Multi-tenant user and device corresponding authority management system and method

Abstract

The invention provides a multi-tenant user and device corresponding authority management system and method. The multi-tenant user and equipment corresponding authority management system comprises an administrator unit, a user management unit and an equipment management unit, the administrator unit is used for performing administrator level-to-level management on the data; the user management unit is used for performing empowerment operation and management on each user; and the equipment management unit is used for adjusting the mounted resources into equipment and associating the equipment authority with the user. The method comprises steps corresponding to the system module.

Description

Technical Field

[0001] The present invention provides a multi-tenant user and device corresponding authority management system and method, belonging to the technical field of authority management. Background Art

[0002] The platform sets up System account management configuration and management groups. The content of the management group is visible and manageable to the administrators in the same group, and the data is isolated. The administrator's authority varies with the group. User groups share resources, and users can see the allocated resources. User permissions are controlled by user groups and roles. Roles are multi-device permission sets that can be edited and assigned. The platform setting up System account management in the prior art has the following technical problems:

[0003] (1) The Administrator role currently lacks real functionality and cannot be assigned.

[0004] (2) The roles and their submodule devices are not isolated according to the management group, resulting in a split in the control of industrial equipment and submodule devices. Summary of the invention

[0005] The present invention provides a multi-tenant user and device corresponding rights management system and method to solve the above technical problems existing in the prior art. The technical solutions adopted are as follows:

[0006] A multi-tenant user and device corresponding authority management system, the multi-tenant user and device corresponding authority management system comprising an administrator unit, a user management unit and a device management unit;

[0007] The administrator unit is used to perform hierarchical management of data by administrators;

[0008] The user management unit is used to perform authorization operations and management on each user;

[0009] The device management unit is used to adjust the mounted resources to devices and associate device permissions with users.

[0010] Further, the administrator unit includes an administrator group module and an administrator module;

[0011] The administrator group module is used to isolate data at the administrator group level. Data created by different administrator groups are not visible to each other. At the same time, all configurations under different administrator groups do not interfere with each other. In addition, all administrators under the same administrator group have the same operation permissions and device permissions.

[0012] The administrator module is used to operate and manage the resources under the management group of the administrator account, and to grant rights to the user group so that the user accounts included in the user group have the rights of some devices; wherein the resources include but are not limited to user groups, users, user trees, devices, electronic maps, data cockpits, rule chains, etc.

[0013] Among them, the administrator is an account with a special identity, which is saved in the same data table as the user's account, but the identity is different and the corresponding visible pages are also different.

[0014] Further, the user management unit includes a user group management module, a user management module and a user organization management module;

[0015] The user group management module is used to manage the permissions of resources held by all users contained in it, wherein users in a user group are only allowed to perform creation operations, deletion operations, and modification of basic information operations, and it is not allowed to move users from one user group to another;

[0016] The user management module is used to hold an account of a user identity and to perform visible display and operation management of resources authorized by the user;

[0017] The user organization management module is used for display optimization when displaying users, but does not involve user authority management capabilities.

[0018] Further, the device management unit includes a device organization module, a device authority module and a device authentication module;

[0019] The device organization module is used to adjust the mounted resources to devices. The device organization module is only used for display optimization and does not involve any permissions. When the device is created, a node is selected for mounting, which can be modified and moved later.

[0020] The device permission module is used to associate device permissions with users. The authorization of device permissions is handled by the microservice. After the microservice completes the authorization, it calls the RPC interface to inform this service, which is then recorded and stored uniformly by this service.

[0021] The device authentication module is used to control the microservice to call the authentication interface to the service when the front-end Web specifically requests the device tree or device-related data or directly operates the device to determine whether the user holds the device permission; if the user holds the permission, it can proceed normally; otherwise, an error message is returned.

[0022] Furthermore, the multi-tenant user and device corresponding rights management system also includes:

[0023] A real-time monitoring module, used to monitor in real time the operating load parameters of each unit time of the permission management system corresponding to users and devices under the multi-tenant; wherein the operating load parameters include CPU usage, memory utilization, I / O data size and concurrent task processing volume;

[0024] A comparison module, used for comparing the CPU usage rate and the memory utilization rate with a preset CPU usage rate threshold and a preset memory utilization rate threshold;

[0025] A first load intensity evaluation coefficient acquisition module, configured to acquire a first load intensity evaluation coefficient by using the CPU usage, the memory usage, the I / O data size, and the concurrent task processing amount when the CPU usage exceeds a preset CPU usage threshold and the memory usage exceeds a preset memory usage threshold;

[0026] The first load intensity evaluation coefficient is obtained by the following formula:

[0027]

[0028] Among them, L 01 represents the first load intensity evaluation coefficient; n represents the number of unit time experienced by the operation of the corresponding permission management system for users and devices under multi-tenants; P ci represents the CPU usage corresponding to the i-th unit time; P ni represents the memory utilization rate corresponding to the i-th unit time; K i Indicates the I / O data size corresponding to the i-th unit time; K c Indicates the preset I / O data size reference value; T i represents the concurrent task processing volume corresponding to the i-th unit time; P nm Indicates the memory utilization value that exceeds the preset memory utilization threshold; P cm Indicates the CPU usage value that exceeds the preset CPU usage threshold;

[0029] A second load intensity evaluation coefficient acquisition module, configured to acquire a second load intensity evaluation coefficient by using the CPU usage, memory usage, I / O data size, and concurrent task processing amount when the CPU usage exceeds a preset CPU usage threshold, or the memory usage exceeds a preset memory usage threshold;

[0030] The second load intensity evaluation coefficient is obtained by the following formula:

[0031]

[0032] Among them, L 02represents the second load intensity evaluation coefficient; n represents the number of unit time experienced by the operation of the corresponding permission management system for users and devices under multi-tenants; P ci represents the CPU usage corresponding to the i-th unit time; P ni represents the memory utilization rate corresponding to the i-th unit time; K i Indicates the I / O data size corresponding to the i-th unit time; K c Indicates the preset I / O data size reference value; T i Indicates the amount of concurrent tasks processed corresponding to the i-th unit time;

[0033] a first alarm module, configured to compare the first load intensity evaluation coefficient with a preset first load intensity evaluation coefficient threshold value, and when the first load intensity evaluation coefficient exceeds the preset first load intensity evaluation coefficient threshold value, determine that the system load is overloaded, and issue an overload alarm;

[0034] The second alarm module is used to compare the second load intensity evaluation coefficient with a preset second load intensity evaluation coefficient threshold. When the second load intensity evaluation coefficient exceeds the preset second load intensity evaluation coefficient threshold, it is determined that the system load is overloaded and an overload alarm is issued.

