Access control method and device for multi-tenant database, server and storage medium

Abstract

The invention relates to the field of data processing, and discloses an access control method and device for a multi-tenant database, a server and a storage medium. The method comprises the steps that when an SQL request is detected, the SQL request is intercepted, and an original table name carried by the SQL request is analyzed; if it is judged that the SQL request needs to access the multi-tenant database according to the original table name, tenant information corresponding to the SQL request is obtained; and according to the tenant information, executing a dynamic SQL splicing operation on the SQL request to obtain a target SQL request, and executing the target SQL request. In the embodiment of the invention, the access control strategy of the multi-tenant database has wide adaptability and compatibility, does not depend on specific database middleware, can be easily integrated into various database environments, and greatly simplifies configuration and maintenance work.

Description

Technical Field

[0001] The present invention relates to the field of data processing, and in particular to an access control method, device, server and storage medium for a multi-tenant database. Background Art

[0002] In a multi-tenant database system, multiple tenants share the same database instance, but data must be isolated from each other to ensure security and privacy. Traditional multi-tenant systems often achieve data isolation through static table names or different database instances.

[0003] MyCat, ShardingSphere, Vitess and Cobar are popular database middlewares, each with its own advantages, but all require complex configuration and are difficult to maintain. Summary of the invention

[0004] The main purpose of the present invention is to solve the technical problem that MyCat, ShardingSphere, Vitess and Cobar are popular database middlewares, each with its own advantages, but all require complex configuration and are difficult to maintain.

[0005] A first aspect of the present invention provides an access control method for a multi-tenant database, the access control method for a multi-tenant database comprising: When a SQL request is detected, the SQL request is intercepted, and the original table name carried in the SQL request is parsed; If it is determined according to the original table name that the SQL request is to access a multi-tenant database, then acquiring tenant information corresponding to the SQL request; According to the tenant information, a dynamic SQL concatenation operation is performed on the SQL request to obtain a target SQL request, and the target SQL request is executed.

[0006] Optionally, in a first implementation of the first aspect of the present invention, the step of performing a dynamic SQL concatenation operation on the SQL request according to the tenant information and the original table name to obtain a target SQL request includes: Obtain the database suffix corresponding to the tenant information; According to the database suffix, a dynamic SQL concatenation operation is performed on the SQL request to obtain a target SQL request.

[0007] Optionally, in a second implementation of the first aspect of the present invention, the step of performing a dynamic SQL concatenation operation on the SQL request according to the database suffix to obtain a target SQL request includes: Remove the escape character of the original table name of the SQL request to obtain the SQL request to be processed; According to the database suffix, a dynamic SQL concatenation operation is performed on the SQL request to obtain a target SQL request.

[0008] Optionally, in a third implementation manner of the first aspect of the present invention, if it is determined according to the original table name that the SQL request is to access a multi-tenant database, before the step of obtaining tenant information corresponding to the SQL request, the method further includes: Get the target BeanDefinition object information corresponding to the original table name; According to the target annotation information associated with the target BeanDefinition object information, it is determined whether the SQL request accesses the multi-tenant database.

[0009] Optionally, in a fourth implementation manner of the first aspect of the present invention, when the SQL request is detected, before the step of intercepting the SQL request, the method further includes: Get a collection of BeanDefinition objects; Filter out a sub-collection of BeanDefinition objects containing custom annotation information from the BeanDefinition object collection; The BeanDefinition object information of the BeanDefinition object subset and the custom annotation information are associated and saved in a key-value pair manner.

[0010] Optionally, in a fifth implementation manner of the first aspect of the present invention, after the step of executing the target SQL request, the method further includes: In a backup manner, a table partitioning operation is periodically performed on the multi-tenant database.

[0011] Optionally, in a sixth implementation of the first aspect of the present invention, after the step of intercepting the SQL request when the SQL request is detected and parsing the original table name carried by the SQL request, the method further includes: If it is determined according to the original table name that the SQL request does not access the multi-tenant database, the SQL request is executed.

