Data isolation and flexible data combination method applied to SaaS platform

Abstract

The embodiment of the invention provides a data isolation and flexible data combination method applied to a SaaS platform, and the method comprises the steps that a local end responds to an instruction of accessing a service page by a data link of a user at a C end, stores a first identifier and a token in a local cache, and sets a key as key information carrying the first identifier of an enterprise user, searching the token according to the first identifier and responding to the instruction; the first identifier is a first identifier given to the enterprise user during registration, and the token is a random code generated by encryption according to a second identifier registered by the C-end user and login information during login of the C-end user; and the local end receives a business data request carrying the token triggered by the C-end user, and sends the business data request to the server, and the server searches the business data corresponding to the business data request by adopting the first identifier. According to the method, the existing resources can be fully utilized in a mode of increasing the identifier, and the labor cost and the time cost when the new user is accessed are reduced.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a data isolation and data flexible combination method applied to a SaaS platform, an electronic device and a computer-readable medium. Background Art

[0002] In the currently widely used SaaS (Software as a Service) system, it is inevitable to store, manage and use the data of multiple enterprise users. In the existing cloud data services, each enterprise customer's data is independently built into a database to achieve data isolation. Although this can achieve data security, it also has some limitations and shortcomings, as well as a lack of flexibility in some scenarios.

[0003] For example, when new enterprise users need to be connected, if the traditional data isolation method is used, more database service resources need to be added. This makes it impossible to fully utilize the existing resources. At the same time, the method of increasing database service resources requires more manpower and time costs to connect new users, which ultimately increases the cost of SaaS rentals and further hinders the expansion of business negotiations. Moreover, in dealing with some special scenarios that require data combination, the traditional data isolation method will also appear more limited. For example, some enterprise users want to isolate their data when displaying their data on the C-end to ensure data security, privacy protection, and protect the brand value of the enterprise. However, other enterprise users have multiple sub-organizations or companies, and they want to display their data together with the data of other organizations or companies to achieve a more comprehensive data display and enhance user experience. Summary of the invention

[0004] The embodiment of the present invention provides a data isolation and data flexible combination method applied to a SaaS platform to solve the problems of high labor cost, high time cost and inability to effectively ensure data security in the prior art.

[0005] The embodiment of the present invention discloses a data isolation and data flexible combination method applied to a SaaS platform, including:

[0006] The local end responds to the instruction of the C-end user to access the business page according to the data link of the enterprise user, saves the first identifier and token in the local cache, updates the key value key corresponding to the first identifier and token of the local cache data to the specified key value, and the local end finds the first identifier by the specified key value to respond to the instruction; the first identifier is the first identifier assigned to the enterprise user when the enterprise user registers, and the token is a random code encrypted and generated according to the registered second identifier and login information of the C-end user when the C-end user logs in;

[0007] The local end receives the business data request triggered by the C-end user, and carries the first identifier and token in the business data request according to the specified key value. The local end sends the business data request to the server end so that the server end performs login verification according to the token. When the verification is passed, the first identifier is used to search for the business data corresponding to the business data request.

[0008] Optionally, the method further comprises:

[0009] The local end receives a first registration request triggered by an enterprise user, and adds a first identifier for distinguishing the enterprise in the SaaS platform during the registration process according to the first registration request, wherein all data of the enterprise user in the SaaS platform carries the first identifier;

[0010] and / or,

[0011] The local end receives a second registration request triggered by the C-end user, adds a second identification for distinguishing the C-end user during the registration process according to the second registration request, and

[0012] When the local end receives the login information of the C-end user, the second identification and login information of the C-end user are encrypted to form a token; so that the token is used to verify the access of the C-end user in the interaction between the local end and the server end, and the data of the enterprise user with the first identification of the C-end user is obtained after the verification is passed.

[0013] Optionally, the method further comprises:

[0014] The local end receives an operation request for a data isolation service from an enterprise user, and then carries the first identifier in the route of the operation request sent by the local end to the server end;

[0015] Alternatively, when the local end receives an operation request for a data isolation service from an enterprise user, the local end carries the first identifier in the route of the operation request sent by the local end to the server, and caches the first identifier in a local cache.

