Multi-tenant data processing method, system and medium based on cloud platform database

Abstract

The present invention discloses a multi-tenant data processing method, system and medium based on a cloud platform database, and relates to the technical field of multi-tenant data processing, comprising the following steps: receiving a data request sent by a tenant; verifying the identity information of the tenant, and allocating the data request to a corresponding database; performing content recognition on the data request, and identifying ordinary data and important data in the data request; encrypting the important data to obtain encrypted data after encryption; storing the ordinary data and encrypted data of the tenant, and decrypting the encrypted data and returning it to the tenant when the tenant reads the data; the present invention is used to solve the problem that the existing multi-tenant data processing technology still has insufficient security protection for tenant data, resulting in the problem that the important data of the tenant is easily leaked and stolen.

Description

Technical Field

[0001] The present invention relates to the technical field of multi-tenant data processing, and specifically to a multi-tenant data processing method, system and medium based on a cloud platform database. Background Art

[0002] Multi-tenant data processing technology refers to the methods and technologies for simultaneously processing and managing the data of multiple tenants or customers in a system or platform. In a multi-tenant environment, different tenants share the same system instance, but their data must be strictly isolated and protected to ensure the data security, privacy and integrity of each tenant.

[0003] Existing multi-tenant data processing technologies usually use a single database and multi-tenant architecture or a database per tenant method to perform simple data isolation to ensure that each tenant's data is physically and logically isolated to ensure data security and privacy. However, this can only ensure the security of normal reading methods. If someone maliciously attacks the cloud platform database, it will lead to tenant data leakage, and some important data will inevitably exist in the leaked data. Therefore, it is necessary to encrypt the important data to ensure the security of the important data. For example, in the Chinese patent application publication number: CN108093026A, a multi-tenant request processing method and device are disclosed. This solution only isolates the user's data through the user identifier to ensure the security of the data. This method cannot guarantee the security of some important data. The existing multi-tenant data processing technology also has insufficient security protection for tenant data, which makes the tenant's important data easy to be leaked and stolen. Summary of the invention

[0004] The present invention aims to solve one of the technical problems in the prior art to at least a certain extent, by receiving a data request sent by a tenant, verifying the tenant's identity information, allocating the data request to a target database, and then performing content identification on the data request, identifying ordinary data and important data in the data request, and then encrypting the important data to obtain encrypted data, and finally storing the tenant's ordinary data and encrypted data. When the tenant reads the data, the encrypted data is decrypted and returned to the tenant, so as to solve the problem that the existing multi-tenant data processing technology still has insufficient security protection for tenant data, which makes the tenant's important data easy to be leaked and stolen.

[0005] To achieve the above objectives, in a first aspect, the present application provides a multi-tenant data processing method based on a cloud platform database, comprising the following steps:

[0006] Receive data requests sent by tenants;

[0007] Verify the tenant's identity information and assign data requests to the corresponding database;

[0008] Perform content recognition on data requests to identify common data and important data in data requests;

[0009] Encrypt important data to obtain encrypted data;

[0010] The tenant's normal data and encrypted data are stored, and when the tenant reads the data, the encrypted data is decrypted and returned to the tenant.

[0011] Furthermore, the data request includes a user identification ID and data to be stored.

[0012] Furthermore, verifying the tenant's identity information and allocating the data request to the corresponding database includes the following sub-steps:

[0013] Get the user ID;

[0014] Read the tenant ID database and check whether the user ID exists in the tenant ID database. If so, output a tenant existence signal; if not, output a tenant non-existence signal;

[0015] If the output tenant has a signal, the data to be stored is allocated to the database corresponding to the user ID, and the database corresponding to the user ID is marked as the target database; if the output tenant does not have a signal, the tenant information that was not queried is returned to the tenant.

[0016] Furthermore, performing content identification on the data request to identify common data and important data in the data request includes the following sub-steps:

[0017] Perform data preprocessing on the data to be stored in the data request to obtain a submitted analysis chart and a total analysis chart;

[0018] Analyze the submitted analysis chart and the total analysis chart to determine whether the words to be identified are important data.

