Tenant traffic isolation method and system in multi-tenant environment, storage medium and computer equipment

Abstract

The invention relates to the technical field of computers, and discloses a tenant traffic isolation method and system in a multi-tenant environment, a storage medium and a computer device.The method comprises the steps that in response to a tenant creation instruction, a unique tenant identifier is allocated to a to-be-created tenant; creating a tenant resource and binding the tenant resource with the unique tenant identifier; determining a target node according to the creation requirement of the tenant, and scheduling the container unit at the target node; creating a dynamic network policy based on the network policy definition; when an access request of a first tenant application to a second tenant application is received, determining whether an access permission exists or not based on the dynamic network strategy, if yes, determining a target tenant namespace and a target tenant service entry based on a unique tenant identifier of the second tenant application, and sending the target tenant namespace and the target tenant service entry to the first tenant application; and finding a container unit where the second tenant application is located in the target tenant namespace through the target tenant service entry, and sending the access request to the container unit where the second tenant application is located. The method can be applied to the fields of financial science and technology and medical health.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computers, in particular to a tenant traffic isolation method and system in a multi-tenant environment, a storage medium and a computer device. BACKGROUND

[0002] With the rapid development of cloud computing and containerization technology, multi-tenant architecture has become the mainstream deployment mode in high-security requirement fields such as financial technology and smart medical care. In a multi-tenant cluster environment, the application programs (such as financial transaction systems and medical data platforms) of different tenants usually share underlying computing resources (such as Kubernetes clusters), but network traffic needs to be strictly isolated to prevent data leakage, malicious attacks or resource contention. For example, in the field of financial technology, the multi-tenant environment needs to meet strict compliance requirements to ensure that the transaction data and user information of different financial institutions are completely isolated in the shared cluster. For example, the payment systems of bank A and bank B may be deployed in the same Kubernetes cluster, but bank A's applications must be prohibited from directly accessing bank B's databases or internal APIs. For another example, in the field of smart medical care, the multi-tenant environment needs to protect the absolute security of patient privacy data (such as electronic medical records and genetic information) while supporting cross-institutional collaboration (such as hospitals and research institutions sharing de-identified data).

[0003] The prior art often implements isolation based on IP address or port isolation when isolating different tenant traffic, but this isolation method has the problems of insufficient flexibility and being easily bypassed. In particular, in a containerization and microservice architecture, tenant resources change dynamically, and traditional isolation methods are difficult to meet the dynamic change isolation requirements. SUMMARY

[0004] Therefore, the present application provides a tenant traffic isolation method and system in a multi-tenant environment, a storage medium and a computer device, which generates a unique and unforgeable tenant identifier, ensuring the uniqueness and security of the tenant identity and realizing accurate resource association. Independent tenant resources are created to achieve physical isolation, which is flexible and not easily bypassed. Fine-grained network policies can be dynamically generated, automatically updated with resource changes and compatible with existing cluster systems, meeting diverse security requirements. Access management plugins strictly verify access permissions to ensure accurate routing of access, and comprehensively guarantee the safe and stable operation of tenant resources, improving system management efficiency and security.

[0005] According to one aspect of the present application, a tenant traffic isolation method in a multi-tenant environment is provided, which is applied to a target cluster including a tenant identifier management module, a resource creation module, a resource scheduler, a network policy controller and an access management plugin. The method comprises:

[0006] The tenant identification management module allocates a unique tenant identification for a to-be-created tenant in response to a tenant creation instruction;

[0007] The resource creation module creates a tenant resource for the to-be-created tenant and binds the unique tenant identification with the tenant resource, wherein the tenant resource comprises a tenant namespace, a tenant service entrance and a container unit, and the container unit is used for deploying a tenant application;

[0008] The resource scheduler acquires a tenant creation demand corresponding to the tenant creation instruction, determines a target node from nodes of the target cluster according to the tenant creation demand, and schedules the container unit on the target node;

[0009] The network policy controller acquires a network policy definition corresponding to the to-be-created tenant, and creates a dynamic network policy matching the unique tenant identification based on the network policy definition, wherein the dynamic network policy comprises an access policy between tenant applications of different tenants;

[0010] The access management plug-in, when receiving an access request of a first tenant application of any first tenant to a second tenant application of a remaining tenant, calls the dynamic network policy, determines whether the first tenant application has an access right of the second tenant application based on the dynamic network policy, and when having the access right, determines a target tenant namespace and a target tenant service entrance of the second tenant application based on a unique tenant identification corresponding to the second tenant application, finds a container unit where the second tenant application is located in the target tenant namespace through the target tenant service entrance, and sends the access request to the container unit where the second tenant application is located.

[0011] According to another aspect of the present application, a tenant traffic isolation system in a multi-tenant environment is provided, comprising:

[0012] A tenant identification management module is configured to allocate a unique tenant identification for a to-be-created tenant in response to a tenant creation instruction;

[0013] A resource creation module is configured to create a tenant resource for the to-be-created tenant and bind the unique tenant identification with the tenant resource, wherein the tenant resource comprises a tenant namespace, a tenant service entrance and a container unit, and the container unit is used for deploying a tenant application;

[0014] A resource scheduler is configured to acquire a tenant creation demand corresponding to the tenant creation instruction, determine a target node from nodes of the target cluster according to the tenant creation demand, and schedule the container unit on the target node;

[0015] a network policy controller configured to obtain a network policy definition corresponding to the to-be-created tenant, and create a dynamic network policy matching the unique tenant identifier based on the network policy definition, wherein the dynamic network policy comprises an access policy between tenant applications of different tenants;

[0016] an access management plug-in configured to, when receiving an access request of a first tenant application of any first tenant to a second tenant application of a remaining tenant, invoke the dynamic network policy, determine whether the first tenant application has access permission of the second tenant application based on the dynamic network policy, and when having the access permission, determine a target tenant namespace and a target tenant service entry of the second tenant application based on a unique tenant identifier corresponding to the second tenant application, find a container unit where the second tenant application is located in the target tenant namespace through the target tenant service entry, and send the access request to the container unit where the second tenant application is located.