[0035] A method for managing permissions between users and devices under multi-tenancy, the method comprising an administrator unit, a user management unit and a device management unit;

[0036] Conduct hierarchical management of data by administrators;

[0037] Empower and manage each user;

[0038] Adjust the mounted resources to devices and associate device permissions with users.

[0039] Furthermore, the administrator-level management of data includes:

[0040] Data is isolated at the administrator group level. Data created by different administrator groups are not visible to each other. At the same time, all configurations under different administrator groups do not interfere with each other. In addition, all administrators under the same administrator group have the same operation permissions and device permissions.

[0041] Operate and manage the resources under the management group of the administrator account, and grant permissions to the user group so that the user accounts contained in the user group have the permissions of some devices; the resources include but are not limited to user groups, users, user trees, devices, electronic maps, data cockpits, rule chains, etc.

[0042] Among them, the administrator is an account with a special identity, which is saved in the same data table as the user's account, but the identity is different and the corresponding visible pages are also different.

[0043] Furthermore, the authorization operation and management of each user includes:

[0044] Manage the permissions of resources held by all users in the group. Users in the group are only allowed to create, delete, and modify basic information. Moving users from one group to another is not allowed.

[0045] An account that holds a user's identity and provides visible display and operational management of the resources that the user is authorized to use;

[0046] Display optimization when displaying users, but does not involve user permission management capabilities.

[0047] Furthermore, adjusting the mounted resource to a device and associating the device authority with the user includes:

[0048] Adjust the mounted resources to devices, where the device organization module is only used for display optimization and does not involve any permissions. In addition, when the device is created, a node is selected for mounting, which can be modified and moved later.

[0049] The device permissions are associated with the user. The authorization of the device permissions is handled by the microservice. After the microservice completes the authorization, it notifies this service through the RPC interface call, and this service records and stores it uniformly.

[0050] When the front-end Web specifically requests the device tree or device-related data or directly operates the device from the microservice, the control microservice calls the authentication interface to this service to determine whether the user holds the device permission; if the user holds the permission, it can proceed normally; otherwise, an error message is returned.

[0051] Furthermore, the method for managing permissions between users and devices under multi-tenancy also includes:

[0052] Real-time monitoring of the operating load parameters of each unit time of the permission management system corresponding to users and devices under the multi-tenant; wherein the operating load parameters include CPU usage, memory utilization, I / O data size and concurrent task processing volume;

[0053] Comparing the CPU usage and memory utilization with preset CPU usage thresholds and memory utilization thresholds;

[0054] When the CPU usage exceeds a preset CPU usage threshold, and the memory usage exceeds a preset memory usage threshold, a first load intensity evaluation coefficient is obtained by using the CPU usage, the memory usage, the I / O data size, and the concurrent task processing amount;

[0055] The first load intensity evaluation coefficient is obtained by the following formula:

[0056]

[0057] Among them, L 01 represents the first load intensity evaluation coefficient; n represents the number of unit time experienced by the operation of the corresponding permission management system for users and devices under multi-tenants; P ci represents the CPU usage corresponding to the i-th unit time; P ni represents the memory utilization rate corresponding to the i-th unit time; K i Indicates the I / O data size corresponding to the i-th unit time; K c Indicates the preset I / O data size reference value; T i represents the concurrent task processing volume corresponding to the i-th unit time; P nm Indicates the memory utilization value that exceeds the preset memory utilization threshold; P cm Indicates the CPU usage value that exceeds the preset CPU usage threshold;

[0058] When the CPU usage exceeds a preset CPU usage threshold, or the memory usage exceeds a preset memory usage threshold, a second load intensity evaluation coefficient is obtained by using the CPU usage, memory usage, I / O data size, and concurrent task processing amount;

[0059] The second load intensity evaluation coefficient is obtained by the following formula:

[0060]

[0061] Among them, L 02 represents the second load intensity evaluation coefficient; n represents the number of unit time experienced by the operation of the corresponding permission management system for users and devices under multi-tenants; P ci represents the CPU usage corresponding to the i-th unit time; P ni represents the memory utilization rate corresponding to the i-th unit time; K i Indicates the I / O data size corresponding to the i-th unit time; K c Indicates the preset I / O data size reference value; T i Indicates the amount of concurrent tasks processed corresponding to the i-th unit time;

[0062] Comparing the first load intensity evaluation coefficient with a preset first load intensity evaluation coefficient threshold, when the first load intensity evaluation coefficient exceeds the preset first load intensity evaluation coefficient threshold, determining that the system load is overloaded, and issuing an overload alarm;

[0063] or

[0064] The second load intensity evaluation coefficient is compared with a preset second load intensity evaluation coefficient threshold value. When the second load intensity evaluation coefficient exceeds the preset second load intensity evaluation coefficient threshold value, the system load is determined to be overloaded, and an overload alarm is issued.

[0065] Beneficial effects of the present invention:

[0066] The user and device corresponding authority management system and method proposed in the present invention under multi-tenancy effectively solves the technical problems of administrator authority being too broad, failure to effectively isolate data, and risk of data leakage through refined authority management and data isolation. It realizes tenant-level isolation of data, and data between different administrator groups are invisible to each other, which greatly improves data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] Figure 1 is a system block diagram of the system of the present invention;

[0068] Figure 2 The schematic diagram of the method of the present invention. DETAILED DESCRIPTION

[0069] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0070] The embodiment of the present invention proposes a multi-tenant user and device corresponding authority management system, such as Figure 1 As shown, the multi-tenant user and device corresponding authority management system includes an administrator unit, a user management unit and a device management unit;

[0071] The administrator unit is used to perform hierarchical management of data by administrators;

[0072] The user management unit is used to perform authorization operations and management on each user;

[0073] The device management unit is used to adjust the mounted resources to devices and associate device permissions with users.

[0074] The working principle of the above technical solution is as follows: The multi-tenant user and device corresponding authority management system proposed in this embodiment has the following functions:

[0075] 1) Administrator group: The tenant concept in SaaS can isolate data at the administrator group level. Data created by different administrator groups are not visible to each other. All configurations under different administrator groups do not interfere with each other. All administrators in the same group have the same operation permissions and device permissions.

[0076] 2) Administrator: An account with administrator status can operate all resources under the management group (including but not limited to user groups, users, user trees, devices, electronic maps, data cockpits, rule chains, etc.) after logging in, and can grant permissions to user groups so that users have permissions for some devices. Administrators are accounts with special identities and are saved in the same data table as user accounts, but they have different identities and corresponding visible pages.

[0077] 3) User group: User group is an abstract concept of user collection, and its main purpose is to facilitate authorization. All resource authorization is based on user groups. Only one user group can be authorized, so that all users in it have the permission of the resource. Users in the user group can only create, delete, and modify basic information. It is not allowed to move users from one user group to another.

