A tenant management method, device and readable storage medium for distributed database

Abstract

The present invention discloses a tenant management method, device and readable storage medium of a distributed database, including: by presetting authentication filters and tenant filters, automatic interception and analysis of user access requests are realized, and user identity information and corresponding isolation strategies are determined. After obtaining the original execution operation, the original execution operation is intercepted based on the tenant filter, and the original execution operation is modified according to the tenant identity information and the isolation strategy, and a target execution operation with isolation conditions is generated. Such a design realizes efficient, secure and scalable multi-tenant data management and isolation.

Description

Technical Field

[0001] The present invention relates to the technical field of database management, and in particular to a tenant management method, device and readable storage medium for a distributed database. Background Art

[0002] Distributed databases are widely used in large-scale data processing and high-concurrency access scenarios. However, when multiple tenants (users or user groups) share the same distributed database, how to ensure the data isolation, security, and access efficiency of each tenant becomes an important issue. Traditional tenant management methods mainly achieve data isolation at the application level, but this approach may cause data redundancy, maintenance difficulties, and difficulty in meeting personalized needs. Summary of the invention

[0003] The object of the present invention is to provide a tenant management method, device and readable storage medium for a distributed database.

[0004] In a first aspect, an embodiment of the present invention provides a tenant management method for a distributed database, comprising:

[0005] Obtain user access requests for distributed databases;

[0006] The user access request is intercepted based on a preset authentication filter, and the user access request is parsed to determine the tenant identity information included in the user access request and the isolation policy corresponding to the user access request;

[0007] Obtaining the original execution operation corresponding to the user access request;

[0008] The original execution operation is intercepted based on a preset tenant filter, and the original execution operation is modified according to the tenant identity information and the isolation policy to obtain a target execution operation with an isolation condition added;

[0009] The target execution operation is performed.

[0010] In a possible implementation manner, obtaining the original execution operation corresponding to the user access request includes:

[0011] Obtain the original SQL operation or original ORM object corresponding to the user access request.

[0012] In a possible implementation, intercepting the original execution operation based on a preset tenant filter, and modifying the original execution operation according to the tenant identity information and the isolation policy to obtain a target execution operation with an isolation condition added includes:

[0013] Intercepting the original SQL operation or the original ORM object based on the preset tenant filter;

[0014] Parsing the original SQL operation or the original ORM object to obtain a request type corresponding to the original SQL operation or the original ORM object;

[0015] According to the request type, the original SQL operation or the original ORM object is modified in combination with the tenant identity information and the isolation strategy to obtain a target SQL execution operation with an isolation condition added.

[0016] In a possible implementation, modifying the original SQL operation or the original ORM object according to the request type in combination with the tenant identity information and the isolation policy to obtain a target SQL execution operation for adding an isolation condition includes:

[0017] When the request type is to add an object, combining the tenant identity information and the isolation policy, adding a tenant identity field to the distributed database to obtain the target SQL execution operation;

[0018] When the request type is query, modification or deletion, based on the tenant identity information and the isolation policy, a filtering condition corresponding to the tenant identity identifier is determined to obtain the target SQL execution operation.

[0019] In a possible implementation, after obtaining the original execution operation corresponding to the user access request, the method further includes:

[0020] Determining whether the operation data involved in the original execution operation is sensitive data;

[0021] If yes, desensitizing the operation data;

[0022] If not, the step of intercepting the original execution operation based on the preset tenant filter and modifying the original execution operation according to the tenant identity information and the isolation policy to obtain the target execution operation with the isolation condition added is executed.

[0023] In a possible implementation, the executing the target execution operation includes:

[0024] dividing the target execution operation into a plurality of target execution operations;

[0025] The plurality of target execution operations are performed in parallel.

[0026] In a possible implementation, after executing the target execution operation, the method further includes:

[0027] Storing the target execution operation in a preset cache area;

[0028] When the same user access request is detected, the target execution operation is extracted from the preset cache area.

[0029] In a second aspect, an embodiment of the present invention provides a tenant management device for a distributed database, including:

[0030] An acquisition module, used to acquire user access requests for a distributed database;

[0031] A management module is used to intercept the user access request based on a preset authentication filter, parse the user access request, determine the tenant identity information included in the user access request and the isolation policy corresponding to the user access request; obtain the original execution operation corresponding to the user access request; intercept the original execution operation based on the preset tenant filter, and modify the original execution operation according to the tenant identity information and the isolation policy to obtain a target execution operation with an isolation condition added; and execute the target execution operation.

