Multi-tenant implementation method of disk array system, electronic equipment and storage medium

Abstract

The invention discloses a multi-tenant implementation method of a disk array system, electronic equipment and a storage medium, and relates to the technical field of data storage, and the method comprises the following steps: newly adding tenant identification parameters in a resource creation class interface in an interface layer in a software upgrading mode, so as to indicate tenants to which created business resources belong when the business resources are created, modifying permission judgment logic of the configuration management type interface to perform configuration management isolation on service resources of different tenants; a corresponding relation between the tenant administrator group and the permission information of the tenant administrator group is added in the user management module; and the user authority management module is reconstructed, so that the user authority management module records the user information of the disk array system user, non-sensing and business resource isolation among different tenants are ensured, and the disk array system supporting multiple tenants is obtained. The technical problem that the multi-tenant capability cannot be quickly realized on the existing disk array system is solved, and the technical effect of quickly realizing the multi-tenant capability on the existing disk array system is achieved.

Description

Technical Field

[0001] The present application relates to the technical field of data storage, and in particular to a multi-tenant implementation method, electronic device, and storage medium of a disk array system. Background Art

[0002] With the development of cloud computing, the Internet of Things and other technologies, information technology is increasingly used in various fields of society, and information security is of vital importance. In related technologies, business data is often stored on storage devices mainly based on disk array systems. In order to make full use of disk array resources, the concept of multi-tenancy came into being. Through hardware, network and virtualization isolation, different tenants can share the same disk array system while ensuring data security and privacy. Although multi-tenancy technology has advantages in achieving resource sharing and reducing costs, it is necessary to consider supporting multi-tenancy capabilities in the early stage of disk array system design, otherwise the cost of subsequent expansion is high. For users who originally did not consider multi-tenancy needs, how to quickly implement multi-tenancy capabilities on existing disk array systems has become a challenge. Summary of the invention

[0003] The present application provides a multi-tenant implementation method, an electronic device, and a storage medium for a disk array system, so as to at least solve the problem in the related art that multi-tenant capabilities cannot be quickly implemented on the existing disk array system.

[0004] The present application provides a multi-tenant implementation method for a disk array system, including: If the current disk array system needs to be upgraded to a version that supports multi-tenancy, a tenant identification parameter is added to the resource creation class interface in the interface layer of the current disk array system. The tenant identification parameter is used to indicate the tenant to which the created business resource belongs when creating a business resource; Modify the permission determination logic of the configuration management interface in the interface layer to isolate the configuration management of business resources of different tenants; Adding a correspondence between the tenant administrator group and the permission information of the tenant administrator group in the user group management module of the current disk array system; Reconstructing the user authority management module of the current disk array system so that the user authority management module records the user information of the users of the disk array system; Get a disk array system that supports multi-tenancy.

[0005] The present application also provides an electronic device, comprising: a memory for storing a computer program; and a processor for implementing the steps of any of the above-mentioned methods for implementing a multi-tenant disk array system when executing the computer program.

[0006] The present application also provides a computer-readable storage medium, in which a computer program is stored, wherein when the computer program is executed by a processor, the steps of any of the above-mentioned multi-tenant implementation methods of the disk array system are implemented.

[0007] The present application also provides a computer program product, including a computer program, which implements the steps of any of the above-mentioned multi-tenant implementation methods of the disk array system when the computer program is executed by a processor.

[0008] Through this application, by means of software upgrade, a tenant identification parameter is added to the resource creation class interface in the interface layer to indicate the tenant to which the created business resource belongs when creating a business resource, and the authority determination logic of the configuration management class interface is modified to isolate the business resources of different tenants for configuration management; the corresponding relationship between the tenant administrator group and the authority information of the tenant administrator group is added in the user management module; the user authority management module is reconstructed to record the user information of the disk array system user, thereby ensuring that different tenants are not aware of each other and that business resources are isolated, and a disk array system that supports multiple tenants is obtained. Therefore, the technical problem that the multi-tenant capability cannot be quickly realized on the existing disk array system can be solved, and the technical effect of quickly realizing the multi-tenant capability on the existing disk array system is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0010] Figure 1 A schematic diagram of the structure of a multi-tenant implementation system of a disk array system provided in an embodiment of the present application; Figure 2 A schematic diagram of a multi-tenant implementation method of a disk array system provided in an embodiment of the present application; Figure 3 A schematic diagram of the API interface division of a disk array system supporting multi-tenancy provided in an embodiment of the present application; Figure 4 A schematic diagram of resource division of a disk array system supporting multiple tenants provided in an embodiment of the present application; Figure 5 A flowchart of a multi-tenant implementation method of another disk array system provided in an embodiment of the present application; Figure 6 A flowchart of the target logic provided by an embodiment of the present application; Figure 7A schematic diagram of the structure of a user information table provided in an embodiment of the present application; Figure 8 A schematic diagram of the structure of a business resource information table provided in an embodiment of the present application; Fig. 9 A schematic diagram of the structure of a user group information table provided in an embodiment of the present application; Fig.10 A schematic diagram of the structure of the tenant information table provided in the embodiment of the present application; Fig.11 A schematic diagram of the structure of a disk array system supporting multiple tenants provided in an embodiment of the present application; Fig.12 A schematic diagram of the classification of users of a disk array system supporting multi-tenants provided in an embodiment of the present application; Fig.13 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0011] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0012] It should be noted that, in the description of this application, the terms "include", "comprise" or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. The terms "first", "second", etc. in this application are used to distinguish similar objects, and are not used to describe a specific order or sequence.