[0016] Optionally, the local end receives a service data request triggered by a C-end user, and carries a first identifier and a token in the service data request according to a specified key value, including:

[0017] The local end verifies whether the token is valid through an encryption algorithm. If it is valid, the service data request is sent to the server; otherwise, the login page is displayed to the user.

[0018] Optionally, the method further comprises:

[0019] The business page related to the data isolation type displayed by the local end receives an operation request from the C-end user, and checks whether the operation request carries the first identifier of the enterprise user. If so, the local end responds to the operation request, otherwise, it redirects to the business page.

[0020] Optionally, the local end responds to the operation request, including:

[0021] The local end checks whether the data of the current operation request belongs to data sharing and public data. If so, it is displayed; otherwise, it is displayed according to the information of the data isolation type.

[0022] Optionally, the method further comprises:

[0023] When the local end receives an operation request for the combined use of business data of multiple enterprise users triggered by a C-end user based on the SaaS platform, the operation request carries the second identifier of the C-end user and the first identifier of each enterprise user, so that the local end and the server end interact to verify the timeliness and security of the C-end user. When the timeliness and security of the C-end user are met, the server end extracts the data of all enterprises in the business data and feeds back the data combination based on the permissions of the C-end user corresponding to each enterprise user.

[0024] Optionally, the first identifier is eid, and the second identifier is uid; and / or, the first registration request includes: an enterprise user email address, a business license number, and an enterprise user exclusive telephone number;

[0025] Accordingly, updating the key value key corresponding to the first identifier and token of the local cache data to the specified key value includes:

[0026] Set the key of the local cache data to x-eid.

[0027] The embodiment of the present invention further discloses an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0028] The memory is used to store computer programs;

[0029] The processor is used to implement the method described in the embodiment of the present invention when executing the program stored in the memory.

[0030] The embodiment of the present invention further discloses one or more computer-readable media on which instructions are stored. When executed by one or more processors, the processors are enabled to execute the method described in the embodiment of the present invention.

[0031] The embodiments of the present invention include the following advantages:

[0032] The method of the embodiment of the present invention performs auxiliary data isolation and data combination on the business by carrying the eid parameter (the eid parameter is the first identifier added when the enterprise user registers) on the business link provided by the enterprise. In addition, a unique token identifier is generated by encrypting the C-end user uid, and this identifier serves as the credential and basis for the user to access the data. By adding identifiers, existing resources can be fully utilized, reducing the manpower and time costs of investing in accessing new users. When the user registers, the uid of the data identifier is added to the system, and when the C-end user logs in through the link of the enterprise user business page, the uid and eid can be bound, which is more flexible and expandable when dealing with some special scenarios that require data isolation and data combination. At the same time, it solves the technical deficiencies existing in the existing enterprise Internet service field, flexibly realizes the isolation of business data, and supports the combination of business data at different levels such as public and private. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is a flowchart of the steps of a method for data isolation and flexible data combination applied to a SaaS platform provided in an embodiment of the present invention;

[0034] Figure 2 is a flowchart of the steps of the data isolation and data flexible combination method applied to the SaaS platform provided in an embodiment of the present invention;

[0035] Figure 3 is a block diagram of an electronic device provided in an embodiment of the present invention;

[0036] Figure 4 is a schematic diagram of a computer-readable medium provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0037] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0038] SaaS platform is a software delivery model based on cloud computing. Users can access and use software applications on demand through the Internet without installing and maintaining the software locally. The core concept of the SaaS model is to turn software into a service, allowing users to access and use applications through the Internet anytime and anywhere, while enjoying various support and services provided by cloud service providers. SaaS platforms usually adopt a multi-tenant architecture, that is, multiple users share the same application instance and infrastructure to reduce operating costs and improve resource utilization. The software applications provided by the SaaS platform are deployed on cloud servers. Users access these applications through the Internet without worrying about technical issues such as hardware maintenance, software updates, and data backup. In addition, SaaS platforms usually provide rich APIs and plug-ins to support users to customize and expand according to business needs. Users can increase or decrease resources at any time according to their needs to achieve elastic scaling. The cloud service provider of the SaaS platform is responsible for the update and maintenance of the software. Users do not need to manually install patches or upgrade the software. They can always access the latest version of the software and enjoy the latest features and security patches. At the same time, cloud service providers usually provide advanced data security and backup services to ensure the security and reliability of user data. Based on the above architecture, the SaaS platform can provide a consistent experience across platforms, allowing users to access applications through desktop computers, tablets, smartphones and other devices, and work anytime and anywhere. In short, the SaaS platform provides users with a flexible, efficient and economical way to use software by turning software into a service. Whether it is a small or medium-sized enterprise or a large enterprise, they can obtain high-quality software services through the SaaS platform to improve business efficiency and competitiveness.