[0032] In a third aspect, an embodiment of the present invention provides a computer device, comprising a processor and a non-volatile memory storing computer instructions, wherein when the computer instructions are executed by the processor, the computer device executes the tenant management method of a distributed database described in at least one possible implementation of the first aspect.

[0033] In a fourth aspect, an embodiment of the present invention provides a readable storage medium, wherein the readable storage medium includes a computer program, and when the computer program is running, the computer device where the readable storage medium is located is controlled to execute the tenant management method of a distributed database described in at least one possible implementation manner of the first aspect.

[0034] Compared with the prior art, the beneficial effects provided by the present invention include: adopting a tenant management method, device and readable storage medium of a distributed database disclosed by the present invention, through preset authentication filters and tenant filters, automatic interception and analysis of user access requests are realized, and user identity information and corresponding isolation policies are determined. After obtaining the original execution operation, the original execution operation is intercepted based on the tenant filter, and the original execution operation is modified according to the tenant identity information and isolation policy, and a target execution operation with isolation conditions is generated. Such a design realizes efficient, secure and scalable multi-tenant data management and isolation. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only illustrate certain embodiments of the present invention and should not be regarded as limiting the scope. For those of ordinary skill in the art, other related drawings can also be obtained based on these drawings without creative work.

[0036] Figure 1 A schematic diagram of the steps of a tenant management method for a distributed database provided by an embodiment of the present invention;

[0037] Figure 2 A schematic block diagram of the structure of a tenant management device for a distributed database provided by an embodiment of the present invention;

[0038] Figure 3 A schematic block diagram of the structure of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0040] The specific implementation modes of the present invention are described in detail below in conjunction with the accompanying drawings.

[0041] In order to solve the technical problems in the aforementioned background technology, Figure 1 This is a flow chart of a tenant management method for a distributed database provided in an embodiment of the present disclosure. The tenant management method for a distributed database is introduced in detail below.

[0042] Step S201, obtaining a user access request for a distributed database;

[0043] Step S202: intercepting the user access request based on a preset authentication filter, parsing the user access request, and determining the tenant identity information included in the user access request and the isolation policy corresponding to the user access request;

[0044] Step S203, obtaining the original execution operation corresponding to the user access request;

[0045] Step S204, intercepting the original execution operation based on the preset tenant filter, and modifying the original execution operation according to the tenant identity information and the isolation policy to obtain a target execution operation with an isolation condition added;

[0046] Step S205: executing the target execution operation.

[0047] In an embodiment of the present invention, illustratively, when a distributed database system in which multiple tenants share a database table is running, the server will receive user access requests from different tenants. For example, a user of tenant A wants to query specific data stored in a shared table, so the server receives this query request. After receiving the user access request, the server will first intercept and parse the request using a preset authentication filter. In this process, the server will check the authentication information in the request, such as the tenant's identity (Tenant ID), etc., to ensure that the request comes from a legitimate tenant. At the same time, the server will also determine the isolation policy corresponding to the tenant. For example, some tenants may only be allowed to access their own data, but not other tenants' data. Once the authentication is passed and the tenant identity information and isolation policy are determined, the server will further analyze the user access request to obtain the corresponding original execution operation. Taking the query operation as an example, the original execution operation corresponding to the query request issued by the user of tenant A may be a SQL query statement to retrieve all data from the shared table. Before executing the original operation, the server will intercept again using the preset tenant filter. This step is to ensure that the original operation complies with the tenant's isolation policy. For the user of tenant A, even if the original query statement is to retrieve all data, the server will modify this query statement according to the identity information and isolation policy of tenant A, and add corresponding isolation conditions, such as retrieving only the data of tenant A. The modified query statement is the target execution operation. Finally, the server will execute the modified target execution operation. In this example, the server will execute the modified query statement to retrieve and return only the data of tenant A, ensuring the isolation and security of the data. In this way, even if the data of multiple tenants is stored in the same database table, each tenant can only access its own data. .