[0013] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0014] With the development of cloud computing, Internet of Things, mobile computing and other technologies, information technology is increasingly used in various fields of society, and information security is of vital importance. In today's data centers, business system data is regarded as a vital asset and is often stored on storage devices such as disk array systems, which constitute the core support of data centers.

[0015] As storage device capacity continues to increase and performance continues to improve, disk array resources are not fully utilized. In order to fully utilize disk array resources, the concept of multi-tenancy has emerged, which not only makes more full use of disk array resources, but also ensures data isolation between different tenants, so that different tenants use the same disk array system just like using a separate disk array system.

[0016] Multi-tenancy means building multiple virtual storage systems in a set of disk array physical storage devices, so that each tenant corresponds to a virtual storage system, providing multiple tenants with a flexible, easy-to-manage, and low-cost shared storage solution, while ensuring data security and privacy, so that each tenant can enjoy the experience of owning an independent dedicated storage system.

[0017] In the related art, there are three ways to implement multi-tenant capabilities on a disk array system: hardware isolation, network isolation, and virtualization isolation.

[0018] Among them, the hardware isolation method is: the central processing unit (CPU), memory, hard disk and other hardware resources of the disk array system are allocated to different tenants, so that each tenant logs in to the independent disk array system business software running on the hardware resources allocated to it, and uses their own disk array system business software to configure and manage the disk array resources.

[0019] Network isolation method: Different tenants use different logical Internet Protocol (IP) addresses, and different tenants configure and manage their own disk array resources by accessing different addresses. If tenants with the same logical IP address are in the same LAN, they need to be isolated through a virtual LAN (VLAN).

[0020] Virtualization isolation method: A disk array system is divided into multiple virtual storage partitions. One virtual storage partition corresponds to one tenant. Virtual storage partitions can be isolated by virtual machines or containers for use by different tenants.

[0021] Although the above three methods can realize multi-tenant capability on disk array system, they all need to consider multi-tenant capability support at the early stage of disk array system design, such as: hardware design considers multi-tenancy, virtualization software or operating system software considers multi-tenancy, disk array basic software supports multi-tenancy, etc. If the cost of expanding multi-tenant support during subsequent system maintenance is high. For users who did not consider multi-tenant needs when purchasing disk array systems, in the later stage, due to department splits, idle equipment, new business, etc., it is necessary to expand multi-tenant support on the current disk array system. How to quickly realize multi-tenant capability on the existing disk array system has become a challenge.

[0022] To solve the above problems, the embodiment of the present application provides a multi-tenant implementation method for a disk array system, the method comprising: if the current disk array system needs to be upgraded to a version that supports multi-tenancy, then a tenant identification parameter is added to the resource creation class interface in the interface layer of the current disk array system, the tenant identification parameter is used to indicate the tenant to which the created business resource belongs when creating a business resource; modify the authority determination logic of the configuration management class interface in the interface layer to perform configuration management isolation on the business resources of different tenants; add a correspondence between the tenant administrator group and the authority information of the tenant administrator group in the user group management module of the current disk array system; reconstruct the user authority management module of the current disk array system so that the user authority management module records the user information of the disk array system user; and obtain a disk array system that supports multi-tenancy. The method provided by the above scheme re-implements the interface layer of the disk array system on the basis of keeping the original hardware and basic software of the disk array system unchanged, reconstructs the original user authority management module and user group management module, ensures that different tenants are not aware of each other and the business resource is isolated, and realizes the technical effect of quickly realizing multi-tenant capabilities on the existing disk array system through software upgrade.

[0023] In order to enable those skilled in the art to better understand the method of the present application, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0024] In conjunction with the specific application environment architecture or specific hardware architecture on which the execution of the multi-tenant implementation method of the disk array system depends, the specific application environment architecture or the specific hardware architecture is described herein.

[0025] The disk array system multi-tenant implementation method, electronic device and storage medium provided in the embodiments of the present application are suitable for quickly implementing multi-tenant capabilities on a disk array system that does not support multi-tenant capabilities. Figure 1As shown, it is a structural schematic diagram of the multi-tenant implementation system of the disk array system based on the embodiment of the present application. The system mainly includes a client and a disk array system. The client is used to send an upgrade command to the disk array system, and the disk array system is used to receive the upgrade command issued by the client. In response to the upgrade command, the multi-tenant implementation method of the disk array system provided by the embodiment of the present application is executed to implement the upgrade of the disk array system and obtain a disk array system that supports multiple tenants.

[0026] The embodiment of the present application provides a multi-tenant implementation method of a disk array system, which is applied to a CPU in the disk array system. Figure 2 A flowchart of a multi-tenant implementation method of a disk array system provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, the process includes the following steps: Step S201, if the current disk array system needs to be upgraded to a version supporting multi-tenancy, a tenant identification parameter is added to the resource creation class interface in the interface layer of the current disk array system. The tenant identification parameter is used to indicate the tenant to which the created business resource belongs when creating a business resource.

[0027] Among them, the current disk array system is a disk array system that does not support multi-tenancy. In the case that the disk array system that does not support multi-tenancy needs to be upgraded to a disk array system that supports multi-tenancy, on the basis of keeping the original hardware and basic software of the disk array system unchanged, the interface layer, user authority management module, and user group management module in the current disk array system are targeted for research and development and modification to achieve support for multi-tenancy functions. Among them, the interface layer is the application programming interface (Application Programming Interface, referred to as: API) layer of the disk array system, that is, the API interface layer.

