Multi-tenant management and control method, device and equipment, storage medium and computer program product

Abstract

The invention discloses a multi-tenant management and control method, device and equipment, a storage medium and a computer program product, and the method comprises the steps: enabling an application developed by a developer to be connected to an aPaaS platform, and generating an application ID; when a tenant administrator under the tenant subscribes to the application, binding the application ID with the tenant administrator; a permission strategy is created in a permission center of the aPaaS platform through a tenant administrator based on tenant data and application data, access permissions of applications are distributed to common users under the tenants based on the permission strategy, and the tenant data comprise account information, permission information and group information of all the tenants; when the access instruction is received, if the authority center determines that the user corresponding to the access instruction has the access authority, the user is allowed to access the application, compared with the prior art, the data isolation and access control of the users of different tenants to different applications are realized, and the security and flexibility of an aPaaS platform are further improved.

Description

Technical Field

[0001] The present invention relates to the technical field of user authority management, and in particular to a multi-tenant management and control method, apparatus, equipment, storage medium and computer program product. Background Art

[0002] aPaaS (Application Platform as a Service) is an advanced application form of PaaS (Platform as a Service), which aims to provide users with cloud platform support for developing, deploying and running applications. By providing basic tools such as data management, access control and user interface design, the aPaaS platform significantly reduces the development threshold and cost, while improving the flexibility of application development. However, current aPaaS platforms usually rely on a single or simple two-tier structure in terms of identity management and resource allocation. With the increasing complexity of enterprise-level application requirements, existing systems have been unable to meet the needs of modern enterprises in terms of handling complex relationships between users, tenants and applications and data resource isolation, especially in terms of resource allocation and secure access management in a multi-tenant environment. A more complete solution is urgently needed.

[0003] Therefore, there is an urgent need for a multi-tenant management and control method that can ensure the isolation and control of tenant users and application resources when different applications are accessed on the aPaaS platform, thereby improving the security and flexibility of the aPaaS platform. Summary of the invention

[0004] The main purpose of the present invention is to provide a multi-tenant management method, device, equipment, storage medium and computer program product, aiming to solve the technical problems of low security and flexibility of aPaaS platform in a multi-tenant environment in the prior art.

[0005] To achieve the above object, the present invention provides a multi-tenant management method, which includes the following steps:

[0006] Connect the application developed by the developer to the aPaaS platform and generate an application ID;

[0007] When a tenant administrator under a tenant subscribes to the application, the application ID is bound to the tenant administrator;

[0008] The tenant administrator creates a permission policy based on tenant data and application data in the permission center of the aPaaS platform, and assigns access rights of the application to ordinary users under the tenant based on the permission policy, wherein the tenant data includes account information, permission information and group information of each tenant;

[0009] When receiving the access instruction, if the permission center determines that the user corresponding to the access instruction has access rights, the user is allowed to access the application.

[0010] Optionally, the aPaaS platform divides platform resources into four levels: group level, tenant level, user level and application level;

[0011] The group face is used to represent the group structure within the enterprise and coordinate resource management and scheduling of multiple tenants;

[0012] The tenant plane is used to distinguish different tenants and manage the resources and permissions of the tenants;

[0013] The user plane is used to manage user accounts and permissions under the tenant;

[0014] The application plane is used to distinguish different applications in the enterprise and ensure resource isolation and access control between applications.

[0015] Optionally, before the step of connecting the application developed by the developer to the aPaaS platform and generating an application ID, the step further includes:

[0016] Divide tenants into common users and tenant administrators;

[0017] Setting user levels, and grading the common users and the tenant administrators according to the user levels;

[0018] According to preset configuration rules, access rights and resource configuration are performed on the classified common users and tenant administrators respectively.

[0019] Optionally, the method further includes:

[0020] Based on the group information of each tenant in the tenant data, different tenants are associated with the same group to obtain a data merging result;

[0021] According to the data merging result, the corresponding tenants are accessed by accessing the group to obtain the data of all tenants under the group.

