Method, device, electronic device and storage medium for data access

Abstract

The application relates to the computer technical field, and particularly provides a data access method and device, electronic equipment and a storage medium. The data access method comprises the following steps: when an access request sent by a search engine client is received, determining a target search engine tenant corresponding to the access request; determining a target logical subspace allocated for the target search engine tenant from a plurality of logical subspaces of a search engine; each logical subspace is obtained by dividing a logical space of the search engine; redirecting the access request according to the target logical subspace to obtain a redirection request; performing an access request operation in the target logical subspace according to the redirection request to obtain access response information; and returning the access response information to the search engine client. In this way, the resources consumed by data access isolation are reduced.

Description

Technical Field

[0001] This application relates to the field of computer technology, and more specifically to a method, apparatus, electronic device, and storage medium for data access. Background Technology

[0002] With the development of Internet technology, search engines (such as Elastic Search and OpenSearch) are being used more and more widely, and users' demands for search engines are also increasing.

[0003] In the current technology, to meet the data access isolation requirements of different search engine tenants, separate search engine clusters are typically established for each search engine tenant, and corresponding supporting facilities are configured. The search engine cluster is a cluster used to provide search engine services.

[0004] However, the search engine clusters and supporting facilities built in this way are usually excessively redundant, which leads to a waste of a lot of resources. Summary of the Invention

[0005] The purpose of this application is to provide a data access method, apparatus, electronic device, and storage medium to reduce the resources consumed by data access isolation.

[0006] On one hand, embodiments of this application provide a data access method, the method comprising:

[0007] Upon receiving an access request from a search engine client, the target search engine tenant corresponding to the access request is determined; the target search engine tenant is one of the tenants registered in the search engine.

[0008] From the multiple logical subspaces of the search engine, the target logical subspace allocated to the target search engine tenant is determined; each logical subspace is obtained by dividing the logical space of the search engine.

[0009] Based on the target logical subspace, the access request is redirected to obtain the redirection request;

[0010] Based on the redirection request, perform the access request operation in the target logical subspace to obtain the access response information;

[0011] The access response information will be returned to the search engine client.

[0012] In one implementation, upon receiving an access request from a search engine client, determining the target search engine tenant corresponding to the access request includes:

[0013] Receive access requests sent by search engine clients;

[0014] Perform authentication on access requests;

[0015] If the identity authentication is successful, the target search engine tenant corresponding to the access request is obtained.

[0016] In one implementation, before performing an access request operation in the target logical subspace according to the redirection request and obtaining access response information, the method further includes:

[0017] Authentication is performed based on the redirection request;

[0018] If authentication fails, it is determined that the user does not have permission to access the target logical subspace.

[0019] In one implementation, before performing an access request operation in the target logical subspace according to the redirection request and obtaining access response information, the method further includes:

[0020] If it is determined that the resource requested by the redirection request does not belong to the target logical subspace, then the user is not allowed to access the target logical subspace.

[0021] In one implementation, the access request is redirected according to the target logical subspace to obtain a redirection request, including:

[0022] Retrieves a field of a specified type contained in the access request;

[0023] Based on the target logical subspace, the specified type fields are adjusted to generate a redirection request; the specified type fields are used to create the corresponding target operation object in the target logical subspace.

[0024] In one implementation, based on a redirection request, an access request operation is performed in the target logical subspace to obtain access response information, including:

[0025] Based on the redirection request, the target operation object in the target logical subspace is created using the data node corresponding to the target logical subspace; the data node is a process bound to storage resources.

[0026] Invoke the target operation object, execute the access request operation, and obtain the access response information.

[0027] In one implementation, before determining the target logical subspace allocated to the target search engine tenant from multiple logical subspaces of the search engine, the method further includes:

[0028] The logical space is logically divided to obtain multiple logical subspaces;

[0029] Allocate different logical subspaces to different search engine tenants;

[0030] Different node sets are allocated for the logical subspaces of different search engine tenants; each node set contains at least one data node.

[0031] In one implementation, it is applied to a container operation and maintenance platform; the container operation and maintenance platform contains multiple data workloads; each data workload contains at least one container; different data nodes are configured in different containers.

[0032] On one hand, embodiments of this application provide a data access apparatus, including:

[0033] The receiving unit is used to determine the target search engine tenant corresponding to the access request when it receives an access request sent by the search engine client; the target search engine tenant is one of the tenants registered in the search engine.

[0034] The determining unit is used to determine the target logical subspace allocated to the target search engine tenant from multiple logical subspaces of the search engine; each logical subspace is obtained by dividing the logical space of the search engine.