[0028] Figure 3 This is a schematic diagram of the API interface division of the disk array system supporting multi-tenants provided in the embodiment of the present application. Figure 3 As shown, in order to support multi-tenancy, all API interfaces of the interface layer of the current disk array system are divided into system API interfaces and tenant API interfaces. The tenant API interfaces can be divided into resource creation class API interfaces, i.e. resource creation class interfaces, and configuration management class API interfaces, i.e. configuration management class interfaces, according to resource operation types.

[0029] Among them, system users can operate all API interfaces, tenant users can only operate configuration management API interfaces, and the multi-tenant function only exposes configuration management API interfaces to each tenant. Resource creation interfaces can only be called by users who belong to the business administrator group among system administrators. Among them, the scope of action of system users is the entire disk array system.

[0030] Figure 4 A schematic diagram of resource division of a disk array system supporting multiple tenants provided in an embodiment of the present application. Figure 4 As shown, in order to support multi-tenancy, all resources of the current disk array system are divided into system resources and business resources, where business resources are divided into different tenants. The business resources allocated to each tenant can be tenant 1 resources, ..., tenant n resources, etc., and each tenant's business resources are divided into tenant global resources and tenant user resources. Among them, tenant global resources are tenant overall information, such as: the used space of the entire tenant, all users under the entire tenant, etc. Each ordinary tenant user can only operate the resources that the user has permission to in the tenant to which he belongs, and the tenant users in the tenant administrator group can access all resources under the tenant, thereby ensuring resource isolation between tenants.

[0031] It should be noted that the API interface in the embodiment of the present application is implemented through an interface function. A tenant identifier (ID) parameter is added to the resource creation class interface. The tenant identifier parameter indicates which tenant the currently created business resource (e.g., volume) belongs to. The default value of the parameter is the default tenant.

[0032] Step S202, modifying the permission determination logic of the configuration management interface in the interface layer to perform configuration management isolation on the business resources of different tenants.

[0033] Among them, at the interface layer, in addition to modifying the resource creation interface by adding a new tenant id parameter, it is also necessary to modify the permission determination logic of the configuration management interface, and add the tenant consistency check logic of users and business resources to the permission determination logic to isolate the configuration management of business resources of different tenants.

[0034] Step S203: adding a correspondence between the tenant administrator group and the permission information of the tenant administrator group in the user group management module of the current disk array system.

[0035] The modification made to the user group management module of the current disk array system is to add a correspondence between the tenant administrator group and the permission information of the tenant administrator group, so that users of the tenant administrator group can view all information of the tenant to which they belong, including other user information under the tenant, add users under the tenant, etc.

[0036] Step S204: reconstructing the user authority management module of the current disk array system so that the user authority management module records the user information of the users of the disk array system.

[0037] Among them, the modification made to the user authority management module of the current disk array system is to record two attributes that each disk array system user must contain, namely, the tenant and the user group. In other words, user information includes the tenant and the user group. The user group attribute represents the user's authority capability, and the tenant represents the user's authority scope.

[0038] Step S205: obtaining a disk array system supporting multiple tenants.

[0039] By executing the process from step S201 to step S204 on the current disk array system, a disk array system supporting multiple tenants is obtained.

[0040] The multi-tenant implementation method of the disk array system provided by the present application adds a tenant identification parameter in the resource creation class interface of the interface layer by means of software upgrade, so that each business resource is clearly associated with a specific tenant at the beginning of creation, which realizes the effective isolation of business resources of different tenants, and the business resources of each tenant are managed independently without interfering with each other. By modifying the authority determination logic of the configuration management class interface, strict isolation of business resources of different tenants is realized, and only users with corresponding tenant authority can perform configuration management operations on the resources of the tenant. By increasing the correspondence between the tenant administrator group and the authority information of the tenant administrator group, the user authority management module of the current disk array system is reconstructed so that the user authority management module records the user information of the disk array system users, so that different user roles have corresponding authority ranges, ensuring that different tenants are not aware of each other and the business resources are isolated, and realizing the technical effect of quickly realizing multi-tenant capabilities on the existing disk array system.

[0041] The embodiment of the present application provides a multi-tenant implementation method of a disk array system, which is applied to a CPU in the disk array system. Figure 5 A flowchart of a multi-tenant implementation method of a disk array system provided in an embodiment of the present application is shown in FIG. Figure 5 As shown, the process includes the following steps: Step S501: If the current disk array system needs to be upgraded to a version that supports multi-tenancy, a tenant identification parameter is added to the resource creation class interface in the interface layer of the current disk array system. The tenant identification parameter is used to indicate the tenant to which the created business resource belongs when creating a business resource. For details, see Figure 2 Step S201 of the illustrated embodiment will not be described in detail here.

[0042] Step S502: modify the permission determination logic of the configuration management interface in the interface layer to perform configuration management isolation on the business resources of different tenants.

[0043] Specifically, the above step S502 includes: Step S5021, modify the permission determination logic of the configuration management interface to the following target logic: Receive configuration management requests for the disk array system. All external access to the disk array system must pass through the API interface layer. The API interface layer interacts with the user rights management module to determine whether the corresponding API interface has permission to execute in the tenant environment. The user rights management module depends on the user group management module and the tenant management module.

[0044] Obtain the target disk array system user ID and configuration management information in the configuration management request.