[0022] Optionally, the step of creating a permission policy based on tenant data and application data in the permission center of the aPaaS platform by the tenant administrator, and assigning access rights of the application to ordinary users under the tenant based on the permission policy includes:

[0023] Determine the common user corresponding to the tenant administrator, and allocate corresponding tenant resources to the common user corresponding to the tenant administrator;

[0024] Associating a common user corresponding to the tenant administrator with the application bound to the tenant administrator;

[0025] The tenant administrator creates a permission policy based on tenant data and application data in the permission center of the aPaaS platform;

[0026] Based on the permission policy, the access rights of the application are allocated to the common user corresponding to the tenant administrator, and the corresponding permission level is allocated.

[0027] Optionally, when receiving the access instruction, if the permission center determines that the user corresponding to the access instruction has access rights, the step of allowing the user to access the application includes:

[0028] When receiving an access instruction of the application sent by the user, using the permission center to determine whether the user corresponding to the access instruction has access rights;

[0029] If the user has access rights, the user is allowed to access the application, and the user's application and data are isolated, using a role-based permission approach to ensure access security.

[0030] In addition, to achieve the above object, the present invention also proposes a multi-tenant management and control device, the device comprising:

[0031] An application access module, used to access the application developed by the developer to the aPaaS platform and generate an application ID;

[0032] An application binding module, used to bind the application ID with the tenant administrator when the tenant administrator under the tenant subscribes to the application;

[0033] A permission allocation module, configured to allow the tenant administrator to create a permission policy based on tenant data and application data in the permission center of the aPaaS platform, and to allocate access rights of the application to ordinary users under the tenant based on the permission policy, wherein the tenant data includes the tenant's account information, permission information, and group information;

[0034] The permission determination module is used for, when receiving an access instruction, allowing the user to access the application if the permission center determines that the user corresponding to the access instruction has access rights.

[0035] In addition, to achieve the above-mentioned purpose, the present invention also proposes a multi-tenant management and control device, which includes: a memory, a processor, and a multi-tenant management and control program stored on the memory and executable on the processor, and the multi-tenant management and control program is configured to implement the steps of the multi-tenant management and control method described above.

[0036] In addition, to achieve the above objectives, the present invention also proposes a storage medium, on which a multi-tenant management and control program is stored, and when the multi-tenant management and control program is executed by a processor, the steps of the multi-tenant management and control method described above are implemented.

[0037] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the steps of the multi-tenant management and control method described above.

[0038] The present invention discloses a method of connecting an application developed by a developer to an aPaaS platform and generating an application ID; when a tenant administrator under a tenant subscribes to the application, the application ID is bound to the tenant administrator; the tenant administrator creates a permission policy based on tenant data and application data in the permission center of the aPaaS platform, and assigns access rights of the application to ordinary users under the tenant based on the permission policy, wherein the tenant data includes account information, permission information and group information of each tenant; when an access instruction is received, if the permission center determines that the user corresponding to the access instruction has access rights, the user is allowed to access the application. Since the present invention binds the application ID to the tenant administrator when the tenant administrator under the tenant subscribes to the application, and then creates a permission policy based on tenant data and application data in the permission center of the aPaaS platform by the tenant administrator to assign access rights of the application to ordinary users under the tenant, compared with the prior art, the present invention realizes data isolation and access control of users of different tenants to different applications, thereby improving the security and flexibility of the aPaaS platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 This is a flowchart of the first embodiment of the multi-tenant management and control method of the present invention;

[0040] Figure 2 A schematic diagram of a specific implementation scenario of the multi-tenant management and control method of the present invention;

[0041] Figure 3 This is a flow chart of a second embodiment of a multi-tenant management and control method of the present invention;

[0042] Figure 4 This is a flow chart of a third embodiment of a multi-tenant management and control method of the present invention;

[0043] Figure 5 A schematic diagram of tenant merging in the multi-tenant management and control method of the present invention;

[0044] Figure 6 This is a structural block diagram of the first embodiment of the multi-tenant control device of the present invention;

[0045] Figure 7 It is a structural diagram of a multi-tenant management and control device of a hardware operating environment involved in an embodiment of the present invention.

[0046] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0047] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0048] The embodiment of the present invention provides a multi-tenant management method, referring to Figure 1 , Figure 1 This is a flowchart of the first embodiment of the multi-tenant management and control method of the present invention.