[0012] A second aspect of the present invention provides an access control device for a multi-tenant database, comprising a memory and a processor, wherein the processor is used to execute program instructions stored in the memory so that the access control device for the multi-tenant database executes the above-mentioned access control method for the multi-tenant database.

[0013] A third aspect of the present invention provides a server, characterized in that it includes a memory and a processor, and the processor is used to execute program instructions stored in the memory so that the server executes the above-mentioned access control method for the multi-tenant database.

[0014] A fourth aspect of the present invention provides a computer-readable storage medium, in which instructions are stored, and when the computer-readable storage medium is run on a computer, the computer executes the above-mentioned access control method for a multi-tenant database.

[0015] In an embodiment of the present invention, when a SQL request is detected, the SQL request is intercepted, and the original table name carried by the SQL request is parsed; if it is determined based on the original table name that the SQL request is to access a multi-tenant database, the tenant information corresponding to the SQL request is obtained; based on the tenant information, a dynamic SQL splicing operation is performed on the SQL request to obtain a target SQL request, and the target SQL request is executed. Through dynamic SQL splicing technology, SQL requests are dynamically constructed based on tenant information, which not only flexibly responds to increases and decreases in the number of tenants, but also gets rid of the constraints of static table names or fixed database instances. Performance is significantly improved without adding additional resource burdens. At the same time, the access control strategy of the multi-tenant database has wide adaptability and compatibility, does not rely on specific database middleware, can be easily integrated into a variety of database environments, and greatly simplifies configuration and maintenance work. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A schematic diagram of an embodiment of a method for controlling access to a multi-tenant database in an embodiment of the present invention; Figure 2 A schematic diagram of a specific embodiment of step 103 of the control method for non-invasive acupuncture in an embodiment of the present invention; Figure 3 A schematic diagram of a specific embodiment of step 1032 of the method for controlling non-invasive acupuncture in an embodiment of the present invention; Figure 4 A schematic diagram of an embodiment of an access control device for a multi-tenant database in an embodiment of the present invention; Figure 5 FIG. 1 is a schematic diagram of an embodiment of a server in an embodiment of the present invention. DETAILED DESCRIPTION

[0017] Embodiments of the present invention provide a method, device, server and storage medium for access control of a multi-tenant database.

[0018] The embodiments disclosed in the present invention will be described in more detail below with reference to the accompanying drawings. Although certain embodiments disclosed in the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present invention. It should be understood that the drawings and embodiments disclosed in the present invention are only for exemplary purposes and are not intended to limit the scope of protection disclosed in the present invention.

[0019] In the description of the embodiments disclosed in the present invention, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The terms "first", "second", etc. may refer to different or the same objects. Other explicit and implicit definitions may also be included below.

[0020] The terms involved in the access control method of a multi-tenant database include but are not limited to: Multi-tenant database: A database architecture that allows multiple tenants (that is, different users or organizations) to share the same physical instance of the database, but each tenant's data is logically isolated.

[0021] SQL request: Structured Query Language (SQL) is a standard programming language used to manage and operate relational databases. SQL request refers to a request to query, update, insert or delete a database using SQL statements.

[0022] Dynamic SQL concatenation: The process of dynamically building SQL statements at runtime based on program logic or user input. Allows the program to generate different SQL statements based on different conditions.

[0023] BeanDefinition object: In a Java application based on the Spring framework, the BeanDefinition object contains definition information about a bean, such as its class, scope, dependencies, etc. This is the core of the Spring IoC container-managed bean.

[0024] Custom annotations: Java annotations are metadata used for class, method, parameter, variable, constructor and package declarations, while custom annotations are annotations defined by developers based on their needs. They can be used in code analysis, compilation checking, runtime processing and other scenarios.

[0025] Key-value pair: A data structure in which each element is a pair consisting of a "key" and a "value". The key is used to uniquely identify the element, and the value is the data associated with the key.

[0026] Table sharding: Distribute the data of a large table into multiple smaller, physically independent tables to improve query efficiency and manageability. In a multi-tenant architecture, it is used to achieve data isolation.