[0017] According to yet another aspect of the present application, a storage medium having a computer program stored thereon is provided, and the program is executed by a processor to implement the tenant traffic isolation method in the multi-tenant environment.

[0018] According to still another aspect of the present application, a computer device is provided, which comprises a storage medium, a processor, and a computer program stored in the storage medium and executable on the processor, and the processor implements the tenant traffic isolation method in the multi-tenant environment when executing the program.

[0019] By the technical scheme, the application provides a tenant flow isolation method and system in a multi-tenant environment, a storage medium and a computer device. When the tenant identifier management module receives a tenant creation instruction, a globally unique tenant identifier is first generated. Then, the resource creation module creates a tenant namespace, a tenant service entrance and a container unit in a target cluster according to tenant creation requirements. After the tenant resource is created, the resource creation module binds the unique tenant identifier generated in the first step to the created tenant resource. Further, the resource scheduler can obtain tenant creation requirements corresponding to the tenant creation instruction, and filter out an optimal target node from candidate nodes. Then, the resource scheduler deploys the container unit to the target node. After that, the network policy controller can dynamically generate a fine-grained dynamic network policy according to a network policy definition of a to-be-created tenant, in combination with the unique tenant identifier generated in the first step. When a first tenant application of a first tenant initiates an access request to a second tenant application of a second tenant, the access management plug-in first intercepts the access request and extracts the unique tenant identifier of the first tenant, and calls the dynamic network policy corresponding to the unique tenant identifier to verify whether the first tenant application has the permission to access the second tenant application. If the verification is passed, the access management plug-in can query the target tenant namespace and the target tenant service entrance bound to the unique tenant identifier of the second tenant application according to the unique tenant identifier of the second tenant application, find the container unit where the second tenant application is located in the target tenant namespace through the target tenant service entrance, and finally route the access request to the container unit where the second tenant application is located through the target tenant service entrance. The application generates a unique and unforgeable tenant identifier, guarantees the uniqueness and security of the tenant identity, and realizes accurate resource association. Independent tenant resources are created to realize physical isolation, and this isolation method is flexible and difficult to bypass. Fine-grained network policies can be dynamically generated, and the network policies can be automatically updated according to resource changes and compatible with existing cluster systems to meet diversified security requirements. The access management plug-in strictly verifies the access permission to ensure accurate routing of the access, and comprehensively guarantees the safe and stable operation of the tenant resources, and improves the system management efficiency and security.

[0020] The above description is only a summary of the technical scheme of the application. In order to more clearly understand the technical means of the application, the application can be implemented according to the content of the specification, and in order to make the above and other purposes, characteristics and advantages of the application more obvious and easy to understand, the following specific embodiments of the application are described. BRIEF DESCRIPTION OF DRAWINGS

[0021] The drawings described herein are used to provide further understanding of the application, and form a part of the application. The schematic embodiments of the application and the description thereof are used to explain the application, and do not constitute an improper limitation on the application. In the drawings:

[0022] Figure 1A flow diagram of a tenant traffic isolation method in a multi-tenant environment is shown.

[0023] Figure 2 A structural diagram of a tenant traffic isolation system in a multi-tenant environment is shown.

[0024] Figure 3 An apparatus structure diagram of a computer device is shown. DETAILED DESCRIPTION

[0025] The present application will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments. It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict.

[0026] A tenant traffic isolation method in a multi-tenant environment is provided in the present embodiment, as shown in Figure 1 applied in a target cluster, the target cluster comprising a tenant identification management module, a resource creation module, a resource scheduler, a network policy controller and an access management plug-in, the method comprising:

[0027] Step 101, the tenant identification management module allocates a unique tenant identification for a to-be-created tenant in response to a tenant creation instruction.

[0028] Step 102, the resource creation module creates a tenant resource for the to-be-created tenant, and binds the unique tenant identification with the tenant resource, wherein the tenant resource comprises a tenant namespace, a tenant service entrance and a container unit, and the container unit is used to deploy a tenant application.

[0029] Step 103, the resource scheduler obtains a tenant creation requirement corresponding to the tenant creation instruction, determines a target node from nodes of the target cluster according to the tenant creation requirement, and schedules the container unit on the target node.

[0030] Step 104, the network policy controller obtains a network policy definition corresponding to the to-be-created tenant, and creates a dynamic network policy matching the unique tenant identification based on the network policy definition, wherein the dynamic network policy comprises an access policy between tenant applications of different tenants.

[0031] Step 105: When the access management plug-in receives an access request from a first tenant application of any first tenant to a second tenant application of another tenant, it calls the dynamic network policy, determines whether the first tenant application has access rights to the second tenant application based on the dynamic network policy, and if it has access rights, determines the target tenant namespace and target tenant