Multi-tenant data resource security management method, equipment and medium

Abstract

The invention discloses a multi-tenant data resource security management method and device and a medium, and the method comprises the steps: hooking a data resource directory uploaded by a data resource party to a data factory, so as to construct an independent data sandbox environment; receiving a target data resource use request required by a product in a development process, and sending the target data resource use request to the data resource party and the platform operator for auditing; the target data resource use request comprises specified resource directory information in the data factory; when the verification is passed, synchronizing simulation data of the target data resource to a simulation database, so that a product development party develops a product on a server of a data resource party according to a development operation environment deployed by a platform operator and the simulation data; and deploying the development product to a server of the data resource party. And the multi-tenant data resource security is improved.

Description

Technical Field

[0001] The present application relates to the technical field of data resource management, and in particular to a multi-tenant data resource security management method, device, and medium. Background Art

[0002] With the widespread application of cloud computing technology, multi-tenant architecture has become the mainstream service model chosen by many enterprises and organizations. In a multi-tenant architecture, multiple tenants share the same set of physical or virtual resources, such as computing resources, storage resources, and network resources.

[0003] However, while this sharing model improves resource utilization and cost-effectiveness, it also brings security risks such as data leakage and unauthorized access. Data security and privacy protection are particularly important in sensitive data-intensive industries such as finance and healthcare.

[0004] Currently, each tenant's data is usually encrypted to ensure security. However, encryption is vulnerable to attacks and cannot ensure secure isolation and compliance with regulations for each tenant's data. Encryption security measures are often difficult to fully adapt to the complexity of multi-tenant environments. Summary of the Invention

[0005] The embodiments of the present application provide a multi-tenant data resource security management method, device and medium for solving the problem that encryption security measures are often difficult to fully adapt to the complexity of a multi-tenant environment.

[0006] The embodiments of this application adopt the following technical solutions:

[0007] On the one hand, an embodiment of the present application provides a multi-tenant data resource security management method, which includes: attaching a data resource directory uploaded by a data resource party to a data factory to build an independent data sandbox environment; receiving a target data resource usage request required by a product during the development process, and sending the target data resource usage request to the data resource party and the platform operator for review; the target data resource usage request includes the specified resource directory information in the data factory; when all reviews are passed, synchronizing the simulation data of the target data resource to the simulation database, so that the product development party can develop the product on the data resource party's server according to the development and operation environment deployed by the platform operator and the simulation data; and deploying the developed product to the data resource party's server.

[0008] In one example, before receiving a request to use target data resources required by a product during development, the method further includes: when the product developer uploads development requirements, inputting the development requirements into a pre-built business decomposition network model to obtain multiple demand keyword combinations of the development requirements; searching and matching each demand keyword combination in the data resource directory of the data factory; and determining the directory entries whose matching degree exceeds a preset similarity threshold as target data resources.

[0009] In one example, attaching the data resource directory of the data resource party to the data factory specifically includes: verifying the identity of the data resource party; after the verification is passed, storing the data resource directory in the corresponding sandbox of the data factory according to the attachment permission of the data resource party.

[0010] In one example, the target data resource use request is sent to the data resource party and the platform operator for review, specifically including: determining whether the data resource party has ownership of the target data resource, and whether the product development party has full data access rights to the target data resource; if both parties have such ownership, the target data resource use request is sent to the data resource party and the platform operator for review.

[0011] In one example, the method further includes: if the user does not have all data access rights to the target data resource at the same time, generating a differentiated permission analysis report, the differentiated permission analysis report including accessible data items and inaccessible data items; providing the product development party with a permission upgrade application portal, and sending the differentiated permission analysis report and the permission upgrade application portal to the product development party for confirmation; after the permission upgrade, sending the target data resource use request to the platform operator for review; if the user does not have ownership of the target data resource, creating an ownership review work order, and sending the ownership review work order to the platform operator for review; after the review is passed, sending the target data resource use request to the data resource party for review.

[0012] In one example, after the developed product is deployed to the server of the data resource party, the method further includes: establishing a field mapping relationship between the simulation data field and the target data resource; testing the developed product on the server of the data resource party based on the field mapping relationship and the target data resource; after the test passes, determining that the development product delivery verification has passed.