[0019] Furthermore, preprocessing the data to be stored in the data request includes the following sub-steps:

[0020] Mark all the consecutive numbers in the data to be stored as important data, and a group of consecutive numbers is one important data;

[0021] Use Jieba word segmentation to segment the stored data and obtain data segmentation;

[0022] Compare the data segmentation with the stop word library, mark the data segmentation in the stop word library as stop word and remove them, mark the remaining data segmentation as to-be-recognized segmentation, and name the number of to-be-recognized segmentation as the number of submitted words;

[0023] The same to-be-recognized segmented words are integrated into one to-be-recognized word, the number of occurrences of different to-be-recognized words is counted, marked as the number of word submissions, and the ratio of the number of word submissions to the number of submitted words is counted, named as the submitted word frequency;

[0024] Count the number of words to be identified in the target database, named as the total number of words, count the number of words to be identified in the target database, named as the total number of words, and count the ratio of the total number of words to the total number of words, marked as the total word frequency;

[0025] A rectangular coordinate system is established with the words to be recognized as the X-axis and the submitted word frequency as the Y-axis, named as the submission analysis chart, and the words to be recognized and the corresponding submitted word frequency are entered into the submission analysis chart;

[0026] A rectangular coordinate system is established with the words to be recognized as the horizontal axis and the total word frequency as the vertical axis, named the total analysis chart, and the words to be recognized and the total word frequency are entered into the total analysis chart.

[0027] Furthermore, analyzing the submitted analysis diagram and the overall analysis diagram includes the following sub-steps:

[0028] Obtain any stop participle, mark it as a first participle, mark the ratio of the number of times the first participle appears in the data to be stored to the number of stop participles in the data to be stored as a first ratio; mark the ratio of the number of times the first participle appears in the target database to the number of stop participles in the target database as a second ratio;

[0029] Calculate the average value of the first proportion and name it the submission threshold; calculate the average value of the second proportion and name it the total threshold;

[0030] Name the coordinate systems in the submitted analysis diagram and the total analysis diagram as submitted coordinate points and total coordinate points respectively;

[0031] For the submitted analysis graph, a first threshold is set, the number of submitted coordinate points whose Y is in the range [0, first threshold] is obtained, which is named the first number, the first number is divided by the first threshold, and the calculation result is marked as the first density. The first threshold is initially 0, and the first threshold is gradually increased and the first density is calculated until the first threshold is equal to the submitted threshold and the increase stops;

[0032] For the total analysis graph, set the second threshold, obtain the total number of coordinate points whose Y is in the range [0, second threshold], named as the second number, calculate the second number and divide the second threshold, mark the calculation result as the second density, the second threshold is initially 0, gradually increase the second threshold and calculate the second density, and stop increasing when the second threshold is equal to the total threshold;

[0033] Find the minimum value in the non-zero first density, and mark the corresponding first threshold as the encryption submission threshold; find the minimum value in the non-zero second density, and mark the corresponding second threshold as the total encryption threshold;

[0034] The words to be identified whose submitted word frequency is less than or equal to the submitted encryption threshold and whose total word frequency is less than or equal to the total encryption threshold are marked as important data, and the rest of the words to be identified are marked as ordinary data.

[0035] Furthermore, the important data is encrypted to obtain the encrypted data, which includes the following sub-steps:

[0036] Use the user ID as the encryption key;

[0037] Based on the encryption key, AES is performed on important data to obtain encrypted data.

[0038] Furthermore, storing the tenant's ordinary data and encrypted data, and decrypting the encrypted data when the tenant reads the data and returning it to the tenant includes the following sub-steps:

[0039] Replace the important data in the data to be stored with the corresponding encrypted data, and do not encrypt and replace the common data, to obtain the string to be stored;

[0040] Store the character string to be stored in the target database;

[0041] When the tenant sends a read request, it carries the user identification ID, uses the user identification ID as the decryption key to perform AES decryption on the data, and sends the decrypted data to the tenant.

[0042] In a second aspect, the present application provides a multi-tenant data processing system based on a cloud platform database, including a request receiving module, an identity authentication module, a content identification module, a data encryption module and a data storage module; the request receiving module, the identity authentication module, the content identification module and the data storage module are respectively connected to the data encryption module;

[0043] The request receiving module is used to receive a data request sent by a tenant;

[0044] The identity authentication module is used to verify the tenant's identity information and distribute the data request to the corresponding database;

[0045] The content identification module is used to perform content identification on the data request, and identify common data and important data in the data request;

[0046] The data encryption module is used to encrypt important data to obtain encrypted data;

[0047] The data storage module is used to store the tenant's common data and encrypted data, and to decrypt the encrypted data and return it to the tenant when the tenant reads the data.