[0078] 4) User: An account with a user identity. Only authorized resources can be seen and platform functions can be used, but basically only viewing capabilities are available, not configuration capabilities. Some devices may have operation permissions, such as PTZ control, etc.

[0079] 5) User organization: User organization is a virtual concept of users. As one of the resources, there is only one user tree under the same administrator group. This function only optimizes the display of users and does not involve user permissions and other capabilities. It is only for display. When creating a user, you can choose to mount it under a certain node. You can move the user to another node by modifying it later. Users from different user groups can be assigned to the same node.

[0080] 6) Device organization: Device organization is similar to the user tree function, except that the mounted resources are adjusted to devices. Device organization is also only used for display optimization and does not involve any permissions. When creating a device, you can choose to mount a node, which can be modified and moved later.

[0081] 7) Device permissions: Device permissions are related to user groups, and different user groups have different device permissions. Whether device permissions are granted or not is handled by the microservice. After the microservice grants permissions, it notifies this service through the RPC interface call, and this service records and stores them uniformly.

[0082] 8) Device authentication: When the front-end Web makes a specific request to the microservice for the device tree or device-related data or directly operates the device, the microservice needs to call the authentication interface to request whether the user has the device permission. If the user has the permission, the device can be authenticated. If the user does not have the permission, an error message will be returned.

[0083] The effect of the above technical solution is: a multi-tenant user and device corresponding permission management system proposed in this embodiment effectively solves the technical problems of too broad administrator permissions, failure to achieve effective data isolation, and risk of data leakage through refined permission management and data isolation. It realizes tenant-level isolation of data, and data between different administrator groups are invisible to each other, which greatly improves data security.

[0084] In one embodiment of the present invention, the administrator unit includes an administrator group module and an administrator module;

[0085] The administrator group module is used to isolate data at the administrator group level. Data created by different administrator groups are not visible to each other. At the same time, all configurations under different administrator groups do not interfere with each other. In addition, all administrators under the same administrator group have the same operation permissions and device permissions.

[0086] The administrator module is used to operate and manage the resources under the management group of the administrator account, and to grant rights to the user group so that the user accounts included in the user group have the rights of some devices; wherein the resources include but are not limited to user groups, users, user trees, devices, electronic maps, data cockpits, rule chains, etc.

[0087] Among them, the administrator is an account with a special identity, which is saved in the same data table as the user's account, but the identity is different and the corresponding visible pages are also different.

[0088] The working principle of the above technical solution is as follows: the solution first realizes group-level isolation between data administrators. The data created by different administrator groups are independent of each other, and the data of one group is invisible to another group. At the same time, the configurations under different administrator groups do not interfere with each other, which ensures the independence of data and management configuration between groups. All administrators under the same administrator group hold the same operation permissions and device permissions, which ensures the consistency between administrators in the group. The account with administrator identity can operate and manage the resources under its management group. These resources include but are not limited to user groups, users, user trees, devices, electronic maps, data cockpits, rule chains, etc. The administrator can also grant permissions to the user group so that the user accounts contained in the user group have permissions for some devices. In this way, users in the user group can access and operate specific devices or data according to the permissions granted. The administrator is an account with a special identity, which is stored in the same data table as the user's account, but their identities are different. Due to different identities, the visible pages corresponding to the administrator and the user are also different. The administrator can see and manage related pages and functions, while the user can only see the pages and functions related to his permissions.

[0089] The effect of the above technical solution is: through the isolation of the data administrator group level, the data and management configurations between different groups are independent, which avoids the risk of data leakage and configuration interference. The distinction between administrator and user accounts and the corresponding permission control also further improves the security of the data. Administrators under the same administrator group hold the same operation permissions and device permissions, which avoids confusion and duplication of permission management. Administrators can grant unified permissions to user groups, which simplifies the permission management process and improves management efficiency. The solution supports the creation and management of different administrator groups, as well as the authorization of user groups, which allows the system to be flexibly expanded and adjusted according to actual needs. At the same time, since the distinction between administrator and user accounts and the corresponding permission control are based on data tables, the system can easily add new administrators or users and adjust their permissions.

[0090] In summary, this technical solution effectively improves data security, optimizes data management efficiency, and enhances the scalability and flexibility of the system by implementing mechanisms such as isolation at the data administrator group level, resource management of administrator identity accounts and user group empowerment, and differentiation between administrator and user accounts.

[0091] In one embodiment of the present invention, the user management unit includes a user group management module, a user management module and a user organization management module;

[0092] The user group management module is used to manage the permissions of resources held by all users contained in it, wherein users in a user group are only allowed to perform creation operations, deletion operations, and modification of basic information operations, and it is not allowed to move users from one user group to another;

[0093] The user management module is used to hold an account of a user identity and to perform visible display and operation management of resources authorized by the user;

[0094] The user organization management module is used for display optimization when displaying users, but does not involve user authority management capabilities.

[0095] The working principle of the above technical solution is that the system manages the permissions of resources held by all users contained in it. This means that the system can control the access and operation permissions of users in the user group to resources. In particular, users in the user group are only allowed to perform creation operations, deletion operations and modification of basic information operations. These operations usually involve the management of the user's own resources, such as creating new data items, deleting no longer needed resources, or modifying the basic information of resources (such as name, description, etc.). Users are not allowed to be moved from one user group to another, which ensures the stability of the user group structure and the clarity of permission management. Accounts holding user identities can visibly display and operate the resources authorized by the user. This means that users can see and operate the resources they are authorized to access. The visibility and operation permissions of users are determined based on their identities and the permission allocation of the user groups to which they belong. The system optimizes when displaying users to improve user experience and readability. This may include adjusting the sorting method of the user list, adding filtering conditions, or providing a quick view function for user information. This display optimization does not involve changes in user permission management capabilities. Users can still only access and operate resources according to their assigned permissions.

[0096] The effects of the above technical solution are as follows: through strict management of user rights within user groups, the system can ensure that users can only perform operations for which they are authorized, thereby avoiding abuse of rights and potential security risks. Prohibiting users from moving between different user groups helps maintain the stability of the user group structure and the clarity of rights management. By optimizing user display, the system can provide a more intuitive and easy-to-use user interface, thereby improving the user experience. Users can quickly find the information and resources they need and operate and manage them easily. The system simplifies the rights management process by centrally managing user rights and providing a clear rights allocation mechanism. Administrators can more easily understand and manage user rights, thereby ensuring the security and stability of the system. The technical solution can support the management of multiple user groups and multiple roles, thereby meeting the rights management needs of complex organizations. By assigning users to different user groups and granting different roles and rights, the system can flexibly adapt to various organizational structures and business needs.

[0097] In summary, this technical solution effectively improves the system security, user experience and flexibility of permission management through sophisticated user permission management, optimized user display, and support for multi-user group and multi-role management mechanisms.