[0027] Interception: Pauses processing at a point in the request flow to perform additional actions (such as security checks, logging, etc.) before continuing to process the original request.

[0028] For ease of understanding, the specific process of the embodiment of the present invention is described below. Figure 1 , an embodiment of the access control method of a multi-tenant database in an embodiment of the present invention includes: 101. When an SQL request is detected, the SQL request is intercepted, and an original table name carried in the SQL request is parsed; Specifically, in the configuration of MybatisPlus, register a custom interceptor MybatisPlusInterceptor or inherit from the interceptor base class provided by Mybatis Plus.

[0029] In the intercept method of the interceptor, the SQL request to be executed is intercepted.

[0030] Use JSqlParser or a similar SQL parsing library to perform syntax analysis on the intercepted SQL statement. Analyze the components of the SQL statement to locate and extract the original table name.

[0031] 102. If it is determined according to the original table name that the SQL request is to access a multi-tenant database, tenant information corresponding to the SQL request is obtained; Specifically, after parsing the table name, the interceptor determines whether the SQL request intends to access the multi-tenant database. After determining that the SQL request intends to access the multi-tenant database, the interceptor obtains the tenant information associated with the request. This can be done by checking the current session, request header, thread local variables, or other context information. The tenant information contains an identifier that can determine the tenant's identity (such as a tenant ID or tenant code).

[0032] Optionally, in a backup manner, a table partitioning operation is periodically performed on the multi-tenant database. The generation and maintenance of the multi-tenant database includes: 1. Database partitioning solution: The sharding scheme for a multi-tenant database is controlled by configuration parameters to meet the requirements of different scales and multi-tenant isolation levels: Non-database mode (configuration parameter is -1): All tenant data is stored in the same database.

[0033] Independent database mode (configuration parameter is 0): Each tenant has its own independent database.

[0034] Shared database mode (configuration parameters are 1-n): Multiple tenants share a database, but the data table of each tenant is isolated through the tenant code field to reduce the number of database instances.

[0035] 2. Table division scheme: The table partitioning solution adopts a backup strategy to back up the data that meets the conditions to an independent backup table according to preset rules (such as time, data volume, etc.). The main query process is still performed through the original table to improve query efficiency and ensure data security.

[0036] 3. Database creation plan: When creating a new tenant, the database is automatically created according to the sub-library mode, as follows: Independent database mode: Create a new database instance with the tenant code as the suffix, and use custom DDL scripts to create the tenant's data tables and initialize data.

[0037] Shared database mode: First, the database suffix is ​​calculated through the consistent hash algorithm to determine whether the corresponding database instance exists. If not, it is created, and the custom DDL is called to create data tables and initialize data for tenants. After all operations are completed, the relationship information between the tenant and the database is persistently stored.

[0038] 4. Data table backup plan: The data table backup is performed as a scheduled task, which is implemented through scheduled task management tools such as xxl-job: Time backup strategy: According to the configured time rules, calculate the target time point that needs to be backed up, query and back up the data at that time point to the backup table, and choose to delete or retain the original table data.

[0039] Quantity backup strategy: Based on the preset data volume threshold, query and back up the data that reaches or exceeds the threshold to the backup table.

[0040] The generation and maintenance of multi-tenant databases achieves efficient and secure multi-tenant data isolation and management, providing a reliable data storage solution for business scenarios of different scales.

[0041] 103. Perform a dynamic SQL concatenation operation on the SQL request according to the tenant information to obtain a target SQL request, and execute the target SQL request.

[0042] Specifically, a new table name (for example, original_table_name_tenant_id) is constructed based on the extracted tenant information and the original table name. The table name in the original SQL request is modified to the newly constructed table name. If required by the database sharding strategy, the database name can be modified dynamically.

[0043] Use tools such as string replacement or template engines to build new SQL statements. Pass the modified SQL statements to the database executor for execution. Process the execution results and return the results to the requester.