[0045] Figure 6 Flowchart of the target logic of the embodiment of the present application. Figure 6 As shown, a configuration management request for the disk array system is received, that is, a call to the configuration management class interface is received.

[0046] Obtain the API operation user, that is, obtain the user who calls the configuration management class interface. In this embodiment of the application, the target disk array system user identifier and configuration management information of the user who calls the configuration management class interface, that is, the target disk array system user, are obtained from the configuration management request.

[0047] The target user information corresponding to the target disk array system user identification is obtained from the user authority management module, wherein each disk array system user corresponds to a unique disk array system user identification, ie, user id.

[0048] It should be noted that the user rights management module records the user information of the disk array system users through the user information table. Figure 7 This is a schematic diagram of the structure of the user information table provided in the embodiment of the present application. Figure 7 As shown in the figure, the user information table records the user information of each disk array system user, such as user 1, user 2, user 3, etc. The user information includes user id, user name, user group id, tenant id, and other user attributes. A tenant id of -1 means that the disk array system user is a system user and does not belong to any tenant. A tenant id of 0 means that it is the default tenant. Among them, the user group id in the user information table is used to associate with the user group information table to obtain the user's permission information, and the tenant information in the user information table is used to associate with the tenant information table, so as to limit the scope of the business resource configuration management interface of the corresponding tenant user to the scope of the tenant.

[0049] Based on the user information table, target user information corresponding to the target disk array system user identifier is obtained.

[0050] Based on the target user information and the configuration management information, a determination is made as to whether the configuration management request is allowed to be executed.

[0051] Step S503: Add a correspondence between the tenant administrator group and the permission information of the tenant administrator group in the user group management module of the current disk array system. Figure 2 Step S203 of the illustrated embodiment will not be described in detail here.

[0052] Step S504: Reconstruct the user rights management module of the current disk array system so that the user rights management module records the user information of the disk array system users. Figure 2 Step S204 of the illustrated embodiment will not be described in detail here.

[0053] Step S505: Obtain a disk array system that supports multiple tenants. Figure 2 Step S205 of the illustrated embodiment will not be described in detail here.

[0054] The multi-tenant implementation method of the disk array system provided by the present application obtains the target user information corresponding to the target disk array system user representation, and determines whether to allow the configuration management request based on the target user information and the configuration management information, thereby ensuring that the business resources between different tenants are strictly isolated from the configuration management, avoiding the operation of one tenant from affecting the data or configuration of other tenants, and enhancing the security of the overall system.

[0055] In some optional implementations, the multi-tenant implementation method of the disk array system further includes: Step a1: each time a service resource is created, the corresponding relationship between the service resource identifier corresponding to the service resource and the tenant identifier of the tenant to which the service resource belongs is added to the service resource information table of the interface layer for persistent storage in the disk array system.

[0056] Figure 8 A schematic diagram of the structure of the service resource information table provided in the embodiment of the present application, such as Figure 8 As shown, taking the business resource as a volume as an example, the business resource information table includes the correspondence between the business resource identifier of each business resource and the tenant identifier of the tenant to which the business resource belongs, that is, the tenant ID, the volume name, and other volume attributes. Other volume attributes are other original resource attributes of the volume.

[0057] By recording the correspondence between the business resource identifier and the tenant identifier, the business resource isolation between different tenants is ensured, and only tenant users belonging to the tenant and system users with permissions can access the business resources.

[0058] By setting the business resource information table, when the configuration management interface receives a configuration management request, permission determination is performed based on the business resource information table.

[0059] The multi-tenant implementation method of the disk array system provided in the present application ensures that each business resource is clearly attributed to a specific tenant by adding the corresponding relationship between the business resource identifier corresponding to the business resource and the tenant identifier of the tenant to which the business resource belongs to the business resource information table of the interface layer, thereby avoiding the problem of unclear resource ownership, helping to more accurately track the ownership of each business resource and ensuring the accuracy of resource allocation.

[0060] In some optional implementations, the target logic determines whether to allow the configuration management request to be executed based on the target user information and the configuration management information, including: Step b1: determining a target user group identifier of a target user group to which a target disk array system user belongs based on the target user information.

[0061] like Figure 6 As shown, after obtaining the API operation user, the user group is obtained according to the user, that is, based on the target user information, the target user group identifier of the target user group to which the target disk array system user belongs is determined.

[0062] Step b2: based on the target user group identifier, obtaining permission information corresponding to the target user group identifier from the user group management module, wherein each user group corresponds to a unique user group identifier.

[0063] The associated authority is obtained according to the user group, that is, based on the target user group identifier, the authority information corresponding to the target user group identifier is obtained from the user group management module.

[0064] It should be noted that the user group management module records the correspondence between user groups and their permission information through the user group information table. The user group information table stores all user group information in the disk array system, that is, the correspondence between all user groups and their permission information. User groups are used to implement static permission control and custom permission control based on roles in the disk array system. Fig. 9 A schematic diagram of the structure of the user group information table provided in the embodiment of the present application, such as Fig. 9 As shown, the user management module of the disk array system supporting multiple tenants includes the corresponding relationship between the user group and the permission information of the user group, and the user group identifier is the group ID.

[0065] The permission information of a user group includes static permissions and custom permissions. If the static permission is user-defined (UserDefined), it means that the permission information of the user group is custom permissions. Custom permissions are stored after static permissions, such as Fig. 9 Custom permissions (1), custom permissions (2), ..., custom permissions (n) in.