[0039] Corresponding to the above-mentioned SaaS platform, its users include B-end users (corporate users) and C-end users (individual users / consumers).

[0040] An enterprise user is usually an organization or company that uses the SaaS platform to provide services or complete work tasks. Enterprise users may need to manage multiple C-end user accounts, set permissions and roles for C-end users, and ensure the security and compliance of C-end users when using business data.

[0041] C-end users are usually individual users who use the SaaS platform to meet their personal needs. In one implementation scenario, C-end users can use the services provided by enterprise users through the SaaS platform to meet their personal data access needs. However, they are restricted by the enterprise users' settings of C-end user account permissions and roles. They can only access business data under the permissions opened to them by the enterprise users, or access business data that is visible to everyone according to the enterprise users' sharing policy.

[0042] Reference Figure 1 and Figure 2 , Figure 1 and Figure 2Each of them shows a flow chart of the steps of a method for data isolation and flexible data combination applied to a SaaS platform provided in an embodiment of the present invention, which may specifically include the following steps:

[0043] 101. The local end responds to the instruction of the C-end user to access the business page according to the data link of the enterprise user, saves the first identifier (such as eid) and token in the local cache, updates the key value key corresponding to the first identifier and token of the local cache data with the specified key value (such as x-eid), and the local end uses the specified key value to find the first identifier in response to the instruction; the first identifier is the first identifier assigned to the enterprise user when the enterprise user registers, and the token is a random code encrypted and generated according to the second identifier (such as uid) registered by the C-end user and the login information when the C-end user logs in.

[0044] It is understandable that when caching locally, in order to efficiently store and retrieve data, a suitable key is defined. This key should be able to uniquely identify the data entry in the cache. When it comes to user authentication and authorization, the user's identifier (such as user ID) and access token are usually used to build the cache key. The appropriate cache key format ensures uniqueness, that is, ensures that the key can uniquely identify the data entry in the cache. The key value of this embodiment can keep the key value concise to improve the performance of the cache. At the same time, it is easy to read and maintain. As a result, the cached data can be effectively managed and accessed, improving the performance and reliability of the system.

[0045] 102. The local end receives the business data request triggered by the C-end user, and carries the first identifier and token in the business data request according to the specified key value. The local end sends the business data request to the server end, so that the server end performs login verification according to the token. When the verification is passed, the first identifier is used to search for the business data corresponding to the business data request.

[0046] Furthermore, the local end may also verify whether the token is valid through an encryption algorithm. If it is valid, the business data request is sent to the server; otherwise, a login page is displayed to the user.

[0047] Tokens are used for identity authentication and authorization in computer systems and networks. Tokens can exist in many forms. The token of this embodiment is a string containing specific information, which is used to verify the identity of a user or authorize a user to access a specific resource, and is used to prove the identity or authority of the user.

[0048] The life cycle of the token is short to reduce the risk of abuse, for example 3-5 minutes.

[0049] By using Tokens properly, we can improve system security and user experience, and ensure data confidentiality and integrity.

[0050] For example, based on steps 101 and 102 above, when a C-end user accesses a business page through a page link provided by an enterprise user that requires data isolation, the eid carried in the link is saved together with the user token in the user's local cache, and the key of the cached data is set to x-eid, so that the corresponding token can always be found only through the eid carried by the link.