[0048] In another implementation of the embodiment of the present invention, in a large enterprise, multiple departments use the same distributed database to store and access data. For example, the human resources department needs to access the database to view employee information, the sales department needs to access the database to update sales records, and the finance department needs to access the database to process accounts. Whenever an employee of any department wants to access the database, they will send an access request. Once the database receives the user's access request, the preset authentication filter will intercept the request and parse the information therein. Assuming that an employee sends an access request, the authentication filter will check whether the employee's identity is legal and extract the identity information for use in subsequent steps. By parsing the user access request, the system can determine the tenant identity information contained in the request. The tenant identity information may indicate the department or role to which the employee belongs, so that access to the database can be restricted according to its permissions in subsequent steps. In addition, the isolation policy corresponding to the user access request will also be determined. The isolation policy can be a set of rules or parameters used to limit the scope of operations that a user can perform. For example, some employees may only be able to view data but not modify it, while other employees may have higher levels of permissions and can modify and delete data. After determining the user's identity information and isolation policy, the system obtains the original execution operations associated with the user's access request. These original operations may include retrieving data from the database, inserting new records, updating existing records, etc. Before executing the original operations, the preset tenant filters intercept these operations and modify the original operations based on the user's identity information and isolation policy. For example, if a user's isolation policy only allows them to view sales records, but the original operation is to update sales records, the filter may modify the operation to a read-only operation to match the user's permissions. By modifying the original operation, the filter adds isolation conditions to ensure that the operation is properly controlled and restricted before it is executed. Finally, the system executes the target execution operation based on the modified original operation. This means that executing the operation modified by the filter ensures that the user's access request is properly processed under the premise of complying with their identity and isolation policy. Depending on the type of operation and user permissions, the database may be read, written, or other corresponding operations.

[0049] With such a design, through the above steps, the tenant management method of the distributed database can limit the user's access to and operation of the database according to the user's identity and isolation policy, thereby improving data security and system controllability.

[0050] In the embodiment of the present invention, the aforementioned step S203 can be implemented through the following example execution.

[0051] (1) Obtain the original SQL operation or original ORM object corresponding to the user access request.

[0052] In the embodiment of the present invention, for example, in this scenario example, it is assumed that we are developing a backend system for an online shopping website. Users can log in and browse the product catalog, add products to the shopping cart, place orders, and so on. We need to obtain the access request sent by the user and the original execution operation corresponding to the request. Specifically, at the database level, there may be a table called "UserAccessLog" for recording the user's access request. Every time a user performs an operation, such as browsing the product catalog or placing an order, an access log is generated. For example, user A logs in to the shopping website and browses the product catalog, the system receives an access request and records it in the "UserAccessLog" table. This record contains information such as user A's access time, request type (browsing), and request path. We need to extract the original SQL operation or the original ORM (object-relational mapping) object from the access request obtained in step 1. These operations can be used directly to interact with the database to perform corresponding operations. Continuing with the above example, assume that when user A browses the product catalog, the system generates a raw SQL operation based on the request. This SQL operation may be similar to the following statement: SELECT * FROM Products

[0053] Alternatively, the system can use an ORM framework to handle database interactions, then this step may generate a raw ORM object, for example:

[0054] Python

[0055] from sqlalchemy import Column,Integer,String

[0056] class Product(Base):

[0057] __tablename__ = 'products'

[0058] id=Column(Integer,primary_key=True)

[0059] name = Column (String)

[0060] description = Column (String)

[0061] price=Column(Integer)

[0062] In this scenario, the obtained raw SQL operations or raw ORM objects can be directly used to execute database query operations related to products.

[0063] In another implementation of the embodiment of the present invention, assume that there is an online shopping website, and the user enters a keyword in the search box to search for products. When the user clicks the search button, the system will receive a user access request. The request needs to go through a series of processes to get the final search results. In this process, the system first converts the user's search keyword into an SQL query statement, for example:

[0064] sql

[0065] SELECT*FROM products WHERE name LIKE'%keyword%';

[0066] This SQL query statement is used to obtain the original SQL operation corresponding to the user access request.

[0067] Suppose there is a social media application where users can post and view posts. When a user browses a post, the system receives a user access request. In order to display the post content, the system needs to get the corresponding data from the database. In this case, the system may use ORM (object-relational mapping) technology to interact with the database. When the system receives a user access request, it creates an ORM object based on the information in the request, for example:

[0068] Python

[0069] post=Post.objects.get(id=post_id)

[0070] Here, the Post.objects.get() operation uses ORM technology to obtain the original ORM object corresponding to the user access request.