[0098] In one embodiment of the present invention, the device management unit includes a device organization module, a device authority module and a device authentication module;

[0099] The device organization module is used to adjust the mounted resources to devices. The device organization module is only used for display optimization and does not involve any permissions. When the device is created, a node is selected for mounting, which can be modified and moved later.

[0100] The device permission module is used to associate device permissions with users. The authorization of device permissions is handled by the microservice. After the microservice completes the authorization, it calls the RPC interface to inform this service, which is then recorded and stored uniformly by this service.

[0101] The device authentication module is used to control the microservice to call the authentication interface to the service when the front-end Web specifically requests the device tree or device-related data or directly operates the device to determine whether the user holds the device permission; if the user holds the permission, it can proceed normally; otherwise, an error message is returned.

[0102] The working principle of the above technical solution is as follows: the system first adjusts the mounted resources to devices. The device organization module here is only used for display optimization and does not involve any permission management. This means that the device organization module can change the display method of the device, such as adjusting the position or grouping of the device on the interface, but it will not affect the permission settings of the device. When creating a device, the user needs to choose to mount a node, which indicates the location or affiliation of the device in the system. Subsequently, the user can modify the mounting node of the device, that is, the location of the mobile device in the system. The system associates the device permissions with the user. This process is handled by microservices. Microservices are independent and deployable software services that are organized around business capabilities and deployed independently using automated deployment mechanisms. In microservices, after the authorization operation of device permissions is completed, the RPC (Remote Procedure Call) interface is called to notify this service (which may be the service responsible for permission management) to record and store the allocation of device permissions. When the front-end Web application requests the device tree, device-related data, or directly operates the device from the microservice, the microservice will call the authentication interface to this service (permission management service). The authentication interface is used to determine whether the user holds the permission for the requested device or data. If the user has the permission, the request can proceed normally; if the user does not have the permission, an error message is returned and the request is rejected.

[0103] The effect of the above technical solution is: the mounted resources are adjusted to devices, and users are allowed to modify the mounting nodes of the devices, which improves the flexibility of resource management. Users can adjust the location or ownership of the device in the system as needed to adapt to different business needs. The authorization operation of device permissions is processed by microservices, and the allocation of storage device permissions is uniformly recorded, so that the centralization and automation of permission management is realized. This helps to reduce the complexity and error rate of permission management and improve the security and stability of the system. In the front-end Web application, the microservice calls the authentication interface to the permission management service to determine the user permissions, and can instantly feedback whether the user's operation request is allowed. This helps to improve the user experience and enable users to quickly understand whether their operations are accepted by the system. The technical solution can support complex business scenarios, such as multiple users, multiple roles, and multiple devices. Through a flexible permission management mechanism, the system can assign different permissions to different users according to business needs to ensure that each user can only access and operate the resources they are authorized to.

[0104] In summary, this technical solution achieves flexibility in resource management, centralization and automation of permission management, improvement of front-end user experience, and support for complex business scenarios through mechanisms such as adjusting resources to devices, associating device permissions with users, and verifying permissions. These technical effects help improve the security, stability, and user experience of the system.

[0105] In one embodiment of the present invention, the multi-tenant user and device corresponding rights management system further includes:

[0106] A real-time monitoring module, used to monitor in real time the operating load parameters of each unit time of the permission management system corresponding to users and devices under the multi-tenant; wherein the operating load parameters include CPU usage, memory utilization, I / O data size and concurrent task processing volume;

[0107] A comparison module, used for comparing the CPU usage rate and the memory utilization rate with a preset CPU usage rate threshold and a preset memory utilization rate threshold;

[0108] A first load intensity evaluation coefficient acquisition module, configured to acquire a first load intensity evaluation coefficient by using the CPU usage, the memory usage, the I / O data size, and the concurrent task processing amount when the CPU usage exceeds a preset CPU usage threshold and the memory usage exceeds a preset memory usage threshold;

[0109] The first load intensity evaluation coefficient is obtained by the following formula:

[0110]

[0111] Among them, L 01 represents the first load intensity evaluation coefficient; n represents the number of unit time experienced by the operation of the corresponding permission management system for users and devices under multi-tenants; P ci represents the CPU usage corresponding to the i-th unit time; P ni represents the memory utilization rate corresponding to the i-th unit time; K i Indicates the I / O data size corresponding to the i-th unit time; K c Indicates the preset I / O data size reference value; T i represents the concurrent task processing volume corresponding to the i-th unit time; P nm Indicates the memory utilization value that exceeds the preset memory utilization threshold; P cm Indicates the CPU usage value that exceeds the preset CPU usage threshold;

[0112] A second load intensity evaluation coefficient acquisition module, configured to acquire a second load intensity evaluation coefficient by using the CPU usage, memory usage, I / O data size, and concurrent task processing amount when the CPU usage exceeds a preset CPU usage threshold, or the memory usage exceeds a preset memory usage threshold;

[0113] The second load intensity evaluation coefficient is obtained by the following formula:

[0114]

[0115] Among them, L 02 represents the second load intensity evaluation coefficient; n represents the number of unit time experienced by the operation of the corresponding permission management system for users and devices under multi-tenants; P ci represents the CPU usage corresponding to the i-th unit time; P ni represents the memory utilization rate corresponding to the i-th unit time; K i Indicates the I / O data size corresponding to the i-th unit time; K c Indicates the preset I / O data size reference value; T i Indicates the amount of concurrent tasks processed corresponding to the i-th unit time;

[0116] a first alarm module, configured to compare the first load intensity evaluation coefficient with a preset first load intensity evaluation coefficient threshold value, and when the first load intensity evaluation coefficient exceeds the preset first load intensity evaluation coefficient threshold value, determine that the system load is overloaded, and issue an overload alarm;

[0117] The second alarm module is used to compare the second load intensity evaluation coefficient with a preset second load intensity evaluation coefficient threshold. When the second load intensity evaluation coefficient exceeds the preset second load intensity evaluation coefficient threshold, it is determined that the system load is overloaded and an overload alarm is issued.

[0118] The working principle of the above technical solution is: the system monitors the operating load parameters of each unit time of the corresponding permission management system of users and devices under multi-tenants in real time. These parameters include CPU usage, memory utilization, I / O data size and concurrent task processing volume, which together reflect the current operating status of the system. The system compares the real-time monitored CPU usage and memory utilization with the preset threshold. This is to determine whether the system is close to or has reached the limit of its processing capacity. When the CPU usage and memory utilization exceed the preset threshold at the same time, the system uses these parameters as well as the I / O data size and concurrent task processing volume to calculate the first load intensity evaluation coefficient through a specific formula. This coefficient comprehensively reflects the operating status of the system under high load. When either the CPU usage or the memory utilization exceeds the preset threshold, the system also uses these parameters to calculate the second load intensity evaluation coefficient, but at this time, the situation where both indicators exceed the standard at the same time is not considered, so the calculation formula may be different. The system compares the calculated first or second load intensity evaluation coefficient with the preset threshold. If the evaluation coefficient exceeds the preset threshold, the system load is determined to be overloaded and an overload alarm is issued. This helps administrators detect and address system load issues in a timely manner, preventing system crashes or performance degradation.