[0051] When the C-end user obtains business data, the local end can write the eid and user token into the request header parameters to make a business request. After receiving the business request, the server first obtains the token of the corresponding user for login verification, and then searches and queries through the eid. When the server in this embodiment operates the data, the token identifier is brought into the data service for search and query to obtain the corresponding business data and return the business function presentation.

[0052] The method of this embodiment is applied to data isolation and flexible data combination of the SaaS platform. By carrying the eid parameter (the eid parameter is the first identifier added when the enterprise user registers) on the business link provided by the enterprise, auxiliary data isolation and data combination are performed on the business information.

[0053] In addition, a unique token is generated by encrypting the C-end user's uid, which serves as the credential and basis for the user to access the data. By adding identifiers, existing resources can be fully utilized, reducing the manpower and time costs of investing in new users. When the user registers, the uid of the data identifier is added to the system, and when the C-end user logs in through the link of the enterprise user business page, the uid and eid can be bound, which is more flexible and expandable when dealing with some special scenarios that require data isolation and data combination. At the same time, it solves the technical deficiencies in the existing enterprise Internet service field, flexibly realizes the isolation of business data, and supports the combination of business data at different levels such as public and private.

[0054] In order to better implement the data isolation and data flexible combination method applied to the SaaS platform provided in the first embodiment, before executing the above step 101, Figure 1 The method shown also includes steps 100a and 100b not shown in the figure:

[0055] 100a. The local end receives a first registration request triggered by an enterprise user, and adds a first identifier for the enterprise during the registration process according to the first registration request, which is used to distinguish the enterprise in the SaaS platform. All data of the enterprise user in the SaaS platform carry the first identifier.

[0056] 100b. The local end receives a second registration request triggered by a C-end user, adds a second identification for distinguishing the C-end user during the registration process according to the second registration request, and encrypts the second identification and login information of the C-end user to form a token when the local end receives the login information of the C-end user; so that the token is used to verify the access of the C-end user in the interaction between the local end and the server end, and the data of the enterprise user with the first identification to which the C-end user belongs is obtained after the verification is passed.

[0057] Specifically, in step 100b, in order to ensure the security of the data, the second identification and login information of the C-end user are encrypted. The encryption method can specifically use three types of symmetric encryption, asymmetric encryption and hash function encryption. Among them, symmetric encryption uses the same key to encrypt and decrypt data. Common symmetric encryption algorithms include: AES (Advanced Encryption Standard), DES (Data Encryption Standard), 3DES (Triple DES) and RC4 (Rivest Cipher 4). Asymmetric encryption uses a pair of keys (public key and private key) for encryption and decryption. Common asymmetric encryption algorithms include: RSA (Rivest Shamir Adleman), DSA (Digital Signature Algorithm), ECDSA (Elliptic Curve Digital Signature Algorithm) and ECC (Elliptic Curve Cryptography). Hash functions are used to generate fixed-length summaries and are commonly used for data integrity verification and digital signatures. Common hash functions include: MD5 (Message-Digest Algorithm 5), SHA-1 (Secure Hash Algorithm 1), SHA-256 (Secure Hash Algorithm 256) and SHA-3 (Secure Hash Algorithm 3).

[0058] For the above steps 100a and 100b, for example, the first identifier is eid, and the second identifier is uid; the first registration request includes: corporate user email, business license number, corporate user exclusive phone number and other data that can uniquely distinguish the corporate entity information.

[0059] This embodiment does not limit the first identifier, the second identifier, and the content of the registration request, and they are adjusted according to actual needs.

[0060] The local end of this embodiment can be a local browser page displayed by the SaaS platform or a page of the data service system, etc. The first identification of the enterprise user is carried in the corresponding database service resources of the enterprise, and the token of the C-end user is also carried in all information or data paths transferred by the C-end user, which is the logic for implementing subsequent access to data.

[0061] In this embodiment, a token is generated for the C-end user to ensure timeliness and security. Corresponding to the step of encrypting the second identification and login information of the C-end user in the above step 100b, when the server responds to the service data request triggered by the C-end user through the local end, it verifies whether the user login token is valid through the corresponding encryption algorithm. If it is valid, the system continues to process the service. If it is invalid, it prompts to jump directly to the login page to guide the user to log in again.

