processing. Determine whether data isolation is required. If isolation is required, automatically inject the identifier data into the call parameters through the remote call module, and process it by calling other module services. If isolation is not required, process it directly by calling other module services.

[0056] The other modules are as follows:

[0057] Remote call module to obtain identification data;

[0058] The business process is handled by the data processing module, which obtains the identification data and injects it into the data operation statement.

[0059] The processed data is isolated, and the results are returned.

[0060] Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A data isolation method for a distributed microservice platform, characterized in that, Includes the following steps: Step 1: Data isolation settings. Data is isolated based on the data in a single relational table. All data is stored in a unified relational table and isolated by the set fields. Step 2: Parse the user request data, extract the user identifier from the token carried in the user request through the filter, and place the obtained tenant value into the thread context; Step 3: Business process processing. Determine whether data isolation is required. If isolation is required, automatically inject the identification data into the call parameters through the remote call module, and then obtain the identification data through the data processing module and inject it into the data operation statement. If isolation is not required, the identification data can be directly obtained through the data processing module and injected into the data operation statement; Step 4: Isolate the processed data and return the results.

2. The data isolation method for a distributed microservice platform according to claim 1, characterized in that, After the business process is completed, data that needs to be isolated is automatically injected with identification data into the call parameters through the remote call module, and then processed by calling other module services; data that does not need to be isolated is processed directly by calling other module services.

3. The data isolation method for a distributed microservice platform according to claim 2, characterized in that, The specific method by which the remote call module calls other modules is as follows: First, retrieve the identifier data from the program context, then set it into the implicit parameter, and finally call other module services.

4. The data isolation method for a distributed microservice platform according to claim 3, characterized in that, The implicit parameters are the additional parameters that are declared in a normal method function call, and are used to carry parameters when making a remote call.

5. The data isolation method for a distributed microservice platform according to claim 4, characterized in that, The other modules are as follows: Remote call module to obtain identification data; The business process is handled by the data processing module, which obtains the identification data and injects it into the data operation statement. The processed data is isolated, and the results are returned.

6. The data isolation method for a distributed microservice platform according to claim 4, characterized in that, When other modules are remotely invoked, they automatically retrieve the identification data from the implicit parameters and place it in the context.

7. The data isolation method for a distributed microservice platform according to claim 1, characterized in that, The specific methods for data isolation are as follows: Based on the data operation instructions generated according to the business processing flow, the plugin obtains the identifier from the context and injects the identifier data into the operation instructions to limit the data within the scope of the instruction operation. The instructions are then sent to the database for processing to isolate the data.

8. A data isolation device for a distributed microservice platform, comprising a processor and a memory storing program instructions, characterized in that, The processor is configured to execute the distributed microservice platform data isolation method as described in any one of claims 1 to 5 when running the program instructions.

9. A data isolation device for a distributed microservice platform, characterized in that, include: Product itself; The distributed microservice platform data isolation device as described in claim 8 is installed on the product body.

10. A storage medium storing program instructions, characterized in that, When the program instructions are executed, they perform the distributed microservice platform data isolation method as described in any one of claims 1 to 5.

Images