[0119] The effect of the above technical solution is: by real-time monitoring of the system operation load and load intensity evaluation, the system can issue an alarm before the load is overloaded, so that the administrator has enough time to take measures, such as increasing resources, optimizing system configuration or restricting user access, etc., thereby improving the stability of the system. The system can dynamically adjust resource allocation according to the load parameters monitored in real time to ensure that critical tasks are supported by sufficient resources while avoiding waste of resources. This helps to optimize resource utilization and improve the overall performance of the system. By responding to system load issues in a timely manner, the system can reduce service interruptions or performance degradation caused by load overload, thereby enhancing user experience. Users can enjoy smoother and more stable services when using the system. This technical solution is particularly suitable for multi-tenant environments and can ensure resource isolation and performance assurance between different tenants. Through real-time monitoring and load management, the system can provide stable and efficient services to each tenant.

[0120] In summary, this technical solution achieves load management of the user and device corresponding permission management system under multi-tenancy through real-time monitoring of system operation load, calculation of load intensity evaluation coefficient, comparison and alarm, etc. This helps to improve system stability, optimize resource utilization, enhance user experience and support multi-tenant environment.

[0121] The embodiment of the present invention provides a method for managing permissions between users and devices under multi-tenancy. Figure 2 As shown, the method for managing permissions corresponding to users and devices under multi-tenancy includes an administrator unit, a user management unit and a device management unit;

[0122] S1. Perform hierarchical management of data by administrators;

[0123] S2. Authorize and manage each user;

[0124] S3. Adjust the mounted resources to devices and associate device permissions with users.

[0125] The working principle of the above technical solution is as follows: This unit is responsible for the construction and maintenance of the authority management architecture of the entire system. Administrators are managed in different levels, and administrators at different levels have different permissions to ensure the security of the system and the flexibility of management. This unit is responsible for the creation, deletion, modification of users and the allocation of user permissions. Each user is authorized to operate and manage to ensure that each user can only access and operate the data and functions they are authorized to operate. The management of user permissions may involve aspects such as user authentication, role management, permission control, and auditing and logging. This unit is responsible for the registration, deregistration, status monitoring and allocation of device permissions. Adjusting the mounted resources to devices means that the resources in the system (such as storage devices, network devices, etc.) are abstracted as device objects for management. Device permissions are associated with users to ensure that each user can only access and operate the devices they are authorized to operate. In the specific operation process, the system first manages the administrators in different levels through the administrator unit to ensure that administrators at different levels have appropriate permissions. Then, the user is authorized to operate and manage through the user management unit, and the corresponding permissions are allocated according to the user's role and needs. Finally, the mounted resources are adjusted to devices through the device management unit and associated with user permissions to ensure that users can only access and operate the devices they are authorized to operate.

[0126] The effect of the above technical solution is: through hierarchical management of administrators, the permissions of administrators at different levels can be limited to prevent abuse of permissions. Fine-grained control of user permissions can ensure that each user can only access and operate the data and functions they are authorized to, thereby improving the security of the system. Hierarchical management of administrators can simplify the complexity of permission management, so that administrators at different levels can focus on their respective management tasks. The integration of the user management unit and the device management unit can make permission management more centralized and efficient. This technical solution can easily add new users and devices without major modifications to the existing permission management architecture. Through flexible permission allocation and association mechanisms, the changing needs of different tenants and users can be met. Adjusting the mounted resources to devices and associating permissions can ensure the reasonable allocation and utilization of resources. Through permission management, unauthorized users can be prevented from accessing and operating device resources, thereby avoiding waste and abuse of resources.

[0127] In summary, this technical solution achieves effective management of user and device permissions under multi-tenancy through the integration and collaboration of the administrator unit, user management unit, and device management unit. This management method not only improves the security and management efficiency of the system, but also enhances the scalability of the system and optimizes the utilization of resources.

[0128] In one embodiment of the present invention, the administrator-level management of data includes:

[0129] S101. Data is isolated at the administrator group level. Data created by different administrator groups are not visible to each other. At the same time, all configurations under different administrator groups do not interfere with each other. In addition, all administrators under the same administrator group have the same operation permissions and device permissions.

[0130] S102: Run, operate and manage the resources under the management group of the administrator account, and grant rights to the user group so that the user accounts included in the user group have the rights to some devices; wherein the resources include but are not limited to user groups, users, user trees, devices, electronic maps, data cockpits, rule chains, etc.

[0131] Among them, the administrator is an account with a special identity, which is saved in the same data table as the user's account, but the identity is different and the corresponding visible pages are also different.

[0132] The working principle of the above technical solution is as follows: the solution first realizes group-level isolation between data administrators. The data created by different administrator groups are independent of each other, and the data of one group is invisible to another group. At the same time, the configurations under different administrator groups do not interfere with each other, which ensures the independence of data and management configuration between groups. All administrators under the same administrator group hold the same operation permissions and device permissions, which ensures the consistency between administrators in the group. The account with administrator identity can operate and manage the resources under its management group. These resources include but are not limited to user groups, users, user trees, devices, electronic maps, data cockpits, rule chains, etc. The administrator can also grant permissions to the user group so that the user accounts contained in the user group have permissions for some devices. In this way, users in the user group can access and operate specific devices or data according to the permissions granted. The administrator is an account with a special identity, which is stored in the same data table as the user's account, but their identities are different. Due to different identities, the visible pages corresponding to the administrator and the user are also different. The administrator can see and manage related pages and functions, while the user can only see the pages and functions related to his permissions.

[0133] The effect of the above technical solution is: through the isolation of the data administrator group level, the data and management configurations between different groups are independent, which avoids the risk of data leakage and configuration interference. The distinction between administrator and user accounts and the corresponding permission control also further improves the security of the data. Administrators under the same administrator group hold the same operation permissions and device permissions, which avoids confusion and duplication of permission management. Administrators can grant unified permissions to user groups, which simplifies the permission management process and improves management efficiency. The solution supports the creation and management of different administrator groups, as well as the authorization of user groups, which allows the system to be flexibly expanded and adjusted according to actual needs. At the same time, since the distinction between administrator and user accounts and the corresponding permission control are based on data tables, the system can easily add new administrators or users and adjust their permissions.