[0013] In one example, after the test passes and it is determined that the development product has passed the delivery verification, the method further includes: during the operation of the development product, monitoring the frequency of the development product's calls to the target data resource; when the call frequency exceeds a preset frequency threshold, generating operation risk notification information of the development product, and sending the operation risk notification information to the data resource party and the platform operator.

[0014] In one example, the method further includes: when all the applications are not reviewed and approved, determining a guidance solution for the reason for failure to review; generating a review failure notification message based on the reason for failure to review and the guidance solution; and sending the review failure notification message to the product development party.

[0015] On the other hand, an embodiment of the present application provides a multi-tenant data resource security management device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any one of the multi-tenant data resource security management methods described above.

[0016] On the other hand, an embodiment of the present application provides a multi-tenant data resource security management non-volatile computer storage medium storing computer executable instructions, which can execute any of the multi-tenant data resource security management methods described above.

[0017] At least one of the above technical solutions adopted in the embodiments of the present application can achieve the following beneficial effects:

[0018] Data sandbox technology: By building an independent data sandbox environment, the physical isolation and logical isolation of data from different data resources are combined, providing each tenant with exclusive data processing and storage space, combining physical isolation and logical isolation of data, ensuring the security and privacy of data in a shared resource environment, and effectively protecting data security in a multi-tenant environment.

[0019] Simulation data technology: Using simulation data instead of original data for product development reduces the risk of data leakage and improves development efficiency.

[0020] Multi-dimensional audit mechanism: A data resource usage audit mechanism has been established with the participation of platform operators and data resource providers to ensure the legality and compliance of data use. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solution of the present application, some embodiments of the present application will be described in detail below with reference to the accompanying drawings, in which:

[0022] Figure 1 A flowchart of a multi-tenant data resource security management method provided in an embodiment of the present application;

[0023] Figure 2 A schematic diagram of a framework for a multi-tenant data resource security management method provided in an embodiment of the present application;

[0024] Figure 3 A schematic diagram of the structure of a multi-tenant data resource security management device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0025] To make the objectives, technical solutions, and advantages of this application more clear, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0026] Some embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0027] Figure 1 This is a flowchart of a multi-tenant data resource security management method provided in an embodiment of the present application. This method can be applied to various business areas, such as internet finance, e-commerce, instant messaging, gaming, and government affairs. Certain input parameters or intermediate results in this process can be manually adjusted to help improve accuracy.

[0028] The analysis method involved in the embodiments of the present application can be implemented by a terminal device or a server, and the present application does not impose any special restrictions on this. For ease of understanding and description, the following embodiments are described in detail using a server as an example.

[0029] It should be noted that the server can be a single device or a system composed of multiple devices, that is, a distributed server, and this application does not make any specific restrictions on this.

[0030] Figure 1 The process in includes the following steps:

[0031] S101: Attach the data resource directory uploaded by the data resource party to the data factory to build an independent data sandbox environment.

[0032] For example, the data resource directory includes outpatient medical record directory entries (such as outpatient medical record forms) and inpatient medical record directory entries, which are connected to the data factory. The directory entries indicate that the data include diagnosis results, medication records and other fields, but hide sensitive information such as patient names and ID numbers (field-level permission control is achieved through data sandbox technology).

[0033] In some embodiments of the present application, the process of attaching to the data factory is as follows:

[0034] First, the data source's identity is verified. Then, after verification, the data source directory is stored in the corresponding sandbox of the data factory based on the data source's attachment permissions.

[0035] It should be noted that the identity identifier can be a system registration account identifier. Mounting permissions refer to the operational permissions and scope restrictions that allow data resource owners to connect data resource directories to the data factory. Essentially, they implement permission control to minimize authorization and hierarchical management of data resources, preventing unauthorized access, illegal mounting, or data abuse. For example, operational permissions include: whether mounting is allowed, operation type breakdown (adding mounting, modifying mounting, deleting mounting, batch operation permissions), and time-limited permissions (when mounting is possible, and the validity period of permissions).

[0036] For example, if the data resource provider is a group enterprise, different subsidiaries or departments within it can distinguish their identities through sub-accounts assigned by the platform (such as subsidiary A-001), corresponding to different attachment permissions.