[0049] In this embodiment, the multi-tenant management and control method is applied to the aPaaS platform, and the method includes steps S10 to S40:

[0050] Step S10: Connect the application developed by the developer to the aPaaS platform and generate an application ID.

[0051] It should be noted that the execution subject of this embodiment can be a computer server device with data processing, network communication and program running functions applied to a multi-tenant control scenario, such as a server, a tablet computer, a smart phone, a smart watch, etc., or an electronic device capable of realizing the above functions, a multi-tenant control device, etc. The following takes a multi-tenant control system (hereinafter referred to as the system) including a multi-tenant control device as an example to illustrate this embodiment and the following embodiments.

[0052] It should be explained that, in order to provide aPaaS platform with more sophisticated resource management and access control capabilities, thereby improving the security and flexibility of the aPaaS platform, this embodiment divides the platform resources of the aPaaS platform into four levels: group level, tenant level, user level, and application level;

[0053] The group face is used to represent the group structure within the enterprise and coordinate resource management and scheduling of multiple tenants;

[0054] The tenant plane is used to distinguish different tenants and manage the resources and permissions of the tenants;

[0055] The user plane is used to manage user accounts and permissions under the tenant;

[0056] The application plane is used to distinguish different applications in the enterprise and ensure resource isolation and access control between applications.

[0057] It should be noted that a core function of the aPaaS platform is to support access to different applications. There are different roles in aPaaS, corresponding to different functions, mainly developers, groups, and tenants. Developers are people or teams who use the aPaaS platform to build and deploy applications. They can be independent developers, software development companies, or development teams within an enterprise. Developers use the tools, APIs, and services provided by the aPaaS platform to develop, test, and deploy applications. They are responsible for the logical implementation of the application, user interface design, backend service integration, etc. Groups and tenants are users or organizations that ultimately use, access, and consume applications built by developers. They may be corporate customers, individual users, or other organizations. Tenants access and use applications built by developers through the aPaaS platform. They may pay for use, manage user permissions, configure application parameters, etc. Tenants' needs and feedback usually affect further development and improvements of developers and providers.

[0058] Step S20: When a tenant administrator under the tenant subscribes to the application, the application ID is bound to the tenant administrator.

[0059] It should be explained that the tenant administrator under the tenant subscribes to the application, which can be understood as the tenant administrator under the tenant signing a subscription agreement with the platform on behalf of the tenant in a multi-tenant cloud service or software platform, thereby obtaining the right to access and use specific applications. In this process, the tenant administrator needs to be responsible for configuring and managing the application access rights, user information, resource allocation and other matters within the tenant to ensure that the tenant can use the subscribed application safely and efficiently.

[0060] It should be understood that the application ID may refer to an identifier used to uniquely identify an application program or software.

[0061] It should be noted that tenants include tenant administrators and ordinary users. Tenant administrators can be roles that manage tenant internal affairs and usually have permissions to create and manage users within the tenant, allocate resources, etc. Ordinary users can refer to individuals or organizations that register in a specific service or system and use the service or system. They obtain the right to use resources through a lease agreement, but are usually subject to certain restrictions, such as not being able to change the underlying configuration or affect other tenants' data.

[0062] It is understandable that tenant administrators and ordinary users play different roles in the system, each with different permissions and responsibilities. Tenant administrators are responsible for the internal management and operation of the tenant and ensure the rational allocation and use of resources, while ordinary users are responsible for the rational use of leased resources and compliance with relevant regulations and agreements.

[0063] Step S30: The tenant administrator creates a permission policy based on tenant data and application data in the permission center of the aPaaS platform, and assigns access rights to the application to ordinary users under the tenant based on the permission policy. The tenant data includes account information, permission information and group information of each tenant.

[0064] It should be understood that permission policy can refer to a set of rules and processes for controlling user access and resource operation based on the enterprise's organizational structure and business needs. Its purpose is to ensure data privacy, system security and operational compliance.

[0065] It should be noted that ordinary users can also further divide different access rights according to actual needs.