[0134] In summary, this technical solution effectively improves data security, optimizes data management efficiency, and enhances the scalability and flexibility of the system by implementing mechanisms such as isolation at the data administrator group level, resource management of administrator identity accounts and user group empowerment, and differentiation between administrator and user accounts.

[0135] In one embodiment of the present invention, the authorization operation and management of each user includes:

[0136] S201, manage the permissions of resources held by all users contained in the group, where users in the group are only allowed to create, delete and modify basic information, and users are not allowed to move from one user group to another;

[0137] S202, the account holding the user identity performs visible display and operation management of the resources authorized by the user;

[0138] S203: Display optimization when displaying users, but does not involve user authority management capabilities.

[0139] The working principle of the above technical solution is that the system manages the permissions of resources held by all users contained in it. This means that the system can control the access and operation permissions of users in the user group to resources. In particular, users in the user group are only allowed to perform creation operations, deletion operations and modification of basic information operations. These operations usually involve the management of the user's own resources, such as creating new data items, deleting no longer needed resources, or modifying the basic information of resources (such as name, description, etc.). Users are not allowed to be moved from one user group to another, which ensures the stability of the user group structure and the clarity of permission management. Accounts holding user identities can visibly display and operate the resources authorized by the user. This means that users can see and operate the resources they are authorized to access. The visibility and operation permissions of users are determined based on their identities and the permission allocation of the user groups to which they belong. The system optimizes when displaying users to improve user experience and readability. This may include adjusting the sorting method of the user list, adding filtering conditions, or providing a quick view function for user information. This display optimization does not involve changes in user permission management capabilities. Users can still only access and operate resources according to their assigned permissions.

[0140] The effects of the above technical solution are as follows: through strict management of user rights within user groups, the system can ensure that users can only perform operations for which they are authorized, thereby avoiding abuse of rights and potential security risks. Prohibiting users from moving between different user groups helps maintain the stability of the user group structure and the clarity of rights management. By optimizing user display, the system can provide a more intuitive and easy-to-use user interface, thereby improving the user experience. Users can quickly find the information and resources they need and operate and manage them easily. The system simplifies the rights management process by centrally managing user rights and providing a clear rights allocation mechanism. Administrators can more easily understand and manage user rights, thereby ensuring the security and stability of the system. The technical solution can support the management of multiple user groups and multiple roles, thereby meeting the rights management needs of complex organizations. By assigning users to different user groups and granting different roles and rights, the system can flexibly adapt to various organizational structures and business needs.

[0141] In summary, this technical solution effectively improves the system security, user experience and flexibility of permission management through sophisticated user permission management, optimized user display, and support for multi-user group and multi-role management mechanisms.

[0142] In one embodiment of the present invention, adjusting the mounted resource to a device and associating the device authority with the user includes:

[0143] S301, adjusting the mounted resource to a device, wherein the device organization module is only used for display optimization and does not involve any permissions, and when the device is created, a node is selected for mounting, which can be modified and moved later;

[0144] S302: Associating device permissions with users. The authorization of device permissions is handled by the microservice. After the microservice completes the authorization, it notifies this service through the RPC interface call, and this service records and stores it uniformly.

[0145] S303. When the front-end Web specifically requests the device tree or device-related data or directly operates the device from the microservice, the control microservice calls the authentication interface to the service to determine whether the user holds the device permission; if the user holds the permission, it can proceed normally; otherwise, an error message is returned.

[0146] The working principle of the above technical solution is as follows: the system first adjusts the mounted resources to devices. The device organization module here is only used for display optimization and does not involve any permission management. This means that the device organization module can change the display method of the device, such as adjusting the position or grouping of the device on the interface, but it will not affect the permission settings of the device. When creating a device, the user needs to choose to mount a node, which indicates the location or affiliation of the device in the system. Subsequently, the user can modify the mounting node of the device, that is, the location of the mobile device in the system. The system associates the device permissions with the user. This process is handled by microservices. Microservices are independent and deployable software services that are organized around business capabilities and deployed independently using automated deployment mechanisms. In microservices, after the authorization operation of device permissions is completed, the RPC (Remote Procedure Call) interface is called to notify this service (which may be the service responsible for permission management) to record and store the allocation of device permissions. When the front-end Web application requests the device tree, device-related data, or directly operates the device from the microservice, the microservice will call the authentication interface to this service (permission management service). The authentication interface is used to determine whether the user holds the permission for the requested device or data. If the user has the permission, the request can proceed normally; if the user does not have the permission, an error message is returned and the request is rejected.

[0147] The effect of the above technical solution is: the mounted resources are adjusted to devices, and users are allowed to modify the mounting nodes of the devices, which improves the flexibility of resource management. Users can adjust the location or ownership of the device in the system as needed to adapt to different business needs. The authorization operation of device permissions is processed by microservices, and the allocation of storage device permissions is uniformly recorded, so that the centralization and automation of permission management is realized. This helps to reduce the complexity and error rate of permission management and improve the security and stability of the system. In the front-end Web application, the microservice calls the authentication interface to the permission management service to determine the user permissions, and can instantly feedback whether the user's operation request is allowed. This helps to improve the user experience and enable users to quickly understand whether their operations are accepted by the system. The technical solution can support complex business scenarios, such as multiple users, multiple roles, and multiple devices. Through a flexible permission management mechanism, the system can assign different permissions to different users according to business needs to ensure that each user can only access and operate the resources they are authorized to.

[0148] In summary, this technical solution achieves flexibility in resource management, centralization and automation of permission management, improvement of front-end user experience, and support for complex business scenarios through mechanisms such as adjusting resources to devices, associating device permissions with users, and verifying permissions. These technical effects help improve the security, stability, and user experience of the system.

[0149] In one embodiment of the present invention, the method for managing permissions corresponding to users and devices under multi-tenancy also includes:

[0150] Step 1: monitor in real time the operating load parameters of each unit time of the permission management system corresponding to users and devices under the multi-tenant; wherein the operating load parameters include CPU usage, memory utilization, I / O data size and concurrent task processing volume;

[0151] Step 2: Compare the CPU usage and memory usage with a preset CPU usage threshold and memory usage threshold;

[0152] Step 3: When the CPU usage exceeds a preset CPU usage threshold, and the memory usage exceeds a preset memory usage threshold, a first load intensity evaluation coefficient is obtained by using the CPU usage, memory usage, I / O data size, and concurrent task processing amount;

[0153] The first load intensity evaluation coefficient is obtained by the following formula:

[0154]