[0048] In a third aspect, the present application provides a storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps in the above method are performed.

[0049] Beneficial effects of the present invention: The present invention receives data requests sent by tenants, verifies the tenants' identity information, and distributes the data requests to the target database. The advantage is that the tenants' data is isolated by dividing a database for each tenant, so as to ensure the security of the tenants' data during normal reading, thereby improving the security of the tenants' data.

[0050] The present invention performs data preprocessing on the data to be stored in the data request to obtain a submission analysis graph and a total analysis graph, and then analyzes the submission analysis graph and the total analysis graph to determine whether the word to be identified is important data. The advantage is that in order to prevent the leakage of tenant data caused by reading data by abnormal means, the tenant data needs to be encrypted, and the data volume of multi-tenant tenant data is too large. If all of them are to be encrypted, the encryption system will be overloaded. Therefore, only important data in the tenant data needs to be encrypted, and the number of occurrences of important data is usually not too high. Therefore, by analyzing the submission word frequency and total word frequency of different words, it is possible to confirm whether the word is important data, thereby improving the security and effectiveness of multi-tenant data processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 It is a principle block diagram of the method of the present invention;

[0052] Figure 2 Submission analysis diagram for the present invention;

[0053] Figure 3 It is a general analysis diagram of the present invention;

[0054] Figure 4 A flowchart of the steps of the system of the present invention. DETAILED DESCRIPTION

[0055] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] Example 1, please refer to Figure 1As shown, in the first aspect, the present application provides a multi-tenant data processing system based on a cloud platform database, including a request receiving module, an identity authentication module, a content identification module, a data encryption module and a data storage module; the request receiving module, the identity authentication module, the content identification module and the data storage module are respectively connected to the data encryption module;

[0057] The request receiving module is used to receive the data request sent by the tenant; the data request includes the user identification ID and the data to be stored;

[0058] In actual applications, the data request obtained is "[100101] The access key of the system is 123456", where the number in the square brackets at the beginning of the data request is the user identification ID, and the text after the square brackets is the data to be stored.

[0059] The identity authentication module is used to verify the tenant's identity information and assign data requests to the corresponding database;

[0060] The authentication module is configured with an authentication strategy, which includes:

[0061] Get the user ID;

[0062] Read the tenant ID database and check whether the user ID exists in the tenant ID database. If so, output a tenant existence signal; if not, output a tenant non-existence signal;

[0063] If the output tenant exists signal, the data to be stored is allocated to the database corresponding to the user identification ID, and the database corresponding to the user identification ID is marked as the target database; if the output tenant does not exist signal, the tenant information that was not queried is returned to the tenant;

[0064] In actual application, the user ID obtained is "100101", and some data of the tenant ID database is shown in Table 1 below:

[0065] Table 1 Partial data of the tenant ID database

[0066] User ID Database address 100101 Xxx / xxx / xxx / 100101 100102 Xxx / xxx / xxx / 100102 100201 Xxx / xxx / xxx / 100201

[0067] Find that the user ID "100101" exists in the tenant ID database, output the tenant existence signal, access the database address, and mark the database corresponding to Xxx / xxx / xxx / 100101 as the target database.

[0068] The content identification module is used to identify the content of the data request and identify the common data and important data in the data request; the content identification module includes a data preprocessing unit and an important data determination unit;

[0069] The data preprocessing unit is used to perform data preprocessing on the data to be stored in the data request to obtain a submitted analysis graph and a total analysis graph;

[0070] The data preprocessing unit is configured with a data preprocessing strategy, which includes:

[0071] Mark all the consecutive numbers in the data to be stored as important data, and a group of consecutive numbers is one important data;

[0072] Use Jieba word segmentation to segment the stored data and obtain data segmentation;

[0073] Compare the data segmentation with the stop word library, mark the data segmentation in the stop word library as stop word and remove them, mark the remaining data segmentation as to-be-recognized segmentation, and name the number of to-be-recognized segmentation as the number of submitted words;