[0062] In the above step 100b, the mechanism of identity authentication, authorization and data integrity verification is implemented based on token. The token itself can be set in various forms, but its core purpose is to provide a secure way to verify the user's identity, authorize access or protect the integrity of data. First, it is used to verify the user's identity to ensure that the user is legitimate. Second, it is used to maintain the session state between the local end and the server end, avoid frequent login verification, ensure the security and reliability of the system, effectively prevent unauthorized access and data tampering, and protect the security of user data.

[0063] Steps 100a and 100b in this embodiment may be performed in any order and may be adjusted as needed. At the same time, each enterprise user corresponds to multiple C-end users, and the permissions of multiple C-end users may also be different, determined according to the specific C-end user's information in the enterprise. In this embodiment, the first identification of the enterprise user is used to enable all the data of the enterprise user to be carried, so that when a new C-end user accesses, there is no need to create a new database service resource, and the data of the original enterprise user can be identified and read through the first identification, which saves labor costs compared to the prior art.

[0064] Taking a company's department as an enterprise user as an example, the department members are the C-end users corresponding to the department. Moreover, according to the different work permissions of each member in the department, different roles can be configured through the second identifier, so that the server can identify whether the member has the corresponding authority based on the second identifier configured for the member.

[0065] Specifically, for example, if the SaaS platform stores public data A accessible to all members of the department, private data B accessible only to senior members, and private data C about the department members themselves, then the multiple members in the department can be divided into two roles, one is a special role that can access private data B, and the other is a common role that cannot access private data B. The two roles can be distinguished by the corresponding configured uid. For example, the first two or last two digits of the uid of the special role are configured as a pre-specified set of numbers or letters, and the first two or last two digits of the uid of the common role are configured as another pre-specified set of numbers or letters; or different roles can be set by dividing the uid number segment. When the server performs login verification or interaction with the user, it can verify the legitimacy of the user's identity through the user's token, and determine the user's role by reading the first two or last two digits of the user's uid, or according to the user's uid number segment, so as to know whether the user has access rights to the corresponding data, thereby realizing the isolation of the corresponding business data.

[0066] For example, based on the above-mentioned configuration of member permissions through uid, when the server of the SaaS platform receives a business data request for private data B from a user of an ordinary role, the server of the SaaS platform first verifies the first identifier and token carried in the business data request. After the verification is passed, the server parses the token to obtain the user's second identifier uid, and obtains the user's role by reading the first or last two digits of the user's uid. If it is determined that the user does not have access to private data B, it will redirect to the business page, and may also prompt the user on the business page that he does not have relevant permissions.

[0067] Correspondingly, when the server of the SaaS platform receives a business data request for private data B from a user with a special role, the server of the SaaS platform first verifies the first identifier and token carried in the business data request. After the verification is passed, the server parses the token to obtain the user's second identifier uid, and obtains the user's role by reading the first or last two digits of the user's uid. When it is determined that the user with the special role has access to private data B, the private data is returned to the local end.

[0068] Based on the combination of the above-mentioned first identification (eid) and the second representation (uid), the present invention adds an eid in the system when an enterprise user registers, and carries the eid parameter on the business link provided by the enterprise to assist in data isolation and data combination for the business; when the user registers, the uid of the data identification is added in the system, and a unique token identification is generated by encrypting the uid. This identification serves as the credential and basis for the user to access the data, and carries relevant permission information through the uid. The enterprise user manages the permissions of the C-end users under it by configuring the relevant fields of the uid. Therefore, for each newly registered C-end user, the existing resources can be fully utilized by adding the identification, thereby reducing the manpower and time costs of investing in accessing new users.

[0069] In the specific implementation process of the data isolation and data flexible combination method applied to the SaaS platform provided in this embodiment, as shown in FIG. Figure 1 As shown, it includes step 101 and step 102.

[0070] 101. The local end responds to the instruction of the C-end user to access the business page according to the data link of the enterprise user, saves the first identifier (such as eid) and token in the local cache, updates the key value key corresponding to the first identifier and token of the local cache data with the specified key value (such as x-eid), and the local end uses the specified key value to find the first identifier in response to the instruction; the first identifier is the first identifier assigned to the enterprise user when the enterprise user registers, and the token is a random code encrypted and generated according to the second identifier (such as uid) registered by the C-end user and the login information when the C-end user logs in.