[0044] Optionally, if it is determined according to the original table name that the SQL request does not access the multi-tenant database, the SQL request is executed. By directly executing the SQL request of the non-multi-tenant database, unnecessary processing steps such as interception, parsing, and dynamic SQL splicing are avoided. For SQL requests that do not require multi-tenant database access control, they can be directly identified and quickly processed without going through a complex access control process, which simplifies the processing process and reduces the complexity of the system.

[0045] In an embodiment of the present invention, when a SQL request is detected, the SQL request is intercepted, and the original table name carried by the SQL request is parsed; if it is determined based on the original table name that the SQL request is to access a multi-tenant database, the tenant information corresponding to the SQL request is obtained; based on the tenant information, a dynamic SQL splicing operation is performed on the SQL request to obtain a target SQL request, and the target SQL request is executed. Through dynamic SQL splicing technology, SQL requests are dynamically constructed based on tenant information, which not only flexibly responds to increases and decreases in the number of tenants, but also gets rid of the constraints of static table names or fixed database instances. Performance is significantly improved without adding additional resource burdens. At the same time, the access control strategy of the multi-tenant database has wide adaptability and compatibility, does not rely on specific database middleware, can be easily integrated into a variety of database environments, and greatly simplifies configuration and maintenance work.

[0046] In traditional database access control methods, static table names or database names are often used to distinguish data from different tenants. If all tenants use the same table name or database name, it is difficult to technically achieve effective isolation between different tenant data. This may increase the risk of data confusion and misoperation. Static table names or database names limit the system's support for different tenant data organization methods. When it is necessary to adjust the tenant data organization method, a lot of code modification and database migration work is required. In order to solve these problems, the present invention proposes an optional embodiment.

[0047] Optional, see Figure 2 , Figure 2This is a schematic diagram of a specific embodiment of step 103 of the control method for non-invasive acupuncture in an embodiment of the present invention. Step 103 also includes the following specific implementation methods: 1031. Obtain a database suffix corresponding to the tenant information; Specifically, when a SQL request is detected and it is determined that the request needs to access a multi-tenant database, tenant information corresponding to the SQL request is first obtained.

[0048] According to the tenant information, the database suffix associated with the tenant is further obtained. The database suffix is ​​the key to distinguish the data of different tenants.

[0049] 1032. Perform a dynamic SQL concatenation operation on the SQL request according to the database suffix to obtain a target SQL request.

[0050] Specifically, the original SQL request is dynamically spliced ​​according to the acquired database suffix. The splicing process mainly adds the database suffix to the table name or database name in the SQL request, thereby generating a new target SQL request.

[0051] For example, if the original table name is user_table and the database suffix of tenant A is _tenantA, the table name in the concatenated target SQL request may become user_table_tenantA.

[0052] Finally, the system executes the spliced ​​target SQL request to access the data of specific tenants in the multi-tenant database.

[0053] In this optional embodiment, by dynamically adding a tenant-specific database suffix in the SQL request, effective isolation between different tenant data is achieved, avoiding data confusion and misoperation. This optional method allows SQL requests to be dynamically adjusted according to tenant information, thereby supporting a variety of different database architectures and tenant data organization methods, and improving the flexibility and scalability of the system.

[0054] In traditional database access control methods, there is often no clear processing specification or standard for original table names containing special characters. This may lead to a series of problems such as SQL syntax errors, execution errors, etc. due to improper escape character processing during dynamic SQL splicing. These problems not only affect the normal access and processing of data, but also threaten the stability and security of the system. In order to solve these problems, the present invention proposes an optional embodiment.

[0055] Optional, see Figure 3 , Figure 3This is a schematic diagram of a specific embodiment of step 1032 of the control method for non-invasive acupuncture in an embodiment of the present invention. Step 1032 also includes the following specific implementation methods: 10321. Remove the escape character of the original table name of the SQL request to obtain the SQL request to be processed; Specifically, before executing dynamic SQL splicing, the original table name in the SQL request is processed to remove possible escape characters to obtain the changed SQL request to be processed. Because the original table name may use escape characters in the SQL request due to the presence of special characters (such as spaces, quotation marks, etc.), the escape characters may cause syntax errors or execution errors in the SQL statement during the dynamic splicing process.