[0066] In a specific implementation, the ordinary user corresponding to the tenant administrator can be determined, and the corresponding tenant resources can be allocated to the ordinary user corresponding to the tenant administrator; the ordinary user corresponding to the tenant administrator can be associated with the application bound to the tenant administrator; the tenant administrator can create a permission policy based on tenant data and application data in the permission center of the aPaaS platform; based on the permission policy, the ordinary user corresponding to the tenant administrator can be allocated access rights to the application and the corresponding permission level can be allocated.

[0067] Step S40: When receiving the access instruction, if the permission center determines that the user corresponding to the access instruction has access rights, the user is allowed to access the application.

[0068] It should be noted that when receiving an access instruction to the application sent by a user, the permission center is used to determine whether the user corresponding to the access instruction has access rights; if the user has access rights, the user is allowed to access the application, and the user's application and data are isolated, using a role-based permission approach to ensure access security. If the user does not have access rights, the user is not allowed to access the application.

[0069] It should be explained that isolating the user's applications and data and ensuring access security in a role-based manner includes: isolating processes through processes or a loading environment that supports multiple applications running simultaneously; storing all tenants' data in the same database, with each tenant having their own independent solution and its corresponding table, and users adding or modifying table columns by themselves; granting different access rights to different tenants based on the enterprise organizational structure and role system model.

[0070] The core capability of the aPaaS platform is to access different applications, and then control the access control of tenants and their users to the applications through permission policies. In order to better achieve this goal, the application plane is proposed, which is bound to users and tenants through the application plane, and then the permission policy is configured to bind the application permission policy to users and tenants, so as to achieve data isolation and access control of different tenant users to different applications, and achieve the purpose of user access to applications.

[0071] For specific procedures, please refer to Figure 2 , Figure 2 It is a schematic diagram of a specific implementation scenario of the multi-tenant management and control method of the present invention. It describes how different roles perform application development, subscription, permission management and access on the aPaaS (Application Platform as a Service) platform. The following roles and steps are included in the flowchart: Developer: responsible for developing and creating applications. On the aPaaS platform, developers create applications and generate unique application IDs. Tenants: subscribe to applications created by developers. Tenants can be corporate customers, individual users, or other organizations, who access and use applications built by developers through the aPaaS platform. Tenant administrator: On the aPaaS platform, tenant administrators are responsible for creating application permission policies and binding them to designated users. Administrators manage user access rights to applications through the permission center. Ordinary users: end users, who initiate access requests through the gateway. The gateway will perform permission authentication. If the permission authentication passes, ordinary users can access the corresponding applications. The figure also shows the relationship between the application and the permission center. The application is associated with the permission policy through the APP ID (i.e. application ID), and the permission center is responsible for managing these permission policies to ensure the security and compliance of user access. The entire process reflects how the aPaaS platform achieves full-process management of application creation, subscription, permission allocation and user access through different levels of management and control.

[0072] This embodiment discloses connecting the application developed by the developer to the aPaaS platform and generating an application ID; when the tenant administrator under the tenant subscribes to the application, the application ID is bound to the tenant administrator; the tenant administrator creates a permission policy based on tenant data and application data in the permission center of the aPaaS platform, and assigns access rights to the application to ordinary users under the tenant based on the permission policy, wherein the tenant data includes account information, permission information and group information of each tenant; when receiving an access instruction, if the permission center determines that the user corresponding to the access instruction has access rights, the user is allowed to access the application. Since in this embodiment, when the tenant administrator under the tenant subscribes to the application, the application ID is bound to the tenant administrator, and then the tenant administrator creates a permission policy based on tenant data and application data in the permission center of the aPaaS platform to assign access rights to the application to ordinary users under the tenant, compared with the prior art, this embodiment realizes data isolation and access control of users of different tenants to different applications, thereby improving the security and flexibility of the aPaaS platform.

[0073] refer to Figure 3 , Figure 3 This is a flow chart of the second embodiment of the multi-tenant management and control method of the present invention.

[0074] Based on the first embodiment described above, in this embodiment, before step S10, steps S01 to S03 are further included:

[0075] Step S01: Divide tenants into common users and tenant administrators.

[0076] Step S02: setting user levels, and grading the common users and the tenant administrators respectively according to the user levels.

[0077] Step S03: According to preset configuration rules, access rights and resource configuration are performed on the classified common users and tenant administrators respectively.