[0066] The static permission is the audit administrator group (Monitor), indicating that the user group is the audit administrator group, and the static permission is the static permission corresponding to the audit administrator group.

[0067] The static permission is the security administrator group (SecurityAdmin), indicating that the user group is the security administrator group, and the static permission is the static permission corresponding to the security administrator group.

[0068] The static permission of TenantAdmin indicates that this user group is a tenant administrator group newly added for the multi-tenant function. This static permission is the static permission corresponding to the tenant administrator.

[0069] It should be noted that when static permissions are user-defined, the subsequent custom permission list must be set.

[0070] Step b3, determining whether the configuration management information satisfies the authority information corresponding to the target user group identifier.

[0071] By comparing the actual operation of the API interface call with the specific permissions of the user, it is determined whether the API is allowed to be executed. In other words, it is determined whether the configuration management information meets the permission information corresponding to the target user group identifier.

[0072] Step b4: if the configuration management information satisfies the authority information corresponding to the target user group identifier, then the target service resource identifier in the configuration management information is obtained.

[0073] If the configuration management information satisfies the permission information corresponding to the target user group identifier, it means that the API is allowed to be executed, that is, the subsequent process can be continued.

[0074] When the API is allowed to be executed, the tenant ID to which the API object belongs is obtained, that is, the target business resource identifier in the configuration management information is obtained, and the first tenant identifier corresponding to the target business resource identifier is determined according to the target business resource identifier.

[0075] Step b5: Determine the first tenant identifier corresponding to the target business resource identifier based on the business resource information table of the interface layer.

[0076] The business resource information table includes the correspondence between business resource identifiers and tenant identifiers. After obtaining the target business resource identifier, the first tenant identifier corresponding to the target business resource identifier can be determined according to the business resource information table, that is, the tenant ID of the target business resource corresponding to the target business resource identifier.

[0077] Step b6: determining the second tenant identifier of the second tenant to which the target disk array system user belongs based on the target user information.

[0078] The tenant ID of the user is obtained, that is, the tenant ID of the API interface caller is obtained, that is, based on the target user information corresponding to the target disk array system user ID, the second tenant ID of the second tenant to which the target disk array system user belongs is determined.

[0079] Step b7: determine whether the first tenant identifier and the second tenant identifier are consistent.

[0080] Among them, it is determined whether the first tenant identifier and the second tenant identifier are consistent, that is, whether the tenant IDs of the object (such as a volume) and the subject (API interface caller user) are consistent, that is, whether the object and the user tenant are consistent.

[0081] Step b8: If the first tenant identifier and the second tenant identifier are consistent, it is determined that the configuration management request is allowed to be executed.

[0082] If the first tenant identifier and the second tenant identifier are consistent, it is determined that the configuration management request is allowed to be executed, and the disk array system executes the configuration management request based on the configuration management information. That is, the API interface call is successful, and the process ends.

[0083] The multi-tenant implementation method of the disk array system provided by the present application realizes fine-grained permission control of the user's configuration management operation by obtaining corresponding permission information based on the target user group identifier and judging whether the configuration management information satisfies the permission information. After verifying the user group permissions, the first tenant identifier corresponding to the target business resource identifier and the second tenant identifier of the second tenant to which the target disk array system user belongs are further compared to see whether they are consistent, ensuring that each tenant can only perform configuration management on its own business resources, avoiding resource confusion and data leakage between different tenants, realizing effective isolation of tenant resources, and providing each tenant with an independent and secure use environment.

[0084] In some optional implementations, the target logic further includes: Step c1: If the configuration management information does not satisfy the authority information corresponding to the target user group identifier, it is determined that the configuration management request is not allowed to be executed.

[0085] Among them, if the configuration management information does not meet the permission information corresponding to the target user group identifier, that is, the API is not allowed to be executed, it is determined that the configuration management request is not allowed to be executed, that is, the API interface call fails, and the process ends.

[0086] The multi-tenant implementation method of the disk array system provided by the present application determines that the configuration management request is not allowed to be executed when the configuration management information does not meet the permission information corresponding to the target user group identifier, thereby effectively preventing illegal operations, protecting the system and data security, and avoiding data leakage.

[0087] In some optional implementations, the target logic further includes: Step d1: If the first tenant identifier and the second tenant identifier are inconsistent, it is determined that the configuration management request is not allowed to be executed.

[0088] If the first tenant identifier and the second tenant identifier are inconsistent, the API interface call fails, and it is determined that the configuration management request is not allowed to be executed, and the process ends.

[0089] The multi-tenant implementation method of the disk array system provided in the present application determines that the configuration management request is not allowed to be executed when the first tenant identifier and the second tenant identifier are inconsistent, thereby ensuring that each tenant can only manage its own business resources, avoiding misoperation of business resources, improving the accuracy and security of resource management, and realizing the isolation of business resources for multiple tenants.

[0090] In some optional embodiments, the user group management module in a disk array system that supports multiple tenants includes a correspondence between user groups and user group permission information, the user group permission information includes static permissions, and the user groups include a security administrator group, a tenant administrator group, an audit administrator group, and a business administrator group.

[0091] The static permissions of the security administrator group include creating or managing users, creating or managing tenants, setting access control, and creating and associating roles or permissions.

[0092] The static permissions of the tenant administrator group include viewing the corresponding tenant information, creating corresponding tenant users, etc. The corresponding tenant information refers to the information of the tenant to which it belongs. Ordinary tenant users can only view the tenant user's own information.