[0056] 10322. Perform a dynamic SQL concatenation operation on the SQL request according to the database suffix to obtain a target SQL request.

[0057] Specifically, after removing the escape character of the original table name, the SQL request to be processed is dynamically spliced ​​according to the database suffix corresponding to the previously obtained tenant information. The splicing process can add the database suffix to the original table name to generate a new target SQL request.

[0058] For example, if the original table name is user_table and the database suffix of tenant A is _tenantA, the table name in the concatenated target SQL request may become user_table_tenantA.

[0059] Finally, the spliced ​​target SQL request is executed to access the specific tenant data in the multi-tenant database.

[0060] In this optional embodiment, by removing the escape character of the original table name, syntax errors or execution errors caused by the escape character in the dynamic SQL splicing process can be avoided, thereby improving the accuracy of the SQL statement. It can also better handle the original table name containing special characters, and enhance the adaptability to complex SQL requests. By optimizing the processing flow of SQL requests, the additional overhead caused by improper escape character processing is also reduced, thereby improving the overall efficiency of data processing.

[0061] In traditional database access control methods, it is often necessary to specify which SQL requests are for multi-tenant databases by hard coding or configuration files. This method is not only inflexible, but also prone to errors. In order to solve the above technical problems, the present invention proposes an optional embodiment.

[0062] Optionally, the following specific implementations are also included before step 102: 201. Obtain the target BeanDefinition object information corresponding to the original table name; 202. Determine whether the SQL request accesses the multi-tenant database according to the target annotation information associated with the target BeanDefinition object information.

[0063] Specifically, after the SQL request is detected and intercepted, the original table name corresponding to the SQL request is first obtained, and then the target BeanDefinition object information corresponding to the original table name is further obtained.

[0064] Subsequently, according to the target annotation information associated with the BeanDefinition object information, it is possible to determine whether the SQL request is intended to access the multi-tenant database. This step is implemented based on the BeanDefinition mechanism in the Java Spring framework, which can flexibly identify database access requests by parsing the annotation information.

[0065] In this optional embodiment, by directly associating BeanDefinition and annotation information, it is possible to more accurately identify which SQL requests are for the multi-tenant database, thereby avoiding unnecessary misjudgments. The use of annotations makes system configuration more flexible, and developers can easily change system behavior by adding or modifying annotations without modifying the underlying code. Due to the use of annotations and BeanDefinition, maintenance becomes simpler and more intuitive, reducing potential problems introduced by code changes.

[0066] In traditional database access control methods, traditional static configuration methods can no longer meet actual needs. Dynamic configuration and flexible expansion have become important trends in modern software development. The reflection mechanism and annotation processing capabilities of the Java Spring framework provide strong support for this trend. By applying these technologies to access control of multi-tenant databases, more flexible and efficient configuration management can be achieved. Based on the above mechanism, the present invention proposes an optional embodiment.

[0067] Optionally, the following specific implementations are also included before step 101: 203. Obtain the target BeanDefinition object information corresponding to the original table name; 204. Determine whether the SQL request accesses the multi-tenant database according to the target annotation information associated with the target BeanDefinition object information.

[0068] Specifically, before detecting the SQL request, the entire BeanDefinition object collection is obtained first, and the BeanDefinition object subcollection containing custom annotation information is filtered out from this collection.

[0069] Then, the BeanDefinition object information and the corresponding custom annotation information are associated and saved as key-value pairs for subsequent use.

[0070] The implementation of the above steps is based on the Java reflection mechanism and the annotation processing capability of the Spring framework.

[0071] In this optional embodiment, by filtering and saving the BeanDefinition object information containing custom annotations in advance, the relevant configuration information can be located more quickly when processing SQL requests, thereby improving processing efficiency. Since only BeanDefinition objects containing custom annotations are processed, the system can save a lot of unnecessary resource consumption, especially when processing a large number of BeanDefinition objects.