[0071] In summary, the above steps refer to obtaining the original execution operation (such as SQL operation or ORM object) corresponding to the user access request in the above method. The specific scenario depends on the application requirements and the technology used. The above examples provide two common scenarios, which involve SQL operations and ORM object acquisition respectively.

[0072] In the embodiment of the present invention, the aforementioned step S204 may be implemented through the following example execution.

[0073] (1) intercepting the original SQL operation or the original ORM object based on the preset tenant filter;

[0074] (2) parsing the original SQL operation or the original ORM object to obtain a request type corresponding to the original SQL operation or the original ORM object;

[0075] (3) According to the request type, the original SQL operation or the original ORM object is modified in combination with the tenant identity information and the isolation strategy to obtain a target SQL execution operation with an isolation condition added.

[0076] In an embodiment of the present invention, for example, it is assumed that there is a multi-tenant software system, which contains databases of multiple tenants. Before performing any database operation, the system will first check the tenant identity information of the current operation. The preset tenant filter will intercept and verify whether these database operations comply with the access rights of the current tenant according to the configured rules and conditions. For example, a company uses an online sales platform to manage its products and orders. Different stores use the platform as independent tenants, and each store has its own database. When the administrator of store A tries to execute a SQL query statement, the preset tenant filter will intercept the operation and check whether the administrator has sufficient permissions to perform the operation. If the permission verification passes, the next step can be performed. In the previous step, the preset tenant filter has intercepted the original SQL operation or ORM object. Next, the system needs to parse these operations to determine the request types they correspond to. Request types can be divided into read operations (such as SELECT queries) and write operations (such as INSERT, UPDATE, DELETE, etc.). Taking the online sales platform as an example, when the administrator of store A executes a SQL query statement, the system will parse the query statement and determine that it is a read operation. Similarly, if the administrator attempts to perform an update operation (such as INSERT, UPDATE, or DELETE) on the database of store A, the system can also correctly identify these request types. Based on the request type determined in the previous step, in this step, the system modifies the original SQL operation or ORM object according to the tenant's identity information and the preset isolation policy to add appropriate isolation conditions. These isolation conditions can ensure data isolation and security between different tenants. Continuing with the online sales platform as an example, assume that store A and store B are both independent tenants on the platform. The administrator of store A executes a SQL query statement to obtain product inventory information. In this step, the system modifies the original query statement according to store A's identity information and isolation policy to ensure that only product inventory data belonging to store A is returned, without store B's data. Through these steps, the system can intercept and modify the original database operation according to the preset tenant filter, tenant identity information, and isolation policy, thereby ensuring that each tenant can only access its own data and meet the requirements of data isolation.

[0077] In another implementation of the embodiment of the present invention, it is assumed that there is a multi-tenant online shopping mall platform, and different merchants use the same database to store their product information. When a merchant executes an SQL operation to update the price of a product, the operation will be intercepted first. The interception operation can use a preset tenant filter to check the merchant's identity and verify its permissions. The parsing operation can determine the type of request based on the properties of the executed SQL statement or ORM object. For example, when a merchant executes an SQL operation to query the inventory of a product, the parsing operation can determine that the operation is a query request and requires specific isolation conditions to limit the scope of the results. According to different request types, combined with tenant identity information and isolation policies, the original SQL operation or ORM object can be modified to add isolation conditions. For example, when a merchant executes an SQL operation to query the inventory of a product, additional conditions can be added based on the merchant's identity information and isolation policy to ensure that the merchant can only query its own inventory of goods, but cannot access the inventory information of other merchants. Through the above three steps, the system can intercept the original execution operation based on the preset tenant filter, and modify the original execution operation based on the tenant identity information and isolation policy, thereby obtaining the target execution operation with added isolation conditions. This ensures that in a multi-tenant environment, each tenant can only access the data they own, enhancing the security and data isolation of the system.

[0078] In an embodiment of the present invention, the aforementioned step of modifying the original SQL operation or the original ORM object according to the request type, in combination with the tenant identity information and the isolation strategy, to obtain the target SQL execution operation of adding isolation conditions can be implemented through the following example.

[0079] (1) When the request type is to add an object, combining the tenant identity information and the isolation policy, adding a tenant identity field to the distributed database to obtain the target SQL execution operation;

[0080] (2) When the request type is query, modification or deletion, based on the tenant identity information and the isolation policy, determine the filtering condition corresponding to the tenant identity identifier to obtain the target SQL execution operation.