[0035] The acquisition unit is used to redirect the access request based on the target logical subspace and obtain the redirection request;

[0036] The execution unit is used to perform the access request operation in the target logical subspace according to the redirection request and obtain the access response information;

[0037] The return unit is used to send the access response information back to the search engine client.

[0038] Upon receiving an access request from a search engine client, the target search engine tenant corresponding to the access request is determined; the target search engine tenant is one of the tenants registered in the search engine.

[0039] In one embodiment, the receiving unit is used to:

[0040] Receive access requests sent by search engine clients;

[0041] Perform authentication on access requests;

[0042] If the identity authentication is successful, the target search engine tenant corresponding to the access request is obtained.

[0043] In one embodiment, the execution unit is further configured to:

[0044] Authentication is performed based on the redirection request;

[0045] If authentication fails, it is determined that the user does not have permission to access the target logical subspace.

[0046] In one embodiment, the execution unit is further configured to:

[0047] If it is determined that the resource requested by the redirection request does not belong to the target logical subspace, then the user is not allowed to access the target logical subspace.

[0048] In one embodiment, the obtaining unit is used to:

[0049] Retrieves a field of a specified type contained in the access request;

[0050] Based on the target logical subspace, the specified type fields are adjusted to generate a redirection request; the specified type fields are used to create the corresponding target operation object in the target logical subspace.

[0051] In one implementation, the execution unit is used to:

[0052] Based on the redirection request, the target operation object in the target logical subspace is created using the data node corresponding to the target logical subspace; the data node is a process bound to storage resources.

[0053] Invoke the target operation object, execute the access request operation, and obtain the access response information.

[0054] In one implementation, a reducing unit is determined:

[0055] The logical space is logically divided to obtain multiple logical subspaces;

[0056] Allocate different logical subspaces to different search engine tenants;

[0057] Different node sets are allocated for the logical subspaces of different search engine tenants; each node set contains at least one data node.

[0058] In one implementation, it is applied to a container operation and maintenance platform; the container operation and maintenance platform contains multiple data workloads; each data workload contains at least one container; different data nodes are configured in different containers.

[0059] On one hand, embodiments of this application provide an electronic device, including:

[0060] Processor; and

[0061] The memory stores computer instructions that cause the processor to perform steps of methods provided in various alternative implementations of any of the aforementioned data access methods.

[0062] On one hand, embodiments of this application provide a storage medium storing computer instructions for causing a computer to perform the steps of the methods provided in various alternative implementations of any of the above-described data access methods.

[0063] In the data access method, apparatus, electronic device, and storage medium provided in this application embodiment, upon receiving an access request sent by a search engine client, the target search engine tenant corresponding to the access request is determined; the target search engine tenant is one of the tenants registered in the search engine; a target logical subspace allocated to the target search engine tenant is determined from multiple logical subspaces of the search engine; each logical subspace is obtained by dividing the logical space of the search engine; the access request is redirected according to the target logical subspace to obtain a redirection request; the access request operation is executed in the target logical subspace according to the redirection request to obtain access response information; and the access response information is returned to the search engine client. In this way, the logical space of the search engine is divided into multiple logical subspaces, allowing different search engine tenants to access data through different logical subspaces, reducing the resources consumed by data access isolation. Attached Figure Description

[0064] To more clearly illustrate the technical solutions in the specific embodiments of this application or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0065] Figure 1 This is a flowchart of a logical subspace partitioning method in an embodiment of this application.

[0066] Figure 2 This is a schematic diagram of the architecture of a search engine cluster in an embodiment of this application.

[0067] Figure 3 This is a schematic diagram of the architecture of a container operation and maintenance platform according to an embodiment of this application.

[0068] Figure 4 This is a flowchart illustrating a data access method according to an embodiment of this application.

[0069] Figure 5 This is a schematic diagram of the architecture of a multi-tenant logical isolation access system in an embodiment of this application.

[0070] Figure 6 This is a structural block diagram of a data access device according to an embodiment of this application.

[0071] Figure 7 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0072] The technical solution of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application. Furthermore, the technical features involved in the different embodiments of this application described below can be combined with each other as long as they do not conflict with each other.

[0073] First, some of the terms used in the embodiments of this application will be explained to facilitate understanding by those skilled in the art.

[0074] Terminal devices can be mobile terminals, fixed terminals, or portable terminals, such as mobile phones, sites, units, devices, multimedia computers, multimedia tablets, internet data nodes, communicators, desktop computers, laptop computers, notebook computers, netbook computers, tablet computers, personal communication system devices, personal navigation devices, personal digital assistants, audio / video players, digital cameras / camcorders, positioning devices, television receivers, radio broadcast receivers, e-book devices, gaming devices, or any combination thereof, including accessories and peripherals of these devices, or any combination thereof. It is also foreseeable that terminal devices can support any type of user-facing interface (e.g., wearable devices).