[0074] In practical applications, the data to be stored is "the access key of the system is 123456", where 123456 is a continuous number, that is, it is marked as important data; the jieba word segmentation adopts the existing jieba word segmentation technology, and the data word segmentation includes "system", "of", "access", "key", "is" and "123456", where "123456" has been marked as important data, so it is removed from the data word segmentation; the stop word library adopts the existing stop word library, and through search and comparison, it is found that "of" and "is" both exist in the stop word library, so "of" and "is" are marked as stop words and removed, and the remaining "system", "access" and "key" are marked as stop words. "Key" is marked as a word to be identified. In order to facilitate the specific example of the analysis process in this embodiment, the number of characters in the data to be stored in this embodiment is very small. However, in the data storage service based on the cloud platform database, the data uploaded by the tenant each time is usually large, otherwise there is no need to use the cloud platform storage. Only 3 words to be identified are listed in this embodiment to reduce the amount of data in this embodiment. The actual text uploaded this time far exceeds the data to be stored. In order to avoid the complication of the interpretation process in this embodiment due to too much data, the text uploaded this time is not fully displayed in this embodiment, and only the number of submitted words is listed to help the implementation of subsequent analysis steps. The number of submitted words in this embodiment is 320;

[0075] The same to-be-recognized segmented words are integrated into one to-be-recognized word, the number of occurrences of different to-be-recognized words is counted, marked as the number of word submissions, and the ratio of the number of word submissions to the number of submitted words is counted, named as the submitted word frequency;

[0076] Count the number of words to be identified in the target database, named as the total number of words, count the number of words to be identified in the target database, named as the total number of words, and count the ratio of the total number of words to the total number of words, marked as the total word frequency;

[0077] In actual applications, "system", "access" and "key" are each a word to be identified. The number of word submissions for "system" is 26, the number of word submissions for "access" is 8, and the number of word submissions for "key" is 2. The word frequencies of "system", "access" and "key" are 0.08125, 0.02500 and 0.00625, respectively, and the calculation results are retained to 5 decimal places; the total number of words is 567328, and the number of times the word "system" to be identified in the target database appears is 4821, that is, the total number of words for "system" is 4821, and the total number of words for "access" is 263, and the total number of words for "key" is 46; the total word frequencies of "system", "access" and "key" are calculated to be 0.0084977, 0.0004636 and 0.0000405, respectively, and the calculation results are retained to 7 decimal places;

[0078] See also Figure 2 As shown, a rectangular coordinate system is established with the words to be recognized as the X-axis and the submitted word frequency as the Y-axis, named as the submission analysis chart, and the words to be recognized and the corresponding submitted word frequency are entered into the submission analysis chart;

[0079] See also Figure 3 As shown, a rectangular coordinate system is established with the words to be recognized as the horizontal axis and the total word frequency as the vertical axis, named as the total analysis chart, and the words to be recognized and the total word frequency are entered into the total analysis chart;

[0080] In practical applications, submit analysis diagrams such as Figure 2 As shown, the overall analysis diagram is as follows Figure 3 As shown, since only the data on the Y-axis and the vertical axis are considered in the subsequent analysis, the positions of different words to be recognized in the X-axis and the horizontal axis are not considered. For the convenience of viewing, different coordinate points can be located on the same X, and one coordinate point represents one word to be recognized. The X-axis and the horizontal axis have no actual meaning;

[0081] The important data determination unit is used to analyze the submitted analysis graph and the total analysis graph to determine whether the words to be identified are important data;

[0082] The important data determination unit is configured with an important data determination strategy, which includes:

[0083] Obtain any stop participle, mark it as a first participle, mark the ratio of the number of times the first participle appears in the data to be stored to the number of stop participles in the data to be stored as a first ratio; mark the ratio of the number of times the first participle appears in the target database to the number of stop participles in the target database as a second ratio;

[0084] Calculate the average value of the first proportion and name it the submission threshold; calculate the average value of the second proportion and name it the total threshold;

[0085] In practical applications, taking the stop word "的" as an example, it is statistically obtained that the first proportion of "的" in the stop words of the data to be stored is 0.0625, and the second proportion of "的" in the stop words of the target database is 0.0485. The first proportions and the second proportions of all stop words are statistically obtained to get several first proportions and second proportions, and the submission threshold is calculated to be 0.035, and the total threshold is 0.045;

[0086] Name the coordinate systems in the submission analysis graph and the total analysis graph as the submission coordinate points and the total coordinate points respectively;

[0087] For the submission analysis graph, set the first threshold, obtain the number of submission coordinate points where Y is in the range [0, the first threshold], name it the first quantity, calculate the first quantity divided by the first threshold, mark the calculation result as the first density. The first threshold is initially 0, gradually increase the first threshold and calculate the first density until the first threshold is equal to the submission threshold and then stop increasing;