[0071] 102. The local end receives the business data request triggered by the C-end user, and carries the first identifier and token in the business data request according to the specified key value. The local end sends the business data request to the server end, so that the server end performs login verification according to the token. When the verification is passed, the first identifier is used to search for the business data corresponding to the business data request.

[0072] In addition, the aforementioned Figure 1 The method shown may also include:

[0073] When the local end receives an operation request for a data isolation service from an enterprise user, the route of the operation request sent by the local end to the server end carries the first identifier.

[0074] In another optional implementation, when the local end receives an operation request for a data isolation service from an enterprise user, the local end carries the first identifier in the route of the operation request sent from the local end to the server, and caches the first identifier in the local cache, so that the corresponding token can always be found through the eid carried by the page link of the data isolation service.

[0075] In a third possible implementation, the business page related to the data isolation type displayed by the local end receives an operation request from the C-end user, checks whether the operation request carries the first identifier of the enterprise user, and if so, responds to the operation request, otherwise, redirects to the business page. That is, if the C-end user accesses a business type that the enterprise user has special requirements for but does not carry the necessary eid, the local end performs error processing and redirects to the business homepage.

[0076] In the fourth optional implementation, when C-end users use the data service system of the SaaS platform through different business pages provided by different enterprises, they can obtain the C-end user uid before entering the data service system, and obtain the corresponding business data and data sharing strategy in the business configured by the corresponding enterprise. If the sharing strategy is configured as Private, the data is displayed according to the data isolation type, presenting to the user that this is a business capability independently provided by a certain enterprise. Of course, if the sharing strategy is Public, the data is displayed, presenting to the user that this is a business capability registered by a certain enterprise on a certain platform.

[0077] For example, the aforementioned local end responding to the operation request may include:

[0078] The local end checks whether the data of the current operation request belongs to data sharing and public data. If so, it is displayed; otherwise, it is displayed according to the information of the data isolation type.

[0079] Of course, in specific applications, if the local end receives an operation request for the combined use of business data of multiple enterprise users triggered by a C-end user based on the SaaS platform, the operation request carries the second identifier of the C-end user and the first identifier of each enterprise user, so that the local end and the server end can interact to verify the timeliness and security of the C-end user. When the timeliness and security of the C-end user are met, the server end extracts the data of all enterprises in the business data and feeds back the data combination based on the permissions of the C-end user corresponding to each enterprise user.

[0080] That is, when it is necessary to combine the business data of multiple enterprises corresponding to a C-end user, the relevant data provided by the corresponding enterprises can be extracted from the business database through the uid of the C-end user, thereby realizing data combination.

[0081] For example, a parent enterprise has multiple subsidiaries under its jurisdiction. As a C-end user under the corporate users of the parent enterprise, the C-end user has the need to access the business data stored on the SaaS platform by corporate users of some of the subsidiary enterprises under the parent enterprise.

[0082] When the local end receives a business data request for multiple sub-enterprises triggered by an operation request from a C-end user for combined use of business data of multiple sub-enterprise users, the business data request carries a first identifier and a token according to a specified key value, and the local end sends the business data request to the server.

[0083] When the server receives a business data request for multiple sub-enterprises sent by the local end, it first verifies, based on the first identifier carried in the business data request, whether the C-end user has access rights to the multiple sub-enterprises to which it requests access.

[0084] If the C-end user has access rights to a certain subsidiary enterprise, the token carried in the business data request is parsed to obtain the C-end user's uid. Based on the role configured for the C-end user in the uid and the access rights of each role pre-configured by the enterprise user of the subsidiary enterprise, it is verified whether the C-end user has access rights to the business data he requests to access. If so, the user data requested to be accessed by the C-end user is returned to the local end.

[0085] After the local end receives the business data of all sub-enterprises requested by the C-end user from the server, it combines them for use on the corresponding business page.