[0081] In an embodiment of the present invention, illustratively, it is assumed that there is a distributed database system in which data of multiple tenants are stored. Each tenant has its own independent identity information and isolation policy. When a tenant adds a new object to the database through an application, according to the aforementioned method, the system will modify the original SQL operation or ORM (object-relational mapping) object in combination with the tenant's identity information and isolation policy. In this scenario, the system will add a field representing the tenant identity to the distributed database to associate the new object with a specific tenant. Through such modification, the system generates a target SQL execution operation, which includes an SQL statement with the tenant identity field added. Assuming that a tenant in the application wants to perform a query, modification or deletion operation, the operation needs to be restricted by the tenant identity information and isolation policy. According to the aforementioned method, before executing these operations, the system will determine the filtering conditions corresponding to the tenant identity based on the tenant identity information and isolation policy. For example, if a tenant can only access the data created by himself, the system will generate a target SQL execution operation containing the filtering conditions based on the tenant identity information and isolation policy to ensure that only the data owned by the tenant is returned. In this way, the system can limit the scope of query, modification or deletion by applying the filtering conditions, thereby ensuring the isolation of the data. By modifying the original SQL operation or ORM object in combination with the request type, tenant identity information, and isolation policy, the target SQL execution operation with added isolation conditions is obtained. These scenarios show how to implement dynamic operations and access control on data in a distributed database based on different request types, thereby ensuring data isolation and security between tenants.

[0082] In another implementation of the embodiment of the present invention, it is assumed that there is a distributed database in which data of different tenants are stored. When a tenant uses an application to add a new object to the database, according to the request type of "add object", the system will modify the original SQL operation or ORM object according to the tenant's identity information and isolation policy. In this way, the system will add a tenant identity field (for example, tenant ID) to the newly added object to ensure that the object is associated with the tenant. The target SQL execution operation obtained is to send the SQL statement containing the tenant identity field to the distributed database. Suppose a tenant wants to query, modify or delete certain data in the database. In this case, according to the request type of "query", "modify" or "delete", the system will determine the filtering conditions corresponding to the tenant identity in combination with the tenant identity information and isolation policy. The system will use these filtering conditions to perform the target SQL execution operation to ensure that only data belonging to the tenant is returned, modified or deleted. In this design, the original SQL operation or the original ORM object is modified according to the request type (add object, query, modify or delete), the tenant identity information and the isolation policy, and the target SQL execution operation with added isolation conditions is obtained. The specific scenario illustrates how to combine tenant identity information and isolation policies to make modifications under different request types to achieve data isolation.

[0083] In the embodiment of the present invention, after executing step S203, the embodiment of the present invention further provides the following implementation manner.

[0084] (1) determining whether the operation data involved in the original execution operation is sensitive data;

[0085] (2) If yes, desensitizing the operation data;

[0086] (3) If not, the step of intercepting the original execution operation based on the preset tenant filter and modifying the original execution operation according to the tenant identity information and the isolation policy to obtain the target execution operation with the isolation condition added is executed.

[0087] In an embodiment of the present invention, exemplarily, a user submits an access request to a cloud server through an application, and the request includes a series of operation data, such as reading or modifying the content of a file. After obtaining the access request, the system first determines whether the operation data is sensitive data. Sensitive data may include user privacy information, confidential documents, etc. The system checks the data to determine whether the operation data is sensitive data. If it is determined to be sensitive data, the system needs to desensitize the operation data. Desensitization is a method of protecting sensitive data, which usually replaces key information in the data with a vague and unrecognizable form to prevent unauthorized access. If it is determined to be non-sensitive data, the system needs to perform an interception operation based on a preset tenant filter. A tenant refers to a user or organization accessing the system, and a preset tenant filter is a pre-set screening rule used to determine whether the tenant is allowed to perform a specific operation. When performing the interception operation, the system modifies the original execution operation according to the tenant identity information and the isolation policy. The tenant identity information may include user ID, role, etc., and the isolation policy is a set of rules that defines the resource isolation level and permission control. Finally, the modified original execution operation will obtain the target execution operation with the isolation condition added. This means that when the system processes user access requests, it restricts or changes operations based on specific tenant identities and isolation policies, ensuring data security and compliance.