[0088] For the total analysis graph, set the second threshold, obtain the number of total coordinate points where Y is in the range [0, the second threshold], name it the second quantity, calculate the second quantity divided by the second threshold, mark the calculation result as the second density. The second threshold is initially 0, gradually increase the second threshold and calculate the second density until the second threshold is equal to the total threshold and then stop increasing;

[0089] In practical applications, when the first threshold is equal to 0.002, that is, obtain the number of submission coordinate points where the submission word frequency is greater than or equal to 0 and less than or equal to 0.002, and the first quantity is 12. Calculate 12 / 0.002 to get the first density of 6000. Keep statistically calculating the first density up to [0, 0.035] in the above way to get several first densities; similarly analyze and calculate to get several second densities;

[0090] Find the minimum value among the non-zero first densities, and mark the corresponding first threshold as the submission encryption threshold; find the minimum value among the non-zero second densities, and mark the corresponding second threshold as the total encryption threshold;

[0091] Mark the words to be recognized with a submission word frequency less than or equal to the submission encryption threshold and a total word frequency less than or equal to the total encryption threshold as important data, and mark the remaining words to be recognized as ordinary data;

[0092] In actual applications, the first density and the second density that are equal to zero are eliminated, and then the minimum value in the first density and the minimum value in the second density are found, and the submission encryption threshold is obtained to be 0.03, and the total encryption threshold is 0.001; by comparison, it is obtained that the submission word frequency of "access" and "key" is less than the submission encryption threshold, and the total word frequency of "access" and "key" is less than the total encryption threshold, so "access" and "key" are marked as important data, and "system" is ordinary data. There are still many words to be recognized in the data to be stored submitted this time, but in order to make the example of this embodiment concise and easy to understand, the remaining words to be recognized are no longer specifically displayed in this embodiment.

[0093] The data encryption module is used to encrypt important data and obtain encrypted data after encryption;

[0094] The data encryption module is configured with a data encryption strategy, which includes:

[0095] Use the user ID as the encryption key;

[0096] Based on the encryption key, AES is performed on the important data to obtain encrypted data;

[0097] In actual applications, the user identification ID is "100101", that is, 100101 is used as the encryption key. AES encryption adopts the existing AES encryption technology. The important data at this time includes "access", "key" and "123456". Different important data are encrypted respectively, and the encrypted data obtained are "U2FsdGVkX1+zK14hbulU9yAmZNkt3lNzjXvYSRHkcbQ=", "U2FsdGVkX18dvP2AyG5ddsop4P+WXJXhgrqOBUFOVpc=" and "U2FsdGVkX18+dtjS794zFZRSZTOvLDqYnHBFQOeujvY=".

[0098] The data storage module is used to store the tenant's common data and encrypted data. When the tenant reads the data, the encrypted data is decrypted and returned to the tenant;

[0099] The data storage module is configured with a data storage strategy, which includes:

[0100] Replace the important data in the data to be stored with the corresponding encrypted data, and do not encrypt and replace the common data, to obtain the string to be stored;

[0101] Store the character string to be stored in the target database;

[0102] When sending a read request, the tenant carries the user ID, uses the user ID as the decryption key to perform AES decryption on the data, and sends the decrypted data to the tenant;

[0103] In actual applications, the data to be stored is "the system access key is 123456". The important data is replaced with the encrypted data to obtain the string to be stored as "the system's U2FsdGVkX1+zK14hbulU9yAmZNkt3lNzjXvYSRHkcbQ=U2FsdGVkX18dvP2AyG5ddsop4P+WXJXhgrqOBUFOVpc=isU2FsdGVkX18+dtjS794zFZRSZTOvLDq YnHBFQOeujvY=", store the string to be stored in the target database. When the tenant wants to read the data, the read request carries the user identification ID, and the user identification ID is used as the decryption key. For example, if the tenant wants to read the data, the user identification ID sent is 100101, and 100101 is used as the decryption key. Then, the data is decrypted by AES. The encrypted data is divided into multiple decrypted data according to =, and then the decrypted data is decrypted by AES. Finally, the data stored by the tenant is obtained and sent to the tenant.