[0155] Among them, L 01represents the first load intensity evaluation coefficient; n represents the number of unit time experienced by the operation of the corresponding permission management system for users and devices under multi-tenants; P ci represents the CPU usage corresponding to the i-th unit time; P ni represents the memory utilization rate corresponding to the i-th unit time; K i Indicates the I / O data size corresponding to the i-th unit time; K c Indicates the preset I / O data size reference value; T i represents the concurrent task processing volume corresponding to the i-th unit time; P nm Indicates the memory utilization value that exceeds the preset memory utilization threshold; P cm Indicates the CPU usage value that exceeds the preset CPU usage threshold;

[0156] Step 4: When the CPU usage exceeds a preset CPU usage threshold, or the memory usage exceeds a preset memory usage threshold, a second load intensity evaluation coefficient is obtained using the CPU usage, memory usage, I / O data size, and concurrent task processing volume;

[0157] The second load intensity evaluation coefficient is obtained by the following formula:

[0158]

[0159] Among them, L 02 represents the second load intensity evaluation coefficient; n represents the number of unit time experienced by the operation of the corresponding permission management system for users and devices under multi-tenants; P ci represents the CPU usage corresponding to the i-th unit time; P ni represents the memory utilization rate corresponding to the i-th unit time; K i Indicates the I / O data size corresponding to the i-th unit time; K c Indicates the preset I / O data size reference value; T i Indicates the amount of concurrent tasks processed corresponding to the i-th unit time;

[0160] Step 5: Compare the first load intensity evaluation coefficient with a preset first load intensity evaluation coefficient threshold value. When the first load intensity evaluation coefficient exceeds the preset first load intensity evaluation coefficient threshold value, it is determined that the system load is overloaded, and an overload alarm is issued;

[0161] or

[0162] The second load intensity evaluation coefficient is compared with a preset second load intensity evaluation coefficient threshold value. When the second load intensity evaluation coefficient exceeds the preset second load intensity evaluation coefficient threshold value, the system load is determined to be overloaded, and an overload alarm is issued.

[0163] The working principle of the above technical solution is: the system monitors the operating load parameters of each unit time of the corresponding permission management system of users and devices under multi-tenants in real time. These parameters include CPU usage, memory utilization, I / O data size and concurrent task processing volume, which together reflect the current operating status of the system. The system compares the real-time monitored CPU usage and memory utilization with the preset threshold. This is to determine whether the system is close to or has reached the limit of its processing capacity. When the CPU usage and memory utilization exceed the preset threshold at the same time (step 3), the system uses these parameters as well as the I / O data size and concurrent task processing volume to calculate the first load intensity evaluation coefficient through a specific formula. This coefficient comprehensively reflects the operating status of the system under high load. When either the CPU usage or the memory utilization exceeds the preset threshold (step 4), the system also uses these parameters to calculate the second load intensity evaluation coefficient, but at this time, the situation where both indicators exceed the standard at the same time is not considered, so the calculation formula may be different. The system compares the calculated first or second load intensity evaluation coefficient with the preset threshold. If the evaluation coefficient exceeds the preset threshold, the system load is determined to be overloaded and an overload alarm is issued. This helps administrators detect and address system load issues in a timely manner, preventing system crashes or performance degradation.

[0164] The effect of the above technical solution is: by real-time monitoring of the system operation load and load intensity evaluation, the system can issue an alarm before the load is overloaded, so that the administrator has enough time to take measures, such as increasing resources, optimizing system configuration or restricting user access, etc., thereby improving the stability of the system. The system can dynamically adjust resource allocation according to the load parameters monitored in real time to ensure that critical tasks are supported by sufficient resources while avoiding waste of resources. This helps to optimize resource utilization and improve the overall performance of the system. By responding to system load issues in a timely manner, the system can reduce service interruptions or performance degradation caused by load overload, thereby enhancing user experience. Users can enjoy smoother and more stable services when using the system. This technical solution is particularly suitable for multi-tenant environments and can ensure resource isolation and performance assurance between different tenants. Through real-time monitoring and load management, the system can provide stable and efficient services to each tenant.

[0165] In summary, this technical solution realizes the load management of the user and device corresponding permission management system under multi-tenancy through real-time monitoring of system operation load, calculation of load intensity evaluation coefficient, comparison and alarm, etc. This helps to improve system stability, optimize resource utilization, enhance user experience and support multi-tenant environment.

[0166] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A multi-tenant user and device corresponding rights management system, characterized in that: The multi-tenant user and device corresponding authority management system includes an administrator unit, a user management unit and a device management unit; The administrator unit is used to perform hierarchical management of data by administrators; The user management unit is used to perform authorization operations and management on each user; The device management unit is used to adjust the mounted resources to devices and associate device permissions with users.

2. The multi-tenant user and device corresponding authority management system according to claim 1, characterized in that: The administrator unit includes an administrator group module and an administrator module; The administrator group module is used to isolate data at the administrator group level. Data created by different administrator groups are not visible to each other. At the same time, all configurations under different administrator groups do not interfere with each other. In addition, all administrators under the same administrator group have the same operation permissions and device permissions. The administrator module is used to operate and manage the resources under the management group to which the administrator's account belongs, and to grant rights to the user group so that the user accounts included in the user group have the rights to some devices.

3. The multi-tenant user and device corresponding authority management system according to claim 1, characterized in that: The user management unit includes a user group management module, a user management module and a user organization management module; The user group management module is used to manage the permissions of resources held by all users contained in it, wherein users in a user group are only allowed to perform creation operations, deletion operations, and modification of basic information operations, and it is not allowed to move users from one user group to another; The user management module is used to hold an account of a user identity and to perform visible display and operation management of resources authorized by the user; The user organization management module is used for display optimization when displaying users, but does not involve user authority management capabilities.

4. The multi-tenant user and device corresponding authority management system according to claim 1, characterized in that: The device management unit includes a device organization module, a device authority module and a device authentication module; The device organization module is used to adjust the mounted resources into devices; The device permission module is used to associate device permissions with users. The authorization of device permissions is handled by the microservice. After the microservice completes the authorization, it calls the RPC interface to inform this service, which is then recorded and stored uniformly by this service. The device authentication module is used to control the microservice to call the authentication interface to the service when the front-end Web specifically requests the device tree or device-related data or directly operates the device to determine whether the user holds the device permission; if the user holds the permission, it can proceed normally; otherwise, an error message is returned.