[0093] The static permissions of the audit administrator group include viewing or managing the execution results and execution logs of configuration management requests and performing audit log checks. They do not have access to storage, configuration, or data.

[0094] The static permissions of the business administrator group include creation and configuration management of business resources, etc. Configuration management includes viewing and modification, such as the creation, modification and viewing of remote replication services by remote replication operators, etc. Access to security-related elements or data is not allowed. Among them, the business administrator group can be divided into multiple groups according to specific businesses, such as volume administrator group, remote replication administrator group, etc.

[0095] It should be noted that the above user groups and the permission information of the user groups can be modified according to the disk array systems of different manufacturers, and no specific limitation is made here.

[0096] If the above user group types are set, that is, the user group includes the security administrator group, tenant administrator group, audit administrator group, and business administrator group, the permission information of the user group, that is, the static permissions, is fixed and cannot be modified.

[0097] The multi-tenant implementation method of the disk array system provided in the present application strictly isolates the permission information between different user groups by clarifying the permission information of each user group, thereby reducing the risk of system failure or data leakage caused by misoperation or malicious operation.

[0098] In some optional implementations, the user group further includes a custom user group, the permission information of the user group includes custom permissions, and the above target logic further includes: Step e1: when the user group management module does not include the target user group corresponding to the target user group identifier, a custom user group is set in the user group management module, and the target user group is determined to be a custom user group.

[0099] Step e2: setting the permission information of the custom user group to the custom permission input by the user.

[0100] The static permissions are user-defined, indicating that the user's permission information is a custom permission, and the permission information of the custom user group can be set or expanded by the user.

[0101] The multi-tenant implementation method of the disk array system provided in the present application not only improves the flexibility and adaptability of the system by introducing the functions of custom user groups and custom permissions, but also enhances the sophistication of permission management and supports scalability in a multi-tenant environment.

[0102] In some optional implementations, the multi-tenant implementation method of the disk array system further includes: Step f1, adding a tenant management module in the current disk array system, the tenant management module is used to store and manage the attribute information of each tenant, wherein the attribute information at least includes a list of business resources belonging to the tenant.

[0103] The tenant management module saves and manages the attribute information of each tenant through the tenant information table. Fig.10 A schematic diagram of the structure of the tenant information table provided in the embodiment of the present application, such as Fig.10 As shown, the tenant information table includes the correspondence between the tenant ID of each tenant and the attribute information of each tenant. The attribute information includes the business resource list belonging to the tenant, that is, the associated resource list, the tenant name, the tenant quota and other tenant attributes. The tenant ID in the tenant information table starts from 0. The tenant ID of 0 means that the tenant is the default tenant (Default_tenant).

[0104] After each business resource is successfully created, the corresponding business resource identifier must also be updated in the associated resource list field of the tenant information table.

[0105] It should be noted that only users belonging to the security administrator group among system administrators can create tenants. The tenant management module is used to record the relevant information of the tenants that have been created in the disk array system.

[0106] Fig.11 This is a schematic diagram of the structure of a disk array system supporting multiple tenants provided in an embodiment of the present application. Fig.11 As shown, the disk array system supporting multi-tenants includes the original hardware of the disk array system, the basic software of the disk array system, the interface layer of the disk array system, the user authority management module, the user group management module, and the tenant management module.

[0107] Among them, the interface layer of the disk array system is used to receive external calls, that is, receive external access, and determine whether the external access is allowed based on the user authority management module and the user group management module, so that the CPU of the disk array system executes the external access or does not execute the external access based on the determination result.

[0108] The tenant management module is used to record the relevant information of the tenants created in the disk array system to facilitate the query of all resources owned by a tenant.

[0109] The purposes of the user authority management module and the user group management module are as described above and will not be repeated here.

[0110] The multi-tenant implementation method of the disk array system provided in the present application, by adding a tenant management module, makes the system's grasp of each tenant's resources clearer and more accurate, thereby achieving efficient allocation, scheduling and monitoring of resources, which helps to ensure data security.

[0111] In some optional implementations, the multi-tenant implementation method of the disk array system further includes: Step g1: If there are service resources that are not bound to a specific tenant in the current disk array system, the tenant to which the service resources that are not bound to a specific tenant belong is determined as a default tenant.

[0112] To ensure the backward compatibility of the software, a default tenant is introduced. If there are business resources not bound to a specific tenant in the current disk array system, the tenant to which the business resources not bound to a specific tenant belong is determined as the default tenant.

[0113] Step g2: in the process of upgrading the current disk array system to a disk array system supporting multiple tenants, create a user as a default tenant in the tenant administrator group.

[0114] When upgrading from a lower version that does not support multi-tenancy to a higher version that supports multi-tenancy, the tenant attributes of the business resources in the current disk array system automatically become the default tenant, and the upgrade process automatically creates a user in the tenant administrator group of the default tenant to facilitate configuration and management after the upgrade. In this way, whether it is the development of new multi-tenancy functions or the upgrade of the existing disk array system to support multi-tenancy capabilities, it can be well compatible, while taking into account security and convenience.

[0115] That is to say, the multi-tenant implementation method of the disk array system provided in the present application can also be used in the early stage of the disk array system design to realize the multi-tenant function of the disk array system.