[0104] Example 2, please refer to Figure 4 As shown, in the second aspect, the present application provides a multi-tenant data processing method based on a cloud platform database, comprising the following steps:

[0105] Step S1, receiving a data request sent by a tenant; the data request includes a user ID and data to be stored;

[0106] Step S2, verifying the tenant's identity information and assigning the data request to the corresponding database; Step S2 includes the following sub-steps:

[0107] Step S201, obtaining a user ID;

[0108] Step S202, read the tenant ID database, and check whether the user identification ID exists in the tenant ID database. If so, output a tenant existence signal; if not, output a tenant non-existence signal;

[0109] Step S203: if the output tenant exists signal, the data to be stored is allocated to the database corresponding to the user identification ID, and the database corresponding to the user identification ID is marked as the target database; if the output tenant does not exist signal, the tenant information that has not been queried is returned to the tenant;

[0110] Step S3, performing content recognition on the data request to identify common data and important data in the data request; Step S3 includes the following sub-steps:

[0111] Step S301, preprocessing the data to be stored in the data request to obtain a submitted analysis graph and a total analysis graph;

[0112] Step S301 includes the following sub-steps:

[0113] Step S3011, marking all the consecutive numbers in the data to be stored as important data, where a group of consecutive numbers is one important data;

[0114] Step S3012, performing word segmentation processing on the data to be stored by Jieba word segmentation to obtain data word segmentation;

[0115] Step S3013, compare the data segmentation with the stop word library, mark the data segmentation in the stop word library as stop word and remove it, mark the remaining data segmentation as to-be-recognized segmentation, and name the number of to-be-recognized segmentation as the number of submitted words;

[0116] Step S3014, integrating the same to-be-recognized segmented words into one to-be-recognized word, counting the number of times different to-be-recognized words appear, marking it as the number of word submissions, and counting the ratio of the number of word submissions to the number of submitted words, named as the submitted word frequency;

[0117] Step S3015, counting the number of to-be-recognized segmented words in the target database, named as the total segmented word count, counting the number of to-be-recognized words in the target database, named as the total number of words, and counting the ratio of the total number of words to the total number of segmented words, marked as the total word frequency;

[0118] Step S3016, establish a rectangular coordinate system with the words to be recognized as the X-axis and the submitted word frequency as the Y-axis, named as the submitted analysis graph, and enter the words to be recognized and the corresponding submitted word frequency into the submitted analysis graph;

[0119] Step S3017, establishing a rectangular coordinate system with the words to be recognized as the horizontal axis and the total word frequency as the vertical axis, named as the total analysis graph, and entering the words to be recognized and the total word frequency into the total analysis graph;

[0120] Step S302, analyzing the submitted analysis graph and the total analysis graph to determine whether the words to be identified are important data;

[0121] Step S302 includes the following sub-steps:

[0122] Step S3021, obtaining any stop participle, marking it as a first participle, marking the ratio of the number of times the first participle appears in the data to be stored to the number of stop participles in the data to be stored as a first ratio; marking the ratio of the number of times the first participle appears in the target database to the number of stop participles in the target database as a second ratio;

[0123] Step S3022, calculating the average value of the first proportion, named as the submission threshold; calculating the average value of the second proportion, named as the total threshold;

[0124] Step S3023, naming the coordinate systems in the submitted analysis diagram and the total analysis diagram as submitted coordinate points and total coordinate points respectively;

[0125] Step S3024, for the submitted analysis graph, set a first threshold, obtain the number of submitted coordinate points whose Y is in the range [0, first threshold], name it as the first number, calculate the first number divided by the first threshold, mark the calculation result as the first density, the first threshold is initially 0, gradually increase the first threshold and calculate the first density, and stop increasing when the first threshold is equal to the submitted threshold;

[0126] Step S3025, for the total analysis graph, set a second threshold, obtain the total number of coordinate points whose Y is in the range [0, second threshold], name it as the second number, calculate the second number and divide it by the second threshold, mark the calculation result as the second density, the second threshold is initially 0, gradually increase the second threshold and calculate the second density, and stop increasing when the second threshold is equal to the total threshold;

[0127] Step S3026, finding the minimum value in the non-zero first density, marking the corresponding first threshold as the encryption submission threshold; finding the minimum value in the non-zero second density, marking the corresponding second threshold as the total encryption threshold;