5. The multi-tenant user and device corresponding authority management system according to claim 1, characterized in that: The multi-tenant user and device corresponding permission management system also includes: A real-time monitoring module, used to monitor in real time the operating load parameters of each unit time of the permission management system corresponding to users and devices under the multi-tenant; wherein the operating load parameters include CPU usage, memory utilization, I / O data size and concurrent task processing volume; A comparison module, used for comparing the CPU usage rate and the memory utilization rate with a preset CPU usage rate threshold and a preset memory utilization rate threshold; A first load intensity evaluation coefficient acquisition module, configured to acquire a first load intensity evaluation coefficient by using the CPU usage, the memory usage, the I / O data size, and the concurrent task processing amount when the CPU usage exceeds a preset CPU usage threshold and the memory usage exceeds a preset memory usage threshold; The first load intensity evaluation coefficient is obtained by the following formula: Among them, L 01 represents the first load intensity evaluation coefficient; n represents the number of unit time experienced by the operation of the corresponding permission management system for users and devices under multi-tenants; P ci represents the CPU usage corresponding to the i-th unit time; P ni represents the memory utilization rate corresponding to the i-th unit time; K i Indicates the I / O data size corresponding to the i-th unit time; K c Indicates the preset I / O data size reference value; T i represents the concurrent task processing volume corresponding to the i-th unit time; P nm Indicates the memory utilization value that exceeds the preset memory utilization threshold; P cm Indicates the CPU usage value that exceeds the preset CPU usage threshold; A second load intensity evaluation coefficient acquisition module, configured to acquire a second load intensity evaluation coefficient by using the CPU usage, memory usage, I / O data size, and concurrent task processing amount when the CPU usage exceeds a preset CPU usage threshold, or the memory usage exceeds a preset memory usage threshold; The second load intensity evaluation coefficient is obtained by the following formula: Among them, L 02 represents the second load intensity evaluation coefficient; n represents the number of unit time experienced by the operation of the corresponding permission management system for users and devices under multi-tenants; P ci represents the CPU usage corresponding to the i-th unit time; P ni represents the memory utilization rate corresponding to the i-th unit time; K i Indicates the I / O data size corresponding to the i-th unit time; K c Indicates the preset I / O data size reference value; T i Indicates the amount of concurrent tasks processed corresponding to the i-th unit time; a first alarm module, configured to compare the first load intensity evaluation coefficient with a preset first load intensity evaluation coefficient threshold value, and when the first load intensity evaluation coefficient exceeds the preset first load intensity evaluation coefficient threshold value, determine that the system load is overloaded, and issue an overload alarm; The second alarm module is used to compare the second load intensity evaluation coefficient with a preset second load intensity evaluation coefficient threshold. When the second load intensity evaluation coefficient exceeds the preset second load intensity evaluation coefficient threshold, it is determined that the system load is overloaded and an overload alarm is issued.

6. A method for managing permissions between users and devices under multi-tenancy, characterized in that: The method for managing permissions corresponding to users and devices under multi-tenancy includes an administrator unit, a user management unit and a device management unit; Conduct hierarchical management of data by administrators; Empower and manage each user; Adjust the mounted resources to devices and associate device permissions with users.

7. The method for managing permissions between users and devices under multi-tenancy according to claim 6, characterized in that: The administrator-level management of data includes: Data is isolated at the administrator group level. Data created by different administrator groups are not visible to each other. At the same time, all configurations under different administrator groups do not interfere with each other. In addition, all administrators under the same administrator group have the same operation permissions and device permissions. Run operations and manage the resources under the management group of the administrator account, and grant permissions to the user group so that the user accounts included in the user group have permissions to some devices.

8. The method for managing permissions between users and devices under multi-tenancy according to claim 6, characterized in that: The authorization operation and management of each user includes: Manage the permissions of resources held by all users in the group. Users in the group are only allowed to create, delete, and modify basic information. Moving users from one group to another is not allowed. An account that holds a user's identity and provides visible display and operational management of the resources that the user is authorized to use; Display optimization when displaying users, but does not involve user permission management capabilities.

9. The method for managing permissions between users and devices under multi-tenancy according to claim 6, characterized in that: The step of adjusting the mounted resource to a device and associating the device authority with the user includes: Adjust the mount resource to a device; The device permissions are associated with the user. The authorization of the device permissions is handled by the microservice. After the microservice completes the authorization, it notifies this service through the RPC interface call, and this service records and stores it uniformly. When the front-end Web specifically requests the device tree or device-related data or directly operates the device from the microservice, the control microservice calls the authentication interface to this service to determine whether the user holds the device permission; if the user holds the permission, it can proceed normally; otherwise, an error message is returned.

10. The method for managing permissions between users and devices under multi-tenancy according to claim 6, characterized in that: The method for managing permissions between users and devices under multi-tenancy also includes: Real-time monitoring of the operating load parameters of each unit time of the permission management system corresponding to users and devices under the multi-tenant; wherein the operating load parameters include CPU usage, memory utilization, I / O data size and concurrent task processing volume; Comparing the CPU usage and memory utilization with preset CPU usage thresholds and memory utilization thresholds; When the CPU usage exceeds a preset CPU usage threshold, and the memory usage exceeds a preset memory usage threshold, a first load intensity evaluation coefficient is obtained by using the CPU usage, the memory usage, the I / O data size, and the concurrent task processing amount; The first load intensity evaluation coefficient is obtained by the following formula: Among them, L 01 represents the first load intensity evaluation coefficient; n represents the number of unit time experienced by the operation of the corresponding permission management system for users and devices under multi-tenants; P ci represents the CPU usage corresponding to the i-th unit time; P ni represents the memory utilization rate corresponding to the i-th unit time; K i Indicates the I / O data size corresponding to the i-th unit time; K c Indicates the preset I / O data size reference value; T i represents the concurrent task processing volume corresponding to the i-th unit time; P nm Indicates the memory utilization value that exceeds the preset memory utilization threshold; P cm Indicates the CPU usage value that exceeds the preset CPU usage threshold; When the CPU usage exceeds a preset CPU usage threshold, or the memory usage exceeds a preset memory usage threshold, a second load intensity evaluation coefficient is obtained by using the CPU usage, memory usage, I / O data size, and concurrent task processing amount; The second load intensity evaluation coefficient is obtained by the following formula: Among them, L 02 represents the second load intensity evaluation coefficient; n represents the number of unit time experienced by the operation of the corresponding permission management system for users and devices under multi-tenants; P ci represents the CPU usage corresponding to the i-th unit time; P ni represents the memory utilization rate corresponding to the i-th unit time; K i Indicates the I / O data size corresponding to the i-th unit time; K c Indicates the preset I / O data size reference value; T i Indicates the amount of concurrent tasks processed corresponding to the i-th unit time; Comparing the first load intensity evaluation coefficient with a preset first load intensity evaluation coefficient threshold, when the first load intensity evaluation coefficient exceeds the preset first load intensity evaluation coefficient threshold, determining that the system load is overloaded, and issuing an overload alarm; or The second load intensity evaluation coefficient is compared with a preset second load intensity evaluation coefficient threshold value. When the second load intensity evaluation coefficient exceeds the preset second load intensity evaluation coefficient threshold value, the system load is determined to be overloaded, and an overload alarm is issued.

Images