[0072] Reference Figure 4, the embodiment of the present disclosure provides an access control device 400 for a multi-tenant database, including an access control device body for a multi-tenant database, and an access control device 405 for a multi-tenant database. The access control device 405 for a multi-tenant database includes a processor 404 and a memory 401 storing program instructions. Optionally, the device may also include a communication interface 402 and a bus 403. Among them, the processor 404, the communication interface 402, and the memory 401 can complete mutual communication through the bus 403. The communication interface 402 can be used for information transmission. The processor 404 can call the program instructions in the memory 401 to execute the access control method for the multi-tenant database of the above embodiment. In addition, the logical instructions in the above-mentioned memory 401 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. The memory 401, as a computer-readable storage medium, can be used to store software programs, computer executable programs, such as program instructions / modules corresponding to the method in the embodiment of the present disclosure. The processor 404 executes the functional application and data processing by running the program instructions / modules stored in the memory 401, that is, the access control method of the multi-tenant database in the above embodiment is implemented. The memory 401 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function; the data storage area may store data created according to the use of the terminal device, etc. In addition, the memory 401 may include a high-speed random access memory and may also include a non-volatile memory.

[0073] Reference Figure 5 , the embodiment of the present disclosure provides a server 500, including a processor (processor) 504 and a memory (memory) 501 storing program instructions. Optionally, the server may also include a communication interface (CommunicationInterface) 502 and a bus 503. Among them, the processor 504, the communication interface 502, and the memory 501 can communicate with each other through the bus 503. The communication interface 502 can be used for information transmission. The processor 504 can call the program instructions in the memory 501 to execute the access control method of the multi-tenant database of the above embodiment.

[0074] In addition, the logic instructions in the above-mentioned memory 501 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. The memory 501, as a computer-readable storage medium, can be used to store software programs, computer executable programs, such as program instructions / modules corresponding to the method in the embodiment of the present disclosure. The processor 504 executes functional applications and data processing by running the program instructions / modules stored in the memory 501, that is, implements the access control method of the multi-tenant database in the above-mentioned embodiment. The memory 501 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function; the data storage area may store data created according to the use of the terminal device, etc. In addition, the memory 501 may include a high-speed random access memory and may also include a non-volatile memory.

[0075] The technical solution of the embodiment of the present disclosure can be embodied in the form of a software product, which is stored in a storage medium and includes one or more instructions for enabling a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in the embodiment of the present disclosure. The aforementioned storage medium may be a non-transient storage medium, including: a USB flash drive, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a disk or an optical disk, and other media that can store program codes, or a transient storage medium.

[0076] The above description and the accompanying drawings fully illustrate the embodiments of the present disclosure so that those skilled in the art can practice them. Other embodiments may include structural, logical, electrical, process and other changes. The embodiments represent only possible changes. Unless explicitly required, separate components and functions are optional, and the order of operations may vary. Parts and features of some embodiments may be included in or replace parts and features of other embodiments. Moreover, the words used in this application are only used to describe the embodiments and are not used to limit the claims. As used in the description of the embodiments and the claims, unless the context clearly indicates, the singular forms of "a", "an" and "the" are intended to include plural forms as well. Similarly, the term "and / or" as used in this application refers to any and all possible combinations of one or more associated listings. In addition, when used in this application, the term "comprise" and its variants "comprises" and / or comprising refer to the presence of stated features, wholes, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or groups thereof. In the absence of further restrictions, the elements defined by the sentence "including one..." do not exclude the presence of other identical elements in the process, method or device including the elements. In this article, each embodiment may focus on the differences from other embodiments, and the same and similar parts between the embodiments may refer to each other. For the methods, products, etc. disclosed in the embodiments, if they correspond to the method part disclosed in the embodiments, then the relevant parts can refer to the description of the method part.