[0128] Step S3027, marking the words to be recognized whose submitted word frequency is less than or equal to the submitted encryption threshold and whose total word frequency is less than or equal to the total encryption threshold as important data, and marking the rest of the words to be recognized as ordinary data;

[0129] Step S4, encrypting the important data to obtain encrypted data; Step S4 includes the following sub-steps:

[0130] Step S401, using the user ID as an encryption key;

[0131] Step S402, performing AES encryption on the important data based on the encryption key to obtain encrypted data;

[0132] Step S5, storing the tenant's common data and encrypted data, and decrypting the encrypted data when the tenant reads the data and returning it to the tenant; Step S5 includes the following sub-steps:

[0133] Step S501, replacing important data in the data to be stored with corresponding encrypted data, and not performing encryption replacement on common data, to obtain a character string to be stored;

[0134] Step S502, storing the character string to be stored in the target database;

[0135] Step S503: When the tenant sends a read request, the tenant carries the user identification ID, uses the user identification ID as a decryption key to perform AES decryption on the data, and sends the decrypted data to the tenant.

[0136] Embodiment 3, in the third aspect, the present application provides an electronic device, including a processor and a memory, the memory storing computer-readable instructions, and when the computer-readable instructions are executed by the processor, the steps in the above method are executed. Through the above technical solution, the processor and the memory are interconnected and communicate with each other through a communication bus and / or other forms of connection mechanisms, and the memory stores a computer program executable by the processor. When the electronic device is running, the processor executes the computer program to execute the method in any optional implementation of the above embodiment to achieve the following functions: receiving a data request sent by a tenant; verifying the tenant's identity information, and assigning the data request to the corresponding database; performing content identification on the data request, identifying the ordinary data and important data in the data request; encrypting the important data, and obtaining encrypted data after encryption; storing the tenant's ordinary data and encrypted data, and decrypting the encrypted data when the tenant reads the data and returning it to the tenant.

[0137] Embodiment 4, the present application provides a storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps in the above method are executed. Through the above technical solution, when the computer program is executed by the processor, the method in any optional implementation of the above embodiment is executed to achieve the following functions: receiving a data request sent by a tenant; verifying the tenant's identity information, and assigning the data request to the corresponding database; performing content identification on the data request, identifying the ordinary data and important data in the data request; encrypting the important data, and obtaining encrypted data after encryption; storing the tenant's ordinary data and encrypted data, and decrypting the encrypted data and returning it to the tenant when the tenant reads the data.

[0138] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0139] It should be understood by those skilled in the art that the embodiments of the present invention may be provided as methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware aspects. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program codes. Among them, the storage medium may be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read Only Memory, referred to as EPROM), programmable read-only memory (Programmable Read-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic memory, flash memory, magnetic disk or optical disk. These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0140] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