[0116] The multi-tenant implementation method of the disk array system provided in the present application can realize a smooth transition of the system from a single-tenant to a multi-tenant architecture by assigning some old resources that may not be bound to a specific tenant to the default tenant when upgrading the current disk array system. This method avoids the loss or confusion of resources during the upgrade process, ensures that the system can operate normally after the upgrade, and reduces the risks and costs brought by the upgrade. At the same time, a user is created for the default tenant in the tenant administrator group, so that the upgraded system can effectively manage these old resources, ensure the compatibility of the system, and enable the new architecture to be seamlessly compatible with the data and operation mode of the old system.

[0117] In some optional implementations, the multi-tenant implementation method of the disk array system further includes: Step h1: Set the system administrators who belong to the business administrator group to have the authority to call the resource creation interface.

[0118] Step h2: Set the tenant user to have the permission to call the configuration management interface.

[0119] The scope of a tenant user is the tenant to which it belongs.

[0120] Fig.12 A schematic diagram of the classification of users of a disk array system supporting multiple tenants provided in an embodiment of the present application. Fig.12 As shown in the figure, all users of the disk array system supporting multi-tenancy can be divided into system users and tenant users. System users can be divided into security administrator group users, audit administrator group users, business administrator group users, and custom user group users, i.e., custom permission administrator users, etc., according to the user groups they belong to. Tenant users can be divided into tenant administrator group users, common tenant users, and custom user group users, etc., according to the user groups they belong to.

[0121] The multi-tenant implementation method of the disk array system provided by the present application effectively prevents non-professionals or ordinary tenant users from creating resources at will by strictly restricting only users in the business administrator group to call resource creation interfaces, avoiding the abuse and waste of resources, and ensuring the security and stability of system resources. Tenant users can only call configuration management interfaces, and the scope of authority is limited to the tenant to which they belong, which ensures that tenant users can only configure and manage their own resources, prevents unauthorized operations across tenants, and protects the independence and security of each tenant's data.

[0122] In some optional implementations, the multi-tenant implementation method of the disk array system further includes: When a resource creation class interface of a disk array system supporting multiple tenants is called to create a service resource, a third tenant identifier of a third tenant to which the created service resource belongs is obtained.

[0123] Based on the third tenant identifier, attribute information of the third tenant corresponding to the third tenant identifier is obtained from the tenant management module.

[0124] Based on the tenant quota and the associated resource list in the attribute information of the third tenant, it is determined whether the business resources associated with the third tenant exceed a preset amount, the preset amount being set based on the tenant quota. The associated resource list includes the business resources associated with the third tenant.

[0125] If the business resources associated with the third tenant exceed the preset amount, information is returned that the business resources cannot be bound to the third tenant, so that the user can reset the tenant to which the created business resources belong.

[0126] If the business resources associated with the third tenant do not exceed the preset amount, it is determined that the created business resources successfully belong to the third tenant.

[0127] The multi-tenant implementation method of the disk array system provided in this embodiment obtains the attribute information of the third tenant, including the tenant quota and the associated resource list, and compares the business resources associated with the third tenant with the preset quota to ensure that the business resources used by each tenant are within a reasonable range. This helps the system to achieve refined resource allocation, avoid excessive resource occupation by individual tenants, improve resource utilization, and ensure fairness and rationality of resource allocation in a multi-tenant environment.

[0128] In summary, the multi-tenant implementation method of the disk array system provided by the embodiment of the present application keeps the original hardware and basic software in the current disk array system unchanged, adds a tenant management software module, and introduces a tenant information table in the tenant management module to save all tenant information in the system. A tenant administrator user group is added to the user group management module in the current disk array system, and users of the tenant administrator user group can view all information under the corresponding tenant. A user information table is set in the user rights management module in the current disk array system to save all user information in the system. The user information table contains user group and tenant fields, which are used to record the user group corresponding to each user (there are corresponding operation permissions in the user group) and the corresponding tenant information. The API interface layer of the current disk array system needs to be modified accordingly for the introduced tenant concept, and the business resource information table in the system needs to add a tenant id field to record the tenant identifier to which it belongs when the business resource is created, which requires the resource creation class API interface to add a tenant id parameter. The permission judgment logic of all configuration management class API interfaces needs to be modified. On the basis of matching the original user group permissions and actual operation permissions, it is also necessary to match the consistency of the tenants to which the subject and object belong. By modifying the disk array business software API interface layer, adding a tenant management module, and reconstructing the user authority management module and user group management module, multi-tenant resource isolation and access control of the disk array system are realized at the software level, which not only ensures the ability of a disk array system to be virtualized into multiple independent devices, but also ensures the backward compatibility of the disk array system, while providing convenience and security.

[0129] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method.

[0130] The embodiment of the present application also provides an electronic device, such as Fig.13 As shown, it includes a processor 1301 and a memory 1302, in which a computer program is stored. The processor 1301 is configured to run the computer program to execute the steps in any of the above-mentioned multi-tenant implementation method embodiments of the disk array system.

[0131] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above-mentioned multi-tenant implementation method embodiments of the disk array system when running.

[0132] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0133] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps in any of the above-mentioned multi-tenant implementation method embodiments of the disk array system are implemented.

[0134] An embodiment of the present application also provides another computer program product, including a non-volatile computer-readable storage medium, the non-volatile computer-readable storage medium storing a computer program, and when the computer program is executed by a processor, the steps in any of the above-mentioned multi-tenant implementation method embodiments of the disk array system are implemented.