[0075] Servers can be independent physical servers, server clusters or distributed systems composed of multiple physical servers, or cloud servers that provide basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, and big data and artificial intelligence container operation and maintenance platforms.

[0076] Elastic Search: A search engine based on the Lucene library. It provides a distributed, multi-tenant full-text search engine with a Hypertext Transfer Protocol (HTTP) World Wide Web interface and schema-less, lightweight data-interchange format (JavaScript Object Notation, JSON) documents.

[0077] OpenSearch: A search engine based on Lucene.

[0078] An index is a data organization method in Elastic Search / OpenSearch that defines the logical storage and field types of data; it is a collection of data with similar structures.

[0079] A single-tenant search engine refers to a software instance or computer system that has only one end user or user group. In this embodiment, the term "single-tenant search engine" can also be abbreviated as "single-tenant".

[0080] Search engine multi-tenancy refers to a software instance or computer system having multiple end users or user groups. In this embodiment, search engine multi-tenancy can also be simply referred to as multi-tenancy.

[0081] Multi-tenant isolation: Different user groups are isolated in terms of data, computing, storage, functionality, and performance, so that each search engine tenant is independent of each other in these dimensions and does not affect each other.

[0082] Container open source system (Kubernetes, k8s): is an open source system for automatically deploying, scaling and managing "containerized applications".

[0083] Cloud-native: A software approach for building, deploying, and managing modern applications in a cloud computing environment.

[0084] Workload: An application that runs on Kubernetes.

[0085] Kibana / Dashboard: These are data visualization dashboard software that can be used with ElasticSearch and OpenSearch, respectively.

[0086] The technical concept of this application will be explained below.

[0087] In practical applications of search engines, search engine tenants typically have requirements for data security and computational isolation. For example, a search engine tenant may want its accessible data to be visible only to itself and not to other search engine tenants. Another example is that a search engine tenant may want other search engine tenants' use of the search engine to not affect its own search performance. A single search engine tenant can contain multiple users.

[0088] Because search engines typically have a unique, globally defined namespace, this conflicts with user needs. Therefore, in traditional technology, to meet the data security and computational isolation requirements of different search engine tenants, separate search engine clusters are usually established for each tenant, with corresponding supporting facilities configured. A search engine cluster is a cluster used to provide search engine services.

[0089] However, the search engine clusters and supporting facilities established in this way are usually excessively redundant, and the operation and maintenance costs of each search engine cluster are also relatively high, which will result in a large waste of resources.

[0090] In view of the deficiencies of the above-mentioned related technologies, the embodiments of this application provide a data access method, apparatus, electronic device and storage medium, which aim to reduce the resources consumed by data access isolation.

[0091] This application provides a data access method that can be applied to electronic devices. This application does not limit the type of electronic device, which can be any suitable type of device, such as terminal devices and servers, etc. This application will not elaborate further.

[0092] In this embodiment of the application, when accessing data, the logical space of the search engine is first logically divided and hardware and software resources are configured to achieve logical isolation of different logical subspaces and isolation of computing and storage.

[0093] See Figure 1 The diagram shown is a flowchart of a logical subspace partitioning method in an embodiment of this application.

[0094] Step 100: Logically divide the logical space corresponding to the search engine to obtain multiple logical subspaces.

[0095] Considering that search engine clusters typically have only one shared namespace (i.e., logical space), and different users need to share the same global namespace, this application embodiment divides the logical space to obtain multiple logical subspaces.

[0096] In this way, the logical space can be logically divided into multiple subspaces (i.e., logical subspaces).

[0097] Step 101: Allocate different logical subspaces to different search engine tenants.

[0098] In one implementation, once a new search engine tenant is successfully registered, a corresponding logical subspace is allocated to that search engine tenant.

[0099] In this way, each search engine tenant can have its own dedicated logical subspace.

[0100] In this embodiment, after logically dividing the logical space and configuring the operation objects, logical isolation of the search engine is achieved, and each search engine tenant can only see its own content. However, this only guarantees that access requests from different logical subspaces will not logically affect each other; the computation and storage of different logical subspaces are still mixed together. Therefore, different logical subspaces may affect each other's performance.

[0101] Therefore, to achieve computational and storage isolation (i.e., physical isolation) between different logical subspaces, different node sets can be allocated to the logical subspaces of different search engine tenants. A correspondence between the search engine tenant, the logical subspace, and the node set is established.

[0102] The node set contains at least one data node. A data node is a process bound to storage resources; that is, different data nodes correspond to different computing and storage resources.