[0078] It should be noted that the above user levels can divide common users and tenant administrators into multiple levels, and then classify the common users and tenant administrators respectively according to the user levels.

[0079] It should be understood that preset configuration rules are the basis for developing access rights and resource configurations, which can include: role definition, clarifying the roles and responsibilities of ordinary users and tenant administrators, as well as their status and authority levels in the system; permission division: according to different roles, access rights are divided into different levels, such as read-only, read-write, management, etc.; resource allocation: according to business needs, corresponding resources are allocated to different roles, such as storage space, computing power, application access rights, etc.; security policy: formulate data security policies, including data encryption, access control, audit logs, etc., to ensure data integrity and security.

[0080] It is understandable that the access rights and resource configuration of the classified common users and tenant administrators according to the preset configuration rules is an important part of the rights management and resource management in the multi-tenant architecture. Through reasonable rights division and resource allocation, the security and stability of the system can be ensured, and the user satisfaction and business efficiency can be improved.

[0081] This embodiment discloses dividing tenants into common users and tenant administrators; setting user levels, and grading the common users and tenant administrators according to the user levels; and performing access rights and resource configuration on the graded common users and tenant administrators according to preset configuration rules. Compared with the prior art, this embodiment performs access rights and resource configuration on the graded common users and tenant administrators according to preset configuration rules, which can ensure the security and stability of the system and improve user satisfaction and business efficiency.

[0082] refer to Figure 4 , Figure 4 This is a flow chart of the third embodiment of the multi-tenant management and control method of the present invention.

[0083] Based on the above embodiments, in this embodiment, the multi-tenant management and control method further includes steps S50 to S60:

[0084] Step S50: Based on the group information of each tenant in the tenant data, different tenants are associated with the same group to obtain a data merging result.

[0085] Step S60: According to the data merging result, the corresponding tenants are accessed by accessing the group to obtain the data of all tenants under the group.

[0086] It should be understood that traditional tenant merging requires changing the tenants corresponding to the data of different tenants to the same data, which has many problems. First, the workload of data merging is large and the risk is relatively large, which may cause high-level failures (for example, it may cause problems in data consistency and resource management). In order to simplify the complexity of tenant merging, this embodiment introduces the group face. For example, Figure 5 , Figure 5 The figure is a schematic diagram of tenant merging in the multi-tenant management and control method of the present invention. Different tenants are associated with the same group to obtain data merging results. Each group can coordinate the resources of multiple tenants, allowing the resources of different tenants to be seamlessly integrated into the same organization without making a lot of modifications to the original data structure, thereby greatly reducing the workload and potential risks of the merging operation. By associating tenants with groups, users access tenants by accessing the group, and finally obtain the data of all tenants under the group, thereby achieving the effect of tenant merging.

[0087] This embodiment discloses that based on the group information of each tenant in the tenant data, different tenants are associated with the same group to obtain a data merging result; according to the data merging result, the corresponding tenant is accessed by accessing the group to obtain the data of all tenants under the group. Compared with the prior art, this embodiment associates different tenants with the same group to obtain a data merging result. Each group can coordinate the resources of multiple tenants, allowing the resources of different tenants to be seamlessly integrated into the same organization without making a lot of modifications to the original data structure, thereby greatly reducing the workload and potential risks of the merging operation.

[0088] In addition, an embodiment of the present invention further proposes a storage medium, on which a multi-tenant management and control program is stored. When the multi-tenant management and control program is executed by a processor, the steps of the multi-tenant management and control method described above are implemented.

[0089] Reference Figure 6 , Figure 6 This is a structural block diagram of the first embodiment of the multi-tenant management and control device of the present invention.

[0090] like Figure 6 As shown, the multi-tenant management and control device proposed in the embodiment of the present invention includes: an application access module 601, an application binding module 602, a permission allocation module 603 and a permission determination module 604.

[0091] The application access module 601 is used to access the application developed by the developer to the aPaaS platform and generate an application ID.

[0092] The application binding module 602 is used to bind the application ID with the tenant administrator when the tenant administrator under the tenant subscribes to the application.