[0037] Different data resource providers are assigned different sandboxes, and different data from the same data resource provider can also be assigned to different sandboxes. In other words, different data resource providers will not be assigned to the same sandbox.

[0038] For example, the directory entry information of Bank A is:

[0039] Name: Bank A - Customer Basic Information, Data Source: Bank A, Business Tags: Customer Profile, Age, Gender, Storage Sandbox: Bank Sandbox

[0040] The catalog entry for Insurance Company B is:

[0041] Name: Insurance Company B - Policy Information, Data Source: Insurance Company B, Business Tags: Insurance Business, Policy Type, Insured Age, Storage Sandbox: Insurance Sandbox

[0042] It should be noted that if the verification fails, a notification message indicating insufficient attachment permissions will be fed back to the data source. For example, if the data source has not registered an account with Data Factory.

[0043] It should be noted that regarding the attachment and management of data resource directories: Data resource owners are responsible for attaching their data resource directories to the Data Factory, and support is provided for self-attachment and management. This process ensures centralized management and efficient access to data resources.

[0044] S102: Receive a target data resource usage request required during product development, and send the target data resource usage request to the data resource provider and platform operator for review; the target data resource usage request includes designated resource directory information in the data factory.

[0045] In some implementations of this application, before receiving a request to use the target data resources required during product development, the developer can publish specific product requirements through the platform service mall. After receiving the product development requirements, the developer can conduct a detailed analysis of the product development requirements and determine the data resources required. This step promotes the precise matching of requirements and resources, laying the foundation for subsequent data use requests.

[0046] Based on this, when the product developer uploads the development requirements, the development requirements are input into the pre-built business decomposition network model to obtain multiple demand keyword combinations of the development requirements.

[0047] Each required keyword combination is searched and matched in the data resource directory of the data factory, and the directory entries with a matching degree exceeding the preset similarity threshold are determined as target data resources.

[0048] For example, the demand keyword combination: user desensitization, commodity transaction record, the matching directory entries are the desensitized user information table and the commodity transaction flow table.

[0049] It should be noted that the training process of the service disassembly network model is as follows:

[0050] Obtain sample development requirements and sample requirement keywords of the sample development requirements, use the sample development requirements as sample input, use the sample requirement keywords as sample labels, train the initial network model architecture, and obtain a business decomposition network model.

[0051] In some embodiments of this application, requests to use target data resources are subject to dual review by both the platform operator and the data resource provider. Once approved, the data resource provider allows the creation of simulation data based on development requirements and synchronizes it to a designated simulation database. This process effectively prevents direct access to the original data, reducing the risk of data leakage.

[0052] Based on this, the process of sending the target data resource use request to the data resource provider and platform operator for review can be as follows:

[0053] First, determine whether the data resource owner has ownership of the target data resource and whether the product development party has full data access rights to the target data resource.

[0054] When both parties have the same requirements, the target data resource usage request will be sent to the data resource party and the platform operator for review.

[0055] It should be noted that when the platform operator reviews, it will review whether the product developer has the application qualifications. When the data resource provider reviews, it can review whether the target data resources comply with the privacy protection policy (for example, whether they include sensitive fields).

[0056] If you do not have all the data access rights of the target data resource, a differential permission analysis report is generated. The differential permission analysis report includes accessible data items and inaccessible data items.

[0057] Provide product developers with an entry for applying for permission upgrades, and send the differentiated permission analysis report and the permission upgrade application entry to the product developers for confirmation.

[0058] After the permissions are upgraded, the request to use the target data resources will be sent to the platform operator for review.

[0059] If you do not own the target data resource, create an ownership review work order and send it to the platform operator for review.

[0060] Thus, the ownership review work order can be passed, so that all resource owners of the target data resources can review and agree, and then the platform operator can pass the review.

[0061] After the platform operator has reviewed and approved it, the target data resource usage request will be sent to the data resource provider for review.

[0062] S103: When all are reviewed and approved, the simulation data of the target data resource is synchronized to the simulation database, so that the product developer can develop the product on the server of the data resource owner according to the development and operation environment deployed by the platform operator and the simulation data.

[0063] It's important to note that product developers utilize simulation data for product development and, upon completion, deploy the product to the data provider's data cube domain. The data provider provides the necessary server resources, the platform operator deploys the operating environment, and the product developer is responsible for the specific deployment of the data product. This process ensures efficient and secure product development.