[0103] In one embodiment, the electronic device includes a coordination node and multiple data nodes.

[0104] The coordinating node is used to receive access requests, redirect access requests, obtain redirection requests, and send redirection requests to the data nodes corresponding to the target logical subspace.

[0105] Each data node is used to perform an access request operation in the target logical subspace based on the received redirection request, obtain access response information, and return the access response information to the search engine client.

[0106] As an example, electronic devices could be used to create a search engine cluster. See also Figure 2 The diagram shown is a schematic of the architecture of a search engine cluster. Figure 2 The system includes coordinator nodes and multiple data nodes, and may also include master nodes. The first data node is assigned to the shared search engine tenant. The second data node is assigned to search engine tenant C. The third data node is assigned to search engine tenant D.

[0107] The management node manages all other nodes. The coordinating node receives user access requests, preprocesses them, and distributes the processed requests to the appropriate data nodes. Preprocessing includes access request redirection, and may also include access request authentication, authorization, and determination of the existence of the accessed resource. Data nodes perform data computation and data storage operations based on redirected requests to achieve data computation and read / write operations.

[0108] If the search engine is Elastic Search, its shard allocation mechanism can force the data of a search engine tenant to be allocated to a dedicated set of nodes for that tenant. As an example, the `node.attr` property of the Elastic Search process can be used to assign an identifier of the node set it belongs to when a node starts, thus binding the node set to the search engine tenant.

[0109] Furthermore, to facilitate multi-tenant isolation and more conveniently create and manage search engine tenant resources, electronic devices can utilize a container operation and maintenance platform. A container operation and maintenance platform contains multiple data workloads; each data workload contains at least one container; different data nodes are configured in different containers. As an example, this container operation and maintenance platform can be Kubernetes (k8s).

[0110] A container operations platform can also include coordinating node workloads. Both coordinating node workloads and data workloads are built upon workloads. A workload is an application running on Kubernetes. A workload consists of one or more instances, an instance consists of one or more containers, and each container corresponds to a container image. A container is the runtime entity of an image. Containers can be created, started, stopped, deleted, paused, etc. The relationship between images and containers is similar to that between classes and instances in object-oriented programming.

[0111] See Figure 3 The diagram shown is an architectural schematic of a container operation and maintenance platform. Figure 3 This includes: the All Coordinatornode LoadBalancer Service, the All Coordinatornode Workload, the data workload, the Masterheadliess Service, and the Master workload. The container operations platform can also include a dedicated Coordinatornode Workload and a dedicated Coordinatornode LoadBalancer Service for the data workload of a specific search engine tenant.

[0112] The All Coordinatornode LoadBalancer Service is used for communication with external systems. The Master Headlies Service is used for communication between the Master workload and other workloads. Data workloads act as data nodes, used for data computation and storage; the Master workload acts as a management node, used to manage the data nodes within each data workload.

[0113] In this embodiment, leveraging the cloud-native capabilities of Kubernetes (k8s), several data workloads can be rapidly launched horizontally. The specifications and locations of these data workloads can be customized according to the specific application scenario. Furthermore, custom parameters can be passed through Kubernetes, allowing the allocation of data nodes via the Master workload. Moreover, operations and maintenance are performed at the workload level, deploying data workloads and Coordinator workloads using workloads, which simplifies operation and management. Additionally, Kubernetes' tag selector allows the allocation of dedicated Coordinatornode workloads to search engine tenants, further strengthening the physical isolation of logical subspaces between different search engine tenants.

[0114] See Figure 4 The diagram shown is a flowchart of a data access method according to an embodiment of this application. The following is a description of the method in conjunction with... Figure 4 The method is described below, and the specific implementation process is as follows:

[0115] Step 400: Upon receiving an access request from the search engine client, determine the target search engine tenant corresponding to the access request.

[0116] The target search engine tenant is one of the various search engine tenants registered in the search engine.

[0117] Furthermore, access requests can be authenticated to ensure security.

[0118] In one implementation, an access request sent by a search engine client is received; the access request is authenticated; if authentication is successful, the target search engine tenant corresponding to the access request is obtained. If authentication fails, the access request process is stopped, and an access request failure response is returned.

[0119] As an example, the authentication information in the access request is retrieved. If the authentication information matches the authentication information stored locally, then the authentication is considered successful.

[0120] This allows us to identify the target search engine tenant that issued the access request.

[0121] Step 401: Determine the target logical subspace allocated to the target search engine tenant from the multiple logical subspaces of the search engine.

[0122] Each logical subspace is obtained by dividing the logical space of the search engine.