[0088] In the embodiment of the present invention, the aforementioned step S205 can be implemented through the following example execution.

[0089] (1) dividing the target execution operation into multiple target execution operations;

[0090] (2) Execute the multiple target execution operations in parallel.

[0091] In an embodiment of the present invention, illustratively, it is assumed that there is a distributed database system that adopts the tenant management method. Now consider a specific user access request that needs to perform a complex query operation. The following are the detailed steps of the scenario: The user initiates a database query request. The request is intercepted and parsed to determine that the user has tenant identity information and that the request needs to be processed according to a specific isolation policy. The original query operation is obtained. Based on the tenant identity information and the isolation policy, the original query operation is modified to add appropriate isolation conditions. The target execution operation is divided into multiple target execution sub-operations, each of which can be executed in parallel. Multiple target execution sub-operations are executed simultaneously in the distributed database to improve overall performance and concurrency. The execution results are collected and summarized and finally returned to the user.

[0092] In the embodiment of the present invention, after executing step S205, the embodiment of the present invention further provides the following implementation manner.

[0093] (1) storing the target execution operation into a preset cache area;

[0094] (2) When the same user access request is detected, extracting the target execution operation from the preset cache area.

[0095] In an embodiment of the present invention, illustratively, a user initiates a database query request, which is the same as the previous scenario. The request is intercepted and parsed to determine the user's tenant identity information and isolation policy. The original query operation is obtained and modified to a target execution operation with an isolation condition added. The target execution operation is executed, and the execution result is stored in a preset cache area. The same user access request is detected again, which may be because the user has executed the same query operation again. In this case, the previously executed target execution operation is extracted from the preset cache area without the need to execute the entire operation again. The execution result obtained from the cache is returned directly to the user to save time and resources. By storing the target execution operation in the cache area and reusing the cached result when the same request is detected, the response speed and efficiency of the system can be improved, which is particularly useful for frequently repeated query operations.

[0096] An overall implementation process of an embodiment of the present invention is provided below.

[0097] When a user (such as a company) initiates a request, the system will first intercept the request through the authentication filter and obtain information about which company the user belongs to, that is, the tenant information.

[0098] The user's request starts to execute. This request may contain some SQL statements or ORM objects to operate the database. At this time, the tenant filter will intercept these SQL statements or ORM objects.

[0099] The tenant filter then parses these SQL statements or ORM objects to understand what they are going to do and prepare for the next step.

[0100] Next, the tenant filter will modify these SQL statements or ORM objects based on the tenant information obtained earlier. For example, if the original SQL statement is "SELECT * FROM employees", the tenant filter will automatically modify it to "SELECT * FROM employees WHERE tenant_id =: current_tenant_id". In this way, only the employee information belonging to the current company will be queried.

[0101] The modified SQL statement or ORM object will be executed. Since the tenant filtering condition has been added, the execution result will naturally meet the requirements of multi-tenancy and achieve the isolation of data between different companies.

[0102] Finally, the system returns the execution result, which has automatically achieved the isolation of data between companies, and users do not need to care about any logic related to data isolation.

[0103] Another overall implementation process of the embodiment of the present invention is provided below.

[0104] When a user initiates a request, the system first intercepts the request through the authentication filter, extracts the tenant information and isolation policy from it, and then stores it in the context.

[0105] When the system executes SQL statements through the ORM framework, the tenant filter intercepts these SQL statements or ORM objects.

[0106] The tenant filter then parses the intercepted SQL statement or ORM object to prepare for the next step of processing.

[0107] In combination with the tenant isolation strategy, the tenant filter will modify the SQL statement or ORM object to add tenant filtering logic. There are two cases:

[0108] For the operation of adding an object, the system automatically adds a tenant ID field (obtained from the current user login context) and fills in the tenant ID value after the object is persisted to the database to mark the tenant to which the object belongs.

[0109] For operations of querying, modifying, or deleting objects, the system automatically adds tenant ID filtering conditions, so that filtering is performed based on tenant ID when executing SQL statements, thus achieving data isolation between tenants.

[0110] Execute the modified SQL statements. Since the tenant isolation logic has been implanted into the SQL statements in step 4, the system can naturally implement tenant isolation when executing these SQL statements.

[0111] Return the execution result. Since the previous steps have ensured the correctness of data operations and the isolation between tenants, the returned results naturally meet the requirements of a multi-tenant system.