[0077] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software may depend on the specific application and design constraints of the technical solution. The technicians may use different methods for each specific application to implement the described functions, but such implementations should not be considered to exceed the scope of the embodiments of the present disclosure. The technicians may clearly understand that, for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above may refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here.

[0078] In the embodiments disclosed herein, the disclosed methods and products (including but not limited to devices, equipment, etc.) can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units can be only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between each other shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms. The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to implement this embodiment. In addition, each functional unit in the embodiment of the present disclosure may be integrated in a processing unit, or each unit may exist physically alone, or two or more units may be integrated in one unit.

[0079] The flowchart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to the embodiment of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. In some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which can depend on the functions involved. In the description corresponding to the flowchart and the block diagram in the accompanying drawings, the operations or steps corresponding to different boxes can also occur in a different order from the order disclosed in the description, and sometimes there is no specific order between different operations or steps. For example, two consecutive operations or steps can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which can depend on the functions involved. Each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by a dedicated hardware-based system that performs the specified functions or actions, or may be implemented by a combination of dedicated hardware and computer instructions.

Claims

1. A method for access control of a multi-tenant database, characterized in that: The access control method of the multi-tenant database includes: When a SQL request is detected, the SQL request is intercepted, and the original table name carried in the SQL request is parsed; If it is determined according to the original table name that the SQL request is to access a multi-tenant database, then acquiring tenant information corresponding to the SQL request; According to the tenant information, a dynamic SQL concatenation operation is performed on the SQL request to obtain a target SQL request, and the target SQL request is executed.

2. The access control method for a multi-tenant database according to claim 1, characterized in that: The step of performing a dynamic SQL concatenation operation on the SQL request according to the tenant information and the original table name to obtain a target SQL request comprises: Obtain the database suffix corresponding to the tenant information; According to the database suffix, a dynamic SQL concatenation operation is performed on the SQL request to obtain a target SQL request.

3. The access control method for a multi-tenant database according to claim 2, characterized in that: The step of performing a dynamic SQL concatenation operation on the SQL request according to the database suffix to obtain a target SQL request comprises: Remove the escape character of the original table name of the SQL request to obtain the SQL request to be processed; According to the database suffix, a dynamic SQL concatenation operation is performed on the SQL request to obtain a target SQL request.

4. The access control method for a multi-tenant database according to claim 1, characterized in that: If it is determined according to the original table name that the SQL request is to access a multi-tenant database, before the step of obtaining tenant information corresponding to the SQL request, the method further includes: Get the target BeanDefinition object information corresponding to the original table name; According to the target annotation information associated with the target BeanDefinition object information, it is determined whether the SQL request accesses the multi-tenant database.

5. The access control method for a multi-tenant database according to claim 4, characterized in that: When the SQL request is detected, before the step of intercepting the SQL request, the method further includes: Get a collection of BeanDefinition objects; Filter out a sub-collection of BeanDefinition objects containing custom annotation information from the BeanDefinition object collection; The BeanDefinition object information of the BeanDefinition object subset and the custom annotation information are associated and saved in a key-value pair manner.

6. The access control method for a multi-tenant database according to claim 1, characterized in that: After the step of executing the target SQL request, the method further includes: In a backup manner, a table partitioning operation is periodically performed on the multi-tenant database.

7. The access control method for a multi-tenant database according to claim 1, characterized in that: After the steps of intercepting the SQL request when a SQL request is detected and parsing the original table name carried in the SQL request, the method further comprises: If it is determined according to the original table name that the SQL request does not access the multi-tenant database, the SQL request is executed.

8. An access control device for a multi-tenant database, characterized in that: It comprises a memory and a processor, wherein the processor is used to execute program instructions stored in the memory to implement the access control method for a multi-tenant database as claimed in any one of claims 1 to 7.

9. A server, characterized in that: It comprises a memory and a processor, wherein the processor is used to execute program instructions stored in the memory to implement the access control method for a multi-tenant database as claimed in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the access control method for a multi-tenant database according to any one of claims 1 to 7 is implemented.

Images