[0123] In one implementation, the target logical subspace corresponding to the target search engine tenant is obtained based on the correspondence between the search engine tenant and the logical subspace.

[0124] Step 402: Redirect the access request according to the target logical subspace to obtain the redirection request.

[0125] In one implementation, the access request is redirected based on the data node corresponding to the target logical subspace to obtain a redirection request.

[0126] In this context, the data nodes corresponding to the target logical subspace are the nodes of the node set corresponding to the target logical subspace.

[0127] In one implementation, step 402 may include:

[0128] S4021: Retrieves a field of a specified type contained in the access request.

[0129] Optionally, the specified type field can be a field used to indicate the target operation object, or it can be identification information used to represent the target operation object, such as the name of the target operation object.

[0130] The objects of operation include data and internal entities. An internal entity is essentially a variable. Optionally, an internal entity may include at least one of the following: index, alias, pipeline pattern, template, setting, and mapping.

[0131] S4022: Adjust the specified type field according to the target logical subspace to generate a redirection request; the specified type field is used to create the corresponding target operation object in the target logical subspace.

[0132] In one implementation, a rewriter renames a specified type field in the access request according to the renaming rules and the target logical subspace to obtain a redirection request.

[0133] As an example, if the target logical subspace is space A, and the target operation object corresponding to the specified type field is index, then index can be renamed to A.index.

[0134] Optionally, the modifier can be an index data manipulation language (DML) modifier, an index definition language (DDL) modifier, a settings modifier, or a search query modifier, etc.

[0135] The index DML rewriter is used to update index DML fields. The index DDL rewriter is used to update index DDL fields. The settings rewriter is used to update settings fields, and the search query rewriter is used to update search query fields. In practice, the rewriters can be configured according to the specific application scenario, and there are no restrictions here.

[0136] Since the logical space of a search engine has the characteristic of global naming, in this embodiment of the application, different logical subspaces and their corresponding operation objects are distinguished by naming.

[0137] In one implementation, different logical subspaces and their corresponding operation objects are renamed by using different prefixes or suffixes.

[0138] In one implementation, upon receiving an internal entity creation instruction (i.e., an access request), the internal entity to be created (e.g., index) is renamed. Specifically, the process is intercepted at the entry point of creating the new internal entity, and a unique identifier for the corresponding search engine tenant is set for that internal entity; furthermore, personalized settings can be applied to the internal entity for the search engine tenant.

[0139] In this embodiment of the application, by renaming, the logical subspace and the operation object can be uniquely identified, and the correspondence between the operation object, the logical subspace and the search engine tenant can be determined. In this way, the problem of how to attach the operation object to the corresponding logical subspace after dividing the logical space into multiple logical subspaces can be solved.

[0140] Step 403: Based on the redirection request, perform the access request operation in the target logical subspace to obtain the access response information.

[0141] In one implementation, step 403 may include:

[0142] S4031: Create the target operation object corresponding to the target logical subspace according to the redirection request through the data node corresponding to the target logical subspace; the data node is a process bound to storage resources.

[0143] The target node set includes at least one data node; a data node is a process bound to storage resources.

[0144] Combination Figure 2 As shown, a first data node is allocated to a shared search engine tenant. Through this first data node, index11, index12, and index13 are created in the logical subspace of that shared search engine tenant. A second data node is allocated to search engine tenant C. Through this second data node, index21 and index22 are created in the logical subspace of search engine tenant C. A third data node is allocated to search engine tenant D. Through this third data node, index31 is created in the logical subspace of search engine tenant D.

[0145] S4032: Call the target operation object, execute the access request operation, and obtain access response information.

[0146] Step 404: Return the access response information to the search engine client.

[0147] See Figure 5 The diagram shown is an architectural schematic of a multi-tenant logical isolation access system. Figure 5 In this context, the logical space is divided into a first logical subspace and a second logical subspace. The first logical subspace is assigned to search engine tenant A, and the second logical subspace is assigned to search engine tenant B. User 1 and User 2 belong to search engine tenant A. User 3 belongs to search engine tenant B. Search engine tenants A and B belong to the same search engine cluster. Figure 5 The method for making an access request is illustrated with examples.

[0148] If a first access request is received from user 1 or user 2 of search engine tenant A, authentication is performed based on the first access request. If authentication is successful, the first access request is redirected according to the first logical subspace corresponding to search engine tenant A (i.e., the target logical subspace of search engine tenant A), obtaining the first redirection request. Based on the first redirection request, target operation objects corresponding to the first logical subspace are created, namely index1, alias_x1, alias_y1, mapping_1, and pipeline. Through the data nodes corresponding to the first logical subspace, based on the first redirection request, the created target operation objects are called to execute the access request operation and obtain access response information. During the redirection process, DML, DDL, and settings are rewritten using a rewriter.