[0112] In general, this non-invasive multi-tenant implementation method improves the efficiency and maintainability of the software system by automatically embedding multi-tenant processing logic in the ORM framework, so that the business code does not need to deal with multi-tenant related logic.

[0113] Please refer to Figure 2 , Figure 2A tenant management device 110 for a distributed database provided in an embodiment of the present invention includes:

[0114] An acquisition module 1101 is used to acquire a user access request for a distributed database;

[0115] Management module 1102 is used to intercept the user access request based on a preset authentication filter, parse the user access request, determine the tenant identity information included in the user access request and the isolation policy corresponding to the user access request; obtain the original execution operation corresponding to the user access request; intercept the original execution operation based on the preset tenant filter, and modify the original execution operation according to the tenant identity information and the isolation policy to obtain a target execution operation with an isolation condition added; and execute the target execution operation.

[0116] It should be noted that the implementation principle of the tenant management device 110 of the above-mentioned distributed database can refer to the implementation principle of the tenant management method of the above-mentioned distributed database, and will not be repeated here. It should be understood that the division of the various modules of the above device is only a division of logical functions. In actual implementation, they can be fully or partially integrated into a physical entity, or they can be physically separated. And these modules can all be implemented in the form of software called by processing elements; they can also be implemented in the form of hardware; some modules can also be implemented in the form of software called by processing elements, and some modules can be implemented in the form of hardware. For example, the tenant management device 110 of the distributed database can be a separately established processing element, or it can be integrated in a chip of the above-mentioned device. In addition, it can also be stored in the memory of the above-mentioned device in the form of program code, and called and executed by a processing element of the above-mentioned device. The function of the tenant management device 110 of the above-mentioned distributed database. The implementation of other modules is similar. In addition, these modules can be fully or partially integrated together, or they can be implemented independently. The processing element described here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each of the above modules can be completed by an integrated logic circuit of hardware in the processor element or instructions in the form of software.

[0117] For example, the above modules may be one or more integrated circuits configured to implement the above methods, such as one or more application specific integrated circuits (ASIC), or one or more microprocessors (digital signal processors, DSP), or one or more field programmable gate arrays (FPGA), etc. For another example, when a module above is implemented in the form of a processing element scheduling program code, the processing element may be a general-purpose processor, such as a central processing unit (CPU) or other processor that can call program code. For another example, these modules may be integrated together and implemented in the form of a system-on-a-chip (SOC).

[0118] The embodiment of the present invention provides a computer device 100, which includes a processor and a non-volatile memory storing computer instructions. When the computer instructions are executed by the processor, the computer device 100 executes the tenant management device 110 of the distributed database. Figure 3 As shown, Figure 3 This is a structural block diagram of a computer device 100 provided in an embodiment of the present invention. The computer device 100 includes a tenant management device 110 of a distributed database, a memory 111 , a processor 112 , and a communication unit 113 .

[0119] In order to realize data transmission or interaction, the memory 111, the processor 112 and the communication unit 113 are electrically connected to each other directly or indirectly. For example, the electrical connection between these elements can be achieved through one or more communication buses or signal lines. The tenant management device 110 of the distributed database includes at least one software function module that can be stored in the memory 111 in the form of software or firmware or solidified in the operating system (OS) of the computer device 100. The processor 112 is used to execute the tenant management device 110 of the distributed database stored in the memory 111, such as the software function modules and computer programs included in the tenant management device 110 of the distributed database.

[0120] An embodiment of the present invention provides a readable storage medium, which includes a computer program. When the computer program is running, the computer device where the readable storage medium is located is controlled to execute the aforementioned tenant management method of the distributed database.

[0121] For illustrative purposes, the foregoing description is made with reference to specific embodiments. However, the above illustrative discussion is not intended to be exhaustive or to limit the present disclosure to the precise form disclosed. Numerous modifications and variations are possible in accordance with the above teachings. These embodiments are selected and described in order to best illustrate the principles of the present disclosure and its practical application, so that those skilled in the art can best utilize the present disclosure and utilize various embodiments with different modifications to suit the intended specific application.