[0093] The permission allocation module 603 is used to create a permission policy based on tenant data and application data in the permission center of the aPaaS platform by the tenant administrator, and allocate access rights of the application to ordinary users under the tenant based on the permission policy. The tenant data includes the tenant's account information, permission information and group information.

[0094] The permission determination module 604 is configured to, when receiving an access instruction, allow the user to access the application if the permission center determines that the user corresponding to the access instruction has access rights.

[0095] The permission allocation module 603 is also used to determine the ordinary user corresponding to the tenant administrator, and allocate corresponding tenant resources to the ordinary user corresponding to the tenant administrator; associate the ordinary user corresponding to the tenant administrator with the application bound to the tenant administrator; create a permission policy based on tenant data and application data in the permission center of the aPaaS platform by the tenant administrator; allocate access rights to the application to the ordinary user corresponding to the tenant administrator based on the permission policy, and allocate corresponding permission levels.

[0096] The permission determination module 604 is used to, when receiving an access instruction for the application sent by a user, use the permission center to determine whether the user corresponding to the access instruction has access rights; if the user has access rights, the user is allowed to access the application, and the user's application and data are isolated, using a role-based permission approach to ensure access security.

[0097] The embodiment of the device discloses connecting the application developed by the developer to the aPaaS platform and generating an application ID; when the tenant administrator under the tenant subscribes to the application, the application ID is bound to the tenant administrator; the tenant administrator creates a permission policy based on tenant data and application data in the permission center of the aPaaS platform, and assigns access rights of the application to ordinary users under the tenant based on the permission policy, wherein the tenant data includes account information, permission information and group information of each tenant; when receiving an access instruction, if the permission center determines that the user corresponding to the access instruction has access rights, the user is allowed to access the application. Since the embodiment of the device binds the application ID to the tenant administrator when the tenant administrator under the tenant subscribes to the application, and then creates a permission policy based on tenant data and application data in the permission center of the aPaaS platform by the tenant administrator to assign access rights of the application to ordinary users under the tenant, compared with the prior art, the embodiment of the device realizes data isolation and access control of users of different tenants to different applications, thereby improving the security and flexibility of the aPaaS platform.

[0098] Based on the above-mentioned first embodiment of the multi-tenant control device of the present invention, a second embodiment of the multi-tenant control device of the present invention is proposed.

[0099] In this embodiment, the application access module 601 is also used to divide tenants into ordinary users and tenant administrators; set user levels, and classify the ordinary users and the tenant administrators according to the user levels; and perform access rights and resource configuration on the graded ordinary users and the tenant administrators according to preset configuration rules.

[0100] Other embodiments or specific implementation methods of the multi-tenant management and control device of the present invention can refer to the above-mentioned method embodiments and will not be repeated here.

[0101] The present application provides a multi-tenant management and control device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the multi-tenant management and control method in the above-mentioned embodiment one.

[0102] Reference below Figure 7 , which shows a schematic diagram of the structure of a multi-tenant control device suitable for implementing an embodiment of the present application. The multi-tenant control device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 7 The multi-tenant management and control device shown is merely an example and should not impose any limitations on the functions and scope of use of the embodiments of the present application.

[0103] like Figure 7As shown, the multi-tenant control device may include a processing device 1001 (such as a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the multi-tenant control device are also stored. The processing device 1001, ROM1002 and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the multi-tenant control device to communicate with other devices wirelessly or wired to exchange data. Although the figure shows a multi-tenant control device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0104] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0105] The multi-tenant control device provided by this application adopts the multi-tenant control method in the above embodiment, which can solve the technical problem of low security and flexibility of the aPaaS platform in a multi-tenant environment in the prior art. Compared with the prior art, the beneficial effects of the multi-tenant control device provided by this application are the same as the beneficial effects of the multi-tenant control method provided by the above embodiment, and the other technical features in the multi-tenant control device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0106] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0107] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0108] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0109] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0110] The present application also provides a computer program product, including a computer program, which implements the steps of the multi-tenant management and control method as described above when executed by a processor.

[0111] The computer program product provided in this application can solve the technical problem of low security and flexibility of the aPaaS platform in a multi-tenant environment in the prior art. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as the beneficial effects of the multi-tenant management and control method provided in the above embodiment, which will not be repeated here.