[0086] If the C-end user does not have access rights to a certain sub-enterprise among multiple sub-enterprises, or the C-end user has access rights to a certain sub-enterprise but does not have access rights to the business data requested by it, the local end can perform error processing after receiving the information of no authority returned by the server, redirect to the business homepage, or only display the business data received by other C-end users to which they have access rights.

[0087] The method of this embodiment can flexibly realize the isolation of business data between different C-end users of different enterprises by combining the first identifier (eid) and the second identifier (uid), and support the combination of business data at different levels, so that existing resources can be fully utilized, reducing the manpower cost and time cost of investing in accessing new users. When the user registers, the uid of the data identifier is added to the system, and when the C-end user logs in through the link of the enterprise user business page, the uid and eid can be bound. When dealing with scenarios that require data isolation and data combination, the user's authority is verified from different levels by eid and uid respectively, which solves the problem of increasing database service resources, increasing manpower cost and time cost in the prior art.

[0088] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0089] In addition, an embodiment of the present invention further provides an electronic device, such as Figure 3 As shown, it includes a processor 1301, a communication interface 1302, a memory 1303 and a communication bus 1304, wherein the processor 1301, the communication interface 1302, and the memory 1303 communicate with each other through the communication bus 1304.

[0090] Memory 1303, used for storing computer programs;

[0091] The processor 1301 is used to implement the following steps when executing the program stored in the memory 1303:

[0092] The local end responds to the instruction of the C-end user to access the business page according to the data link of the enterprise user, saves the first identifier and token in the local cache, updates the key value key corresponding to the first identifier and token of the local cache data to the specified key value, and the local end finds the first identifier by the specified key value to respond to the instruction; the first identifier is the first identifier assigned to the enterprise user when the enterprise user registers, and the token is a random code encrypted and generated according to the registered second identifier and login information of the C-end user when the C-end user logs in;

[0093] The local end receives the business data request triggered by the C-end user, and carries the first identifier and token in the business data request according to the specified key value. The local end sends the business data request to the server end so that the server end performs login verification according to the token. When the verification is passed, the first identifier is used to search for the business data corresponding to the business data request.

[0094] Further, the local end receives a first registration request triggered by an enterprise user, and adds a first identifier for distinguishing the enterprise in the SaaS platform to the enterprise during the registration process according to the first registration request, wherein all data of the enterprise user in the SaaS platform carries the first identifier;

[0095] In an optional implementation, the local end receives a second registration request triggered by the C-end user, adds a second identification for distinguishing the C-end user during the registration process according to the second registration request, and

[0096] When the local end receives the login information of the C-end user, the second identification and login information of the C-end user are encrypted to form a token; so that the token is used to verify the access of the C-end user in the interaction between the local end and the server end, and the data of the enterprise user with the first identification of the C-end user is obtained after the verification is passed.

[0097] In another optional implementation, when the local end receives an operation request for a data isolation service from an enterprise user, the first identifier is carried in the route of the operation request sent by the local end to the server end;

[0098] In a third optional implementation, when the local end receives an operation request for a data isolation service from an enterprise user, the route of the operation request sent by the local end to the server end carries the first identifier, and the first identifier is cached in a local cache.

[0099] In a fourth optional implementation, the business page related to the data isolation type displayed by the local end receives an operation request from a C-end user, and checks whether the operation request carries the first identifier of the enterprise user. If so, the local end responds to the operation request, otherwise, it redirects to the business page.

[0100] In the fifth optional implementation method, when the local end receives an operation request for the combined use of business data of multiple enterprise users triggered by a C-end user based on the SaaS platform, the operation request carries the second identifier of the C-end user and the first identifier of each enterprise user, so that the local end and the server end interact to verify the timeliness and security of the C-end user. When the timeliness and security of the C-end user are met, the server end extracts the data of all enterprises in the business data and feeds back the data combination based on the permissions of the C-end user corresponding to each enterprise user.

[0101] The communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0102] The communication interface is used for communication between the above terminal and other devices.

[0103] The memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0104] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0105] like Figure 4 As shown, in another embodiment provided by the present invention, a computer-readable storage medium 1401 is also provided, in which instructions are stored. When the computer-readable storage medium 1401 is run on a computer, the computer executes the data isolation and data flexible combination method applied to the SaaS platform described in the above embodiment.