Claims

1. A tenant management method for a distributed database, characterized in that: include: Obtain user access requests for distributed databases; The user access request is intercepted based on a preset authentication filter, and the user access request is parsed to determine the tenant identity information included in the user access request and the isolation policy corresponding to the user access request; Obtaining the original execution operation corresponding to the user access request; The original execution operation is intercepted based on a preset tenant filter, and the original execution operation is modified according to the tenant identity information and the isolation policy to obtain a target execution operation with an isolation condition added; Execute the target execution operation; The obtaining the original execution operation corresponding to the user access request includes: Obtaining the original SQL operation or original ORM object corresponding to the user access request; The intercepting the original execution operation based on the preset tenant filter and modifying the original execution operation according to the tenant identity information and the isolation policy to obtain the target execution operation with the isolation condition added includes: Intercepting the original SQL operation or the original ORM object based on the preset tenant filter; Parsing the original SQL operation or the original ORM object to obtain a request type corresponding to the original SQL operation or the original ORM object; According to the request type, the original SQL operation or the original ORM object is modified in combination with the tenant identity information and the isolation strategy to obtain a target SQL execution operation with an isolation condition added; The modifying the original SQL operation or the original ORM object according to the request type and in combination with the tenant identity information and the isolation strategy to obtain a target SQL execution operation with an isolation condition added includes: When the request type is to add an object, combining the tenant identity information and the isolation policy, adding a tenant identity field to the distributed database to obtain the target SQL execution operation; When the request type is query, modification or deletion, based on the tenant identity information and the isolation policy, determine the filtering condition corresponding to the tenant identity identifier to obtain the target SQL execution operation; After obtaining the original execution operation corresponding to the user access request, the method further includes: Determining whether the operation data involved in the original execution operation is sensitive data; If yes, desensitizing the operation data; If not, the step of intercepting the original execution operation based on the preset tenant filter and modifying the original execution operation according to the tenant identity information and the isolation policy to obtain the target execution operation with the isolation condition added is executed; The executing the target execution operation includes: dividing the target execution operation into a plurality of target execution operations; executing the plurality of target execution operations in parallel; After executing the target execution operation, the method further includes: Storing the target execution operation in a preset cache area; When the same user access request is detected, the target execution operation is extracted from the preset cache area.

2. A tenant management device for a distributed database, characterized in that: include: An acquisition module, used to acquire user access requests for a distributed database; A management module, configured to intercept the user access request based on a preset authentication filter, parse the user access request, and determine the tenant identity information included in the user access request and the isolation policy corresponding to the user access request; Obtaining an original execution operation corresponding to the user access request; intercepting the original execution operation based on a preset tenant filter, and modifying the original execution operation according to the tenant identity information and the isolation policy to obtain a target execution operation with an isolation condition added; and executing the target execution operation; The acquisition module is specifically used for: Obtaining the original SQL operation or original ORM object corresponding to the user access request; The management module is specifically used for: Intercepting the original SQL operation or the original ORM object based on the preset tenant filter; parsing the original SQL operation or the original ORM object to obtain the request type corresponding to the original SQL operation or the original ORM object; According to the request type, the original SQL operation or the original ORM object is modified in combination with the tenant identity information and the isolation strategy to obtain a target SQL execution operation with an isolation condition added; The management module is further specifically used for: When the request type is to add an object, combining the tenant identity information and the isolation policy, adding a tenant identity field to the distributed database to obtain the target SQL execution operation; When the request type is query, modification or deletion, based on the tenant identity information and the isolation policy, determine the filtering condition corresponding to the tenant identity identifier to obtain the target SQL execution operation; The acquisition module is also used for: Determine whether the operation data involved in the original execution operation is sensitive data; if so, perform desensitization processing on the operation data; if not, perform the steps of intercepting the original execution operation based on the preset tenant filter, and modifying the original execution operation according to the tenant identity information and the isolation policy to obtain the step of adding the target execution operation with the isolation condition; The management module is specifically used for: dividing the target execution operation into a plurality of target execution operations; executing the plurality of target execution operations in parallel; Storing the target execution operation in a preset cache area; When the same user access request is detected, the target execution operation is extracted from the preset cache area.

3. A computer device, characterized in that: The computer device includes a processor and a non-volatile memory storing computer instructions. When the computer instructions are executed by the processor, the computer device executes the tenant management method for a distributed database according to claim 1.

4. A readable storage medium, characterized in that: The readable storage medium includes a computer program, and when the computer program is executed, the computer device where the readable storage medium is located is controlled to execute the tenant management method of the distributed database according to claim 1.

Images