[0149] If a second access request is received from user 3 of search engine tenant B, authentication is performed based on the second access request. If authentication is successful, the second access request is redirected according to the second logical subspace corresponding to search engine tenant B (i.e., the target logical subspace of search engine tenant B), obtaining the second redirection request. Based on the second redirection request, target operation objects corresponding to the second logical subspace are created, namely index2, alias_x2, and alias_y2. Through the data node corresponding to the second logical subspace, the created target operation objects are called based on the second redirection request to execute the access request operation and obtain access response information.

[0150] In this embodiment, the logical space of the search engine is divided into multiple logical subspaces, and different logical subspaces are allocated to different search engine tenants, thus achieving logical isolation between different search engine tenants. Furthermore, the node set of the search engine cluster is bound to the search engine tenant, and the data of the search engine tenant is physically forced to be allocated to the corresponding node set. The computation and storage of the logical subspace corresponding to the search engine tenant are achieved through the node set corresponding to that search engine tenant, realizing physical isolation of data computation and data storage between different logical subspaces. This eliminates the need to establish multiple independent search engine clusters and supporting facilities, meeting the user's data security and computational isolation requirements and reducing resource consumption. Moreover, through a rewriter, the operation objects of different logical subspaces are renamed, thereby creating operation objects for different logical subspaces. This achieves the dependency of operation objects on logical subspaces, developing multi-tenant data and functional isolation that is imperceptible to users on a single search engine cluster.

[0151] Furthermore, no modifications to the system core (i.e., the underlying source code) are required. This application is implemented at the architecture and plugin layers, ensuring no impact on subsequent upgrades and reducing costs. Finally, combined with Kubernetes' cloud-native capabilities, it allows for rapid horizontal and vertical scaling. By using data workloads as data nodes, horizontal and vertical operations are simplified. Adding search engine tenants and adjusting their quotas (e.g., storage and computing resources) is also more convenient, improving the user experience.

[0152] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0153] Based on the same inventive concept, this application also provides a data access device. Since the principle of the above-described device and apparatus in solving the problem is similar to that of a data access method, the implementation of the above-described device can refer to the implementation of the method, and repeated details will not be described again. This device can be applied to electronic devices. This application does not limit the type of electronic device; it can be any suitable type of device, such as smartphones, tablet computers, etc., which will not be described again in this application.

[0154] See Figure 6 The diagram shown is a structural block diagram of a data access apparatus according to an embodiment of this application. In some embodiments, the data access apparatus exemplified in this application includes:

[0155] The receiving unit 601 is used to determine the target search engine tenant corresponding to the access request when it receives the access request sent by the search engine client; the target search engine tenant is one of the tenants registered in the search engine.

[0156] The determining unit 602 is used to determine the target logical subspace allocated to the target search engine tenant from multiple logical subspaces of the search engine; each logical subspace is obtained by dividing the logical space of the search engine.

[0157] Unit 603 is used to redirect the access request according to the target logical subspace and obtain the redirection request;

[0158] The execution unit 604 is used to perform an access request operation in the target logical subspace according to the redirection request and obtain access response information;

[0159] Return unit 605 is used to return the access response information to the search engine client.

[0160] Upon receiving an access request from a search engine client, the target search engine tenant corresponding to the access request is determined; the target search engine tenant is one of the tenants registered in the search engine.

[0161] In one embodiment, the receiving unit 601 is used for:

[0162] Receive access requests sent by search engine clients;

[0163] Perform authentication on access requests;

[0164] If the identity authentication is successful, the target search engine tenant corresponding to the access request is obtained.

[0165] In one embodiment, the execution unit 604 is further configured to:

[0166] Authentication is performed based on the redirection request;

[0167] If authentication fails, it is determined that the user does not have permission to access the target logical subspace.

[0168] In one embodiment, the execution unit 604 is further configured to:

[0169] If it is determined that the resource requested by the redirection request does not belong to the target logical subspace, then the user is not allowed to access the target logical subspace.

[0170] In one embodiment, the obtaining unit 603 is used for:

[0171] Retrieves a field of a specified type contained in the access request;

[0172] Based on the target logical subspace, the specified type fields are adjusted to generate a redirection request; the specified type fields are used to create the corresponding target operation object in the target logical subspace.

[0173] In one embodiment, the execution unit 604 is used to:

[0174] Based on the redirection request, the target operation object in the target logical subspace is created using the data node corresponding to the target logical subspace; the data node is a process bound to storage resources.

[0175] Invoke the target operation object, execute the access request operation, and obtain the access response information.