[0112] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0113] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0114] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory / random access memory, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0115] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A multi-tenant management and control method, characterized in that: The method is applied to the aPaaS platform, and the method includes: Connect the application developed by the developer to the aPaaS platform and generate an application ID; When a tenant administrator under a tenant subscribes to the application, the application ID is bound to the tenant administrator; The tenant administrator creates a permission policy based on tenant data and application data in the permission center of the aPaaS platform, and assigns access rights of the application to ordinary users under the tenant based on the permission policy, wherein the tenant data includes account information, permission information and group information of each tenant; When receiving the access instruction, if the permission center determines that the user corresponding to the access instruction has access rights, the user is allowed to access the application.

2. The multi-tenant management and control method according to claim 1, characterized in that: The aPaaS platform divides platform resources into four levels: group level, tenant level, user level, and application level; The group face is used to represent the group structure within the enterprise and coordinate resource management and scheduling of multiple tenants; The tenant plane is used to distinguish different tenants and manage the resources and permissions of the tenants; The user plane is used to manage user accounts and permissions under the tenant; The application plane is used to distinguish different applications in the enterprise and ensure resource isolation and access control between applications.

3. The multi-tenant management and control method according to claim 1, characterized in that: Before the step of connecting the application developed by the developer to the aPaaS platform and generating an application ID, the step further includes: Divide tenants into common users and tenant administrators; Setting user levels, and grading the common users and the tenant administrators according to the user levels; According to preset configuration rules, access rights and resource configuration are performed on the classified common users and tenant administrators respectively.

4. The multi-tenant management and control method according to claim 1, characterized in that: The method further comprises: Based on the group information of each tenant in the tenant data, different tenants are associated with the same group to obtain a data merging result; According to the data merging result, the corresponding tenants are accessed by accessing the group to obtain the data of all tenants under the group.

5. The multi-tenant management and control method according to claim 1, characterized in that: The step of creating a permission policy based on tenant data and application data in the permission center of the aPaaS platform by the tenant administrator, and assigning access rights of the application to ordinary users under the tenant based on the permission policy, includes: Determine the common user corresponding to the tenant administrator, and allocate corresponding tenant resources to the common user corresponding to the tenant administrator; Associating a common user corresponding to the tenant administrator with the application bound to the tenant administrator; The tenant administrator creates a permission policy based on tenant data and application data in the permission center of the aPaaS platform; Based on the permission policy, the access rights of the application are allocated to the common user corresponding to the tenant administrator, and the corresponding permission level is allocated.

6. The multi-tenant management and control method according to claim 1, characterized in that: The step of allowing the user to access the application if the permission center determines that the user corresponding to the access instruction has access rights when the access instruction is received includes: When receiving an access instruction of the application sent by the user, using the permission center to determine whether the user corresponding to the access instruction has access rights; If the user has access rights, the user is allowed to access the application, and the user's application and data are isolated, using a role-based permission approach to ensure access security.

7. A multi-tenant management and control device, characterized in that: The device comprises: An application access module, used to access the application developed by the developer to the aPaaS platform and generate an application ID; An application binding module, used to bind the application ID with the tenant administrator when the tenant administrator under the tenant subscribes to the application; A permission allocation module, configured to allow the tenant administrator to create a permission policy based on tenant data and application data in the permission center of the aPaaS platform, and to allocate access rights of the application to ordinary users under the tenant based on the permission policy, wherein the tenant data includes the tenant's account information, permission information, and group information; The permission determination module is used for, when receiving an access instruction, allowing the user to access the application if the permission center determines that the user corresponding to the access instruction has access rights.

8. A multi-tenant management and control device, characterized in that: The device includes: a memory, a processor, and a multi-tenant management and control program stored in the memory and executable on the processor, wherein the multi-tenant management and control program is configured to implement the steps of the multi-tenant management and control method as described in any one of claims 1 to 6.

9. A storage medium, characterized in that: A multi-tenant management and control program is stored on the storage medium, and when the multi-tenant management and control program is executed by the processor, the steps of the multi-tenant management and control method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product includes a computer program, and when the computer program is executed by a processor, the steps of the multi-tenant management and control method as described in any one of claims 1 to 6 are implemented.

Images