[0064] If all applications are not approved, the process is as follows:

[0065] First, identify the reasons for failure to pass the review and provide guidance on solutions.

[0066] The mapping table can be used to search for reasons for non-approval and provide guidance on solutions. For example, if a data sensitivity level mismatch occurs: an application is made for access to "highly sensitive data" (such as unmasked user biometrics), but the product developer lacks the necessary qualifications. The guidance solution is to obtain data security certification (such as Level 3 Security Protection), or to adjust the application to a lower-sensitivity level.

[0067] Generate an audit failure notification based on the reasons for failure and the guidance solution;

[0068] Send the review failure notification information to the product development party

[0069] S104: Deploy the developed product to the server of the data resource party.

[0070] In some implementations of this application, after product deployment is complete, the data resource provider assists the product developer in connecting the data resource to the real environment for testing. This step is a critical step before product delivery, verifying the stability and security of the product by simulating data interaction scenarios in a real environment.

[0071] Based on this, after the developed product is deployed to the server of the data resource party, a mapping relationship between the simulation data field and the field of the target data resource is established.

[0072] For example, the "virtual patient ID" in the simulated medical record corresponds to the "encrypted patient ID" in the real system), ensuring that data interaction during testing complies with the permissions and format specifications defined in the directory.

[0073] Then, based on the field mapping relationship and the target data resource, the developed product is tested on the data resource party's server. Finally, after passing the test, the developed product is confirmed to have passed the delivery verification.

[0074] In some implementations of this application, after testing and verification, the product is officially delivered to the developer for use. During the product operation process, the data resource party can monitor the data product's call to data resources in real time to promptly discover and address potential security risks.

[0075] Based on this, during the operation of the development product, the frequency of the development product's calls to the target data resources is monitored.

[0076] When the call frequency exceeds the preset frequency threshold, an operation risk notification information of the development product is generated and sent to the data resource party and the platform operator.

[0077] It should be noted that although the embodiments of this application are based on Figure 1Steps S101 to S104 are described in sequence, but this does not mean that steps S101 to S104 must be performed in a strict order. Figure 1 The order shown in FIG1 is to introduce and explain step S101 to step S104 in order to facilitate those skilled in the art to understand the technical solution of the embodiment of the present application. In other words, in the embodiment of the present application, the order between step S101 to step S104 can be appropriately adjusted according to actual needs.

[0078] pass Figure 1 Method, data sandbox technology: by building an independent data sandbox environment, it realizes the combination of physical isolation and logical isolation of data from different data resources, provides each tenant with exclusive data processing and storage space, realizes the combination of physical isolation and logical isolation of data, ensures the security and privacy of data in a shared resource environment, and effectively protects data security in a multi-tenant environment.

[0079] Simulation data technology: Using simulation data instead of original data for product development reduces the risk of data leakage and improves development efficiency.

[0080] Multi-dimensional audit mechanism: A data resource usage audit mechanism has been established with the participation of platform operators and data resource providers to ensure the legality and compliance of data use.

[0081] Real-time monitoring and risk warning: Provides real-time monitoring of data calls during product operation to promptly discover and address potential security risks.

[0082] More intuitively, Figure 2 A schematic diagram of a multi-tenant data resource security management method provided for the implementation of this application. Figure 2 In the data resource provider (data center, exchange center), the data resource provider is responsible for attaching the resource directory it owns to the data factory.

[0083] The demander publishes specific product requirements through the service mall, and the developer (product developer) analyzes the development requirements and determines the target data resources required.

[0084] The developer initiates an application request for data resource use. After dual review by the operator and the data resource provider, the data resource provider creates simulation data based on development requirements and synchronizes it to the designated simulation database.

[0085] Developers will deploy data products developed based on simulation data, and deliver the products to the demanders after passing the real environment test.

[0086] Based on the same idea, some embodiments of the present application also provide devices and non-volatile computer storage media corresponding to the above methods.

[0087] Figure 3 A schematic diagram of the structure of a multi-tenant data resource security management device provided in an embodiment of the present application includes:

[0088] at least one processor; and,

[0089] a memory communicatively connected to the at least one processor; wherein,

[0090] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any of the multi-tenant data resource security management methods described above.