[0176] In one implementation, a reducing unit is determined:

[0177] The logical space is logically divided to obtain multiple logical subspaces;

[0178] Allocate different logical subspaces to different search engine tenants;

[0179] Different node sets are allocated for the logical subspaces of different search engine tenants; each node set contains at least one data node.

[0180] In one implementation, it is applied to a container operation and maintenance platform; the container operation and maintenance platform contains multiple data workloads; each data workload contains at least one container; different data nodes are configured in different containers.

[0181] In the data access method, apparatus, electronic device, and storage medium provided in this application embodiment, upon receiving an access request sent by a search engine client, the target search engine tenant corresponding to the access request is determined; the target search engine tenant is one of the tenants registered in the search engine; a target logical subspace allocated to the target search engine tenant is determined from multiple logical subspaces of the search engine; each logical subspace is obtained by dividing the logical space of the search engine; the access request is redirected according to the target logical subspace to obtain a redirection request; the access request operation is executed in the target logical subspace according to the redirection request to obtain access response information; and the access response information is returned to the search engine client. In this way, the logical space of the search engine is divided into multiple logical subspaces, allowing different search engine tenants to access data through different logical subspaces, reducing the resources consumed by data access isolation.

[0182] This application provides an electronic device, including:

[0183] Processor; and

[0184] The memory stores computer instructions that cause the processor to execute the methods of any of the above-described embodiments.

[0185] This application provides a storage medium storing computer instructions for causing a computer to execute the methods of any of the above embodiments.

[0186] Figure 7 A schematic diagram of the structure of an electronic device 7000 is shown. (See also...) Figure 7 As shown, the electronic device 7000 includes a processor 7010 and a memory 7020, and optionally may also include a power supply 7030, a display unit 7040, and an input unit 7050.

[0187] The processor 7010 is the control center of the electronic device 7000. It connects various components through various interfaces and lines, and performs various functions of the electronic device 7000 by running or executing software programs and / or data stored in the memory 7020.

[0188] In this embodiment, when the processor 7010 calls the computer program stored in the memory 7020, it executes the steps in the above embodiments.

[0189] Optionally, the processor 7010 may include one or more processing units; preferably, the processor 7010 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into the processor 7010. In some embodiments, the processor and memory may be implemented on a single chip; in some embodiments, they may also be implemented separately on independent chips.

[0190] The memory 7020 may primarily include a program storage area and a data storage area. The program storage area may store the operating system, various applications, etc.; the data storage area may store data created based on the use of the electronic device 7000, etc. In addition, the memory 7020 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device, etc.

[0191] Electronic device 7000 also includes a power supply 7030 (such as a battery) that supplies power to various components. The power supply can be logically connected to processor 7010 through a power management system, thereby enabling the management of charging, discharging, and power consumption.

[0192] The display unit 7040 can be used to display information input by the user or information provided to the user, as well as various menus of the electronic device 7000. In this embodiment, it is mainly used to display the display interface of various applications in the electronic device 7000, as well as text, images, and other objects displayed on the display interface. The display unit 7040 may include a display panel 7041. The display panel 7041 may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like.

[0193] The input unit 7050 can be used to receive information such as numbers or characters input by the user. The input unit 7050 may include a touch panel 7051 and other input devices 7052. The touch panel 7051, also known as a touch screen, can collect touch operations on or near the touch panel 7051 (such as operations performed by the user using a finger, stylus, or any suitable object or accessory on or near the touch panel 7051).

[0194] Specifically, the touch panel 7051 can detect user touch operations and the signals generated by these operations, converting them into touch point coordinates and sending them to the processor 7010. It can also receive and execute commands from the processor 7010. Furthermore, the touch panel 7051 can be implemented using various types of sensors, including resistive, capacitive, infrared, and surface acoustic wave sensors. Other input devices 7052 can include, but are not limited to, one or more of the following: a physical keyboard, function keys (such as volume control buttons, power buttons, etc.), a trackball, a mouse, and a joystick.

[0195] Of course, the touch panel 7051 can cover the display panel 7041. When the touch panel 7051 detects a touch operation on or near it, it transmits the information to the processor 7010 to determine the type of touch event. Subsequently, the processor 7010 provides corresponding visual output on the display panel 7041 based on the type of touch event. Although in Figure 7 In this embodiment, the touch panel 7051 and the display panel 7041 are two separate components to realize the input and output functions of the electronic device 7000. However, in some embodiments, the touch panel 7051 and the display panel 7041 can be integrated to realize the input and output functions of the electronic device 7000.