[0135] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0136] The above is a detailed introduction to a multi-tenant implementation method, electronic device and storage medium of a disk array system provided by the present application. This article uses specific examples to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core idea of ​​the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

Claims

1. A method for implementing multi-tenancy in a disk array system, characterized in that: include: If the current disk array system needs to be upgraded to a version that supports multi-tenancy, a tenant identification parameter is added to the resource creation class interface in the interface layer of the current disk array system. The tenant identification parameter is used to indicate the tenant to which the created business resource belongs when creating a business resource; Modify the permission determination logic of the configuration management interface in the interface layer to isolate the configuration management of business resources of different tenants; Adding a correspondence between a tenant administrator group and permission information of the tenant administrator group in a user group management module of the current disk array system; Reconstructing the user authority management module of the current disk array system so that the user authority management module records the user information of the users of the disk array system; Get a disk array system that supports multi-tenancy.

2. The multi-tenant implementation method of the disk array system according to claim 1, characterized in that: The method further comprises: Each time a business resource is created, the correspondence between the business resource identifier corresponding to the business resource and the tenant identifier of the tenant to which the business resource belongs is added to the business resource information table of the interface layer.

3. The multi-tenant implementation method of the disk array system according to claim 1, characterized in that: The step of modifying the permission determination logic of the configuration management interface in the interface layer to perform configuration management isolation on business resources of different tenants includes: Modify the permission determination logic of the configuration management interface to the following target logic: Receiving a configuration management request for the disk array system; Obtaining the target disk array system user identification and configuration management information in the configuration management request; Acquire target user information corresponding to the target disk array system user identifier from the user authority management module, wherein each disk array system user corresponds to a unique disk array system user identifier; Based on the target user information and the configuration management information, it is determined whether to allow the configuration management request to be executed.

4. The method for implementing multi-tenancy of a disk array system according to claim 3, characterized in that: The target logic determines whether to allow the configuration management request to be executed based on the target user information and the configuration management information, including: Based on the target user information, determining a target user group identifier of a target user group to which the target disk array system user belongs; Based on the target user group identifier, obtaining permission information corresponding to the target user group identifier from the user group management module, wherein each user group corresponds to a unique user group identifier; Determining whether the configuration management information satisfies the authority information corresponding to the target user group identifier; If the configuration management information satisfies the authority information corresponding to the target user group identifier, obtaining the target service resource identifier in the configuration management information; Determine, based on the service resource information table of the interface layer, a first tenant identifier corresponding to the target service resource identifier; Based on the target user information, determining a second tenant identifier of a second tenant to which the target disk array system user belongs; Determining whether the first tenant identifier and the second tenant identifier are consistent; If the first tenant identifier and the second tenant identifier are consistent, it is determined that the configuration management request is allowed to be executed.

5. The method for implementing multi-tenancy of a disk array system according to claim 4, characterized in that: The target logic also includes: If the configuration management information does not satisfy the authority information corresponding to the target user group identifier, it is determined that the configuration management request is not allowed to be executed.

6. The method for implementing multi-tenancy of a disk array system according to claim 4, characterized in that: The target logic also includes: If the first tenant identifier and the second tenant identifier are inconsistent, it is determined that the configuration management request is not allowed to be executed.

7. The method for implementing multi-tenancy of a disk array system according to claim 4, characterized in that: The user group management module in the disk array system supporting multiple tenants includes a correspondence between user groups and permission information of user groups, wherein the permission information of the user groups includes static permissions, and the user groups include a security administrator group, a tenant administrator group, an audit administrator group, and a business administrator group; The static permissions of the security administrator group include creating or managing users and creating or managing tenants; The static permissions of the tenant administrator group include viewing corresponding tenant information and creating corresponding tenant users; The static permissions of the audit administrator group include viewing or managing the execution results and execution logs of configuration management requests; The static permissions of the business administrator group include creation and configuration management of business resources.

8. The method for implementing multi-tenancy of a disk array system according to claim 7, characterized in that: The static permissions are fixed and cannot be modified.

9. The method for implementing multi-tenancy of a disk array system according to claim 7, characterized in that: The user group also includes a custom user group, the permission information of the user group includes custom permissions, and the target logic further includes: In a case where the user group management module does not include the target user group corresponding to the target user group identifier, setting a custom user group in the user group management module, and determining that the target user group is the custom user group; The permission information of the custom user group is set to the custom permission input by the user.

10. The method for implementing multi-tenancy of a disk array system according to claim 1, characterized in that: The method further comprises: A tenant management module is added to the current disk array system, and the tenant management module is used to store and manage attribute information of each tenant, wherein the attribute information at least includes a list of business resources belonging to the tenant.

11. The method for implementing multi-tenancy of a disk array system according to claim 1, characterized in that: The method further comprises: If there are service resources that are not bound to a specific tenant in the current disk array system, the tenant to which the service resources that are not bound to a specific tenant belong is determined as a default tenant; In the process of upgrading the current disk array system to a disk array system supporting multiple tenants, a user is created in the tenant administrator group as the default tenant.

12. The method for implementing multi-tenancy of a disk array system according to claim 1, characterized in that: The method further comprises: Setting the user who belongs to the business administrator group among the system administrators to have the calling authority of the resource creation class interface; Set the tenant user to have the permission to call the configuration management interface.

13. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the multi-tenant implementation method of the disk array system as claimed in any one of claims 1 to 12 when executing the computer program.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of the multi-tenant implementation method of the disk array system according to any one of claims 1 to 12.

15. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the multi-tenant implementation method of the disk array system as claimed in any one of claims 1 to 12 are implemented.

Images