Claims

1. A multi-tenant data processing method based on a cloud platform database, characterized in that: The steps include: Receive data requests sent by tenants; Verify the tenant's identity information and assign data requests to the corresponding database; Perform content recognition on data requests to identify common data and important data in data requests; Content identification of data requests and identification of common data and important data in data requests include the following sub-steps: Perform data preprocessing on the data to be stored in the data request to obtain a submitted analysis chart and a total analysis chart; Analyze the submitted analysis chart and the total analysis chart to determine whether the words to be identified are important data; The data preprocessing for the data to be stored in the data request includes the following sub-steps: Mark all the consecutive numbers in the data to be stored as important data, and a group of consecutive numbers is one important data; Use Jieba word segmentation to segment the stored data and obtain data segmentation; Compare the data segmentation with the stop word library, mark the data segmentation in the stop word library as stop word and remove them, mark the remaining data segmentation as to-be-recognized segmentation, and name the number of to-be-recognized segmentation as the number of submitted words; The same to-be-recognized segmented words are integrated into one to-be-recognized word, the number of occurrences of different to-be-recognized words is counted, marked as the number of word submissions, and the ratio of the number of word submissions to the number of submitted words is counted, named as the submitted word frequency; Count the number of words to be identified in the target database, named as the total number of words, count the number of words to be identified in the target database, named as the total number of words, and count the ratio of the total number of words to the total number of words, marked as the total word frequency; A rectangular coordinate system is established with the words to be recognized as the X-axis and the submitted word frequency as the Y-axis, named as the submission analysis chart, and the words to be recognized and the corresponding submitted word frequency are entered into the submission analysis chart; A rectangular coordinate system is established with the words to be recognized as the horizontal axis and the total word frequency as the vertical axis, named as the total analysis chart, and the words to be recognized and the total word frequency are entered into the total analysis chart; The analysis of the submitted analysis chart and the overall analysis chart includes the following sub-steps: Obtain any stop participle, mark it as a first participle, and mark the ratio of the number of times the first participle appears in the data to be stored to the number of stop participles in the data to be stored as a first ratio; The ratio of the number of times the first participle appears in the target database to the number of stopped participles in the target database is marked as a second ratio; Calculate the average value of the first proportion and name it as submission threshold; Calculate the average value of the second proportion and name it as the total threshold; Name the coordinate systems in the submitted analysis diagram and the total analysis diagram as submitted coordinate points and total coordinate points respectively; For the submitted analysis graph, a first threshold is set, the number of submitted coordinate points whose Y is in the range [0, first threshold] is obtained, which is named the first number, the first number is divided by the first threshold, and the calculation result is marked as the first density. The first threshold is initially 0, and the first threshold is gradually increased and the first density is calculated until the first threshold is equal to the submitted threshold and the increase stops; For the total analysis graph, set the second threshold, obtain the total number of coordinate points whose Y is in the range [0, second threshold], named as the second number, calculate the second number and divide the second threshold, mark the calculation result as the second density, the second threshold is initially 0, gradually increase the second threshold and calculate the second density, and stop increasing when the second threshold is equal to the total threshold; Find the minimum value in the non-zero first density, and mark the corresponding first threshold as the submission encryption threshold; Find the minimum value among the non-zero second densities, and mark the corresponding second threshold as the total encryption threshold; The words to be identified whose submitted word frequency is less than or equal to the submitted encryption threshold and whose total word frequency is less than or equal to the total encryption threshold are marked as important data, and the rest of the words to be identified are marked as ordinary data; Encrypt important data to obtain encrypted data; The tenant's normal data and encrypted data are stored, and when the tenant reads the data, the encrypted data is decrypted and returned to the tenant.

2. The multi-tenant data processing method based on the cloud platform database according to claim 1 is characterized in that: The data request includes a user identification ID and data to be stored.

3. The multi-tenant data processing method based on the cloud platform database according to claim 2 is characterized in that: Verifying the tenant's identity information and assigning the data request to the corresponding database includes the following sub-steps: Get the user ID; Read the tenant ID database and check whether the user ID exists in the tenant ID database. If so, output a tenant existence signal; if not, output a tenant non-existence signal; If the output tenant has a signal, the data to be stored is allocated to the database corresponding to the user identification ID, and the database corresponding to the user identification ID is marked as the target database; If the output tenant does not exist signal, the tenant information that was not found is returned to the tenant.

4. The multi-tenant data processing method based on the cloud platform database according to claim 3 is characterized in that: The important data is encrypted and the encrypted data is obtained by the following sub-steps: Use the user ID as the encryption key; Based on the encryption key, AES is performed on important data to obtain encrypted data.

5. The multi-tenant data processing method based on the cloud platform database according to claim 4 is characterized in that: Storing the tenant's ordinary data and encrypted data, decrypting the encrypted data when the tenant reads the data and returning it to the tenant includes the following sub-steps: Replace the important data in the data to be stored with the corresponding encrypted data, and do not encrypt and replace the common data, to obtain the string to be stored; Store the character string to be stored in the target database; When the tenant sends a read request, it carries the user identification ID, uses the user identification ID as the decryption key to perform AES decryption on the data, and sends the decrypted data to the tenant.

6. A multi-tenant data processing system based on a cloud platform database, used to implement the multi-tenant data processing method based on a cloud platform database according to any one of claims 1 to 5, characterized in that: It includes a request receiving module, an identity authentication module, a content identification module, a data encryption module and a data storage module; the request receiving module, the identity authentication module, the content identification module and the data storage module are respectively connected to the data encryption module; The request receiving module is used to receive a data request sent by a tenant; The identity authentication module is used to verify the tenant's identity information and distribute the data request to the corresponding database; The content identification module is used to perform content identification on the data request, and identify common data and important data in the data request; The data encryption module is used to encrypt important data to obtain encrypted data; The data storage module is used to store the tenant's common data and encrypted data, and to decrypt the encrypted data and return it to the tenant when the tenant reads the data.

7. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are executed.

Images