[0196] The electronic device 7000 may also include one or more sensors, such as a pressure sensor, a gravity acceleration sensor, a proximity light sensor, etc. Of course, depending on the specific application, the electronic device 7000 may also include other components such as a camera. Since these components are not the focus of this application's embodiments, therefore... Figure 7 It is not shown in the text and will not be described in detail here.

[0197] Those skilled in the art will understand that Figure 7 This is merely an example of an electronic device and does not constitute a limitation on the electronic device. It may include more or fewer components than shown, or a combination of certain components, or different components.

[0198] For ease of description, the above sections are divided into modules (or units) according to their functions and described separately. Of course, in implementing this application, the functions of each module (or unit) can be implemented in one or more software or hardware components.

[0199] Obviously, the above embodiments are merely examples for clear illustration and are not intended to limit the embodiments. Those skilled in the art can make other variations or modifications based on the above description. It is neither necessary nor possible to exhaustively list all embodiments here. However, obvious variations or modifications derived therefrom are still within the scope of protection of this application.

Claims

1. A method for data access, the method comprising: Upon receiving an access request from a search engine client, the target search engine tenant corresponding to the access request is determined. The target search engine tenant is one of the various search engine tenants registered in the search engine; From the multiple logical subspaces of the search engine, a target logical subspace is determined for the target search engine tenant; each logical subspace is obtained by dividing the logical space of the search engine; different logical subspaces are configured with different operation objects, and the search engine tenant corresponding to each logical subspace executes an access request operation in that logical subspace by calling the operation object in that logical subspace. Based on the target logical subspace, the access request is redirected to obtain a redirection request; Based on the redirection request, an access request operation is performed in the target logical subspace to obtain access response information; The access response information is returned to the search engine client.

2. The method according to claim 1, wherein determining the target search engine tenant corresponding to the access request upon receiving an access request from a search engine client includes: Receive the access request sent by the search engine client; The access request is authenticated. If the identity authentication is successful, the target search engine tenant corresponding to the access request is obtained.

3. The method according to claim 1, further comprising, before performing an access request operation in the target logical subspace according to the redirection request and obtaining access response information: Authentication is performed based on the redirection request; If authentication fails, it is determined that the user does not have permission to access the target logical subspace.

4. The method according to claim 1, further comprising, before performing an access request operation in the target logical subspace according to the redirection request and obtaining access response information: If it is determined that the resource requested by the redirection request does not belong to the target logical subspace, then the user is not allowed to access the target logical subspace.

5. The method according to any one of claims 1-4, wherein redirecting the access request according to the target logical subspace to obtain a redirection request comprises: Retrieve fields of a specified type contained in the access request; Based on the target logical subspace, the specified type field is adjusted to generate the redirection request; The specified type field is used to create the corresponding target operation object in the target logical subspace.

6. The method according to claim 5, wherein, based on the redirection request, an access request operation is performed in the target logical subspace to obtain access response information, comprising: Based on the data nodes corresponding to the target logical subspace, and in accordance with the redirection request, create the target operation object corresponding to the target logical subspace. Data nodes are processes that are bound to storage resources; The target operation object is invoked to execute the access request operation and obtain access response information.

7. The method of claim 6, further comprising, before determining the target logical subspace allocated to the target search engine tenant from the plurality of logical subspaces of the search engine: The logical space is logically divided to obtain multiple logical subspaces; Allocate different logical subspaces to different search engine tenants; Different node sets are allocated for the logical subspaces of different search engine tenants; each node set contains at least one data node.

8. The method according to claim 7 is applied to a container operation and maintenance platform; the container operation and maintenance platform includes multiple data workloads; the data workload includes at least one container; different data nodes are correspondingly set in different containers.

9. A data access apparatus, the apparatus comprising: The receiving unit is used to determine the target search engine tenant corresponding to the access request when it receives an access request sent by the search engine client. The target search engine tenant is one of the various search engine tenants registered in the search engine; The determining unit is used to determine the target logical subspace allocated to the target search engine tenant from multiple logical subspaces of the search engine; each logical subspace is obtained by dividing the logical space of the search engine; different logical subspaces are configured with different operation objects, and the search engine tenant corresponding to each logical subspace executes the access request operation in the logical subspace by calling the operation object in the logical subspace. The obtaining unit is used to redirect the access request according to the target logical subspace to obtain the redirection request; An execution unit is configured to perform an access request operation in the target logical subspace according to the redirection request, and obtain access response information; The return unit is used to return the access response information to the search engine client.

10. An electronic device, comprising: processor; as well as A memory storing computer instructions for causing the processor to perform the method according to any one of claims 1-8.

11. A storage medium storing computer instructions for causing a computer to perform the method according to any one of claims 1-8.

Images