[0106] In another embodiment provided by the present invention, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute the data isolation and data flexible combination method applied to the SaaS platform described in the above embodiment.

[0107] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk Solid State Disk (SSD)), etc.

[0108] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0109] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0110] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A data isolation and data flexible combination method applied to a SaaS platform, characterized in that: include: The local end responds to the instruction of the C-end user to access the business page according to the data link of the enterprise user, saves the first identifier and token in the local cache, updates the key value key corresponding to the first identifier and token of the local cache data to the specified key value, and the local end finds the first identifier by the specified key value to respond to the instruction; the first identifier is the first identifier assigned to the enterprise user when the enterprise user registers, and the token is a random code encrypted and generated according to the registered second identifier and login information of the C-end user when the C-end user logs in; The local end receives the business data request triggered by the C-end user, and carries the first identifier and token in the business data request according to the specified key value. The local end sends the business data request to the server end so that the server end performs login verification according to the token. When the verification is passed, the first identifier is used to search for the business data corresponding to the business data request.

2. The method according to claim 1, characterized in that The method further comprises: The local end receives a first registration request triggered by an enterprise user, and adds a first identifier for distinguishing the enterprise in the SaaS platform during the registration process according to the first registration request, wherein all data of the enterprise user in the SaaS platform carries the first identifier; and / or, The local end receives a second registration request triggered by the C-end user, adds a second identification for distinguishing the C-end user during the registration process according to the second registration request, and When the local end receives the login information of the C-end user, the second identification and login information of the C-end user are encrypted to form a token; so that the token is used to verify the access of the C-end user in the interaction between the local end and the server end, and the data of the enterprise user with the first identification of the C-end user is obtained after the verification is passed.

3. The method according to claim 1, characterized in that The method further comprises: The local end receives an operation request for a data isolation service from an enterprise user, and then carries the first identifier in the route of the operation request sent by the local end to the server end; Alternatively, when the local end receives an operation request for a data isolation service from an enterprise user, the local end carries the first identifier in the route of the operation request sent by the local end to the server, and caches the first identifier in a local cache.

4. The method according to claim 1, characterized in that The local end receives the service data request triggered by the C-end user, and carries the first identifier and token in the service data request according to the specified key value, including: The local end verifies whether the token is valid through an encryption algorithm. If it is valid, the service data request is sent to the server; otherwise, the login page is displayed to the user.

5. The method according to claim 1, characterized in that The method further comprises: The business page related to the data isolation type displayed by the local end receives an operation request from the C-end user, and checks whether the operation request carries the first identifier of the enterprise user. If so, the local end responds to the operation request, otherwise, it redirects to the business page.

6. The method according to claim 5, characterized in that The local end responds to the operation request, including: The local end checks whether the data of the current operation request belongs to data sharing and public data. If so, it is displayed; otherwise, it is displayed according to the information of the data isolation type.

7. The method according to claim 1, characterized in that The method further comprises: When the local end receives an operation request for the combined use of business data of multiple enterprise users triggered by a C-end user based on the SaaS platform, the operation request carries the second identifier of the C-end user and the first identifier of each enterprise user, so that the local end and the server end interact to verify the timeliness and security of the C-end user. When the timeliness and security of the C-end user are met, the server end extracts the data of all enterprises in the business data and feeds back the data combination based on the permissions of the C-end user corresponding to each enterprise user.

8. The method according to claim 2, characterized in that: The first identifier is eid, and the second identifier is uid; and / or, the first registration request includes: an enterprise user email address, a business license number, and an enterprise user exclusive telephone number; Accordingly, updating the key value key corresponding to the first identifier and token of the local cache data to the specified key value includes: Set the key of the local cache data to x-eid.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; The memory is used to store computer programs; The processor is used to implement the method according to any one of claims 1 to 8 when executing the program stored in the memory.

10. A computer-readable medium having instructions stored thereon, which, when executed by one or more processors, cause the processors to perform the method according to any one of claims 1 to 8.

Images