[0091] Some embodiments of the present application provide a multi-tenant data resource security management non-volatile computer storage medium storing computer-executable instructions capable of executing any of the multi-tenant data resource security management methods described above.

[0092] The various embodiments in this application are described in a progressive manner. Similar portions between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the device and medium embodiments are generally similar to the method embodiments, so their descriptions are relatively simple. For relevant portions, refer to the descriptions of the method embodiments.

[0093] The devices and media provided in the embodiments of the present application correspond one-to-one to the methods. Therefore, the devices and media also have similar beneficial technical effects to their corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the devices and media will not be repeated here.

[0094] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0095] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0096] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0097] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps for the function specified in one or more boxes.

[0098] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0099] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0100] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0101] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0102] The foregoing is merely an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modifications, equivalent replacements, improvements, etc. made within the technical principles of the present application should fall within the scope of protection of the present application.

Claims

1. A multi-tenant data resource security management method, characterized in that: The method comprises: Attach the data resource directory uploaded by the data resource provider to the data factory to build an independent data sandbox environment; Receive a request for use of target data resources required during product development, and send the request to the data resource provider and platform operator for review; the request includes directory information of designated resources in the data factory; When all are reviewed and approved, the simulation data of the target data resource will be synchronized to the simulation database, so that the product developer can develop the product on the server of the data resource owner according to the development and operation environment deployed by the platform operator and the simulation data; Deploy the developed product to the server of the data resource party.

2. The method according to claim 1, characterized in that Before receiving a request for using target data resources required by a product during development, the method further includes: When the product developer uploads the development requirements, the development requirements are input into the pre-built business decomposition network model to obtain multiple demand keyword combinations of the development requirements; Combining each demand keyword to search and match the data resource catalog of the data factory; Directory entries whose matching degree exceeds a preset similarity threshold are determined as target data resources.

3. The method according to claim 1, characterized in that The step of attaching the data resource directory of the data resource party to the data factory specifically includes: Verifying the identity of the data resource party; After the verification is passed, the data resource directory is stored in the corresponding sandbox of the data factory according to the attachment authority of the data resource party.

4. The method according to claim 1, wherein The sending of the target data resource use request to the data resource provider and the platform operator for review specifically includes: Determine whether the data resource owner has ownership of the target data resource and whether the product developer has full data access rights to the target data resource; When both are present, the target data resource use request is sent to the data resource party and the platform operator for review.

5. The method according to claim 4, characterized in that The method further comprises: When the permissions are different, if the user does not have all the data access permissions of the target data resource, a differential permission analysis report is generated, wherein the differential permission analysis report includes accessible data items and inaccessible data items; Providing the product developer with a permission upgrade application portal, and sending the differentiated permission analysis report and the permission upgrade application portal to the product developer for confirmation; After the authority is upgraded, the request to use the target data resource is sent to the platform operator for review; If the target data resource is not owned, an ownership review work order is created and sent to the platform operator for review; After the review is passed, the target data resource use request is sent to the data resource party for review.

6. The method according to claim 1, wherein After deploying the developed product to the server of the data resource party, the method further includes: Establish a mapping relationship between simulation data fields and target data resource fields; Testing the developed product on the server of the data resource party according to the field mapping relationship and the target data resource; After the test is passed, it is determined that the developed product has passed the delivery verification.

7. The method according to claim 6, characterized in that After the test passes and it is determined that the developed product has passed delivery verification, the method further includes: During the operation of the development product, monitoring the frequency of the development product calling the target data resource; When the call frequency exceeds a preset frequency threshold, operation risk notification information of the developed product is generated, and the operation risk notification information is sent to the data resource party and the platform operator.

8. The method according to claim 1, characterized in that The method further comprises: If all applications are not approved, determine the reasons for failure and provide guidance on solutions; Generate audit failure notification information based on the reasons for failure to pass the audit and the guidance solution; The review failure notification information is sent to the product development party.

9. A multi-tenant data resource security management device, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the multi-tenant data resource security management method described in any one of claims 1-8 above.

10. A multi-tenant data resource security management non-volatile computer storage medium storing computer executable instructions, characterized in that: The computer executable instructions can execute a multi-tenant data resource security management method as described in any one of claims 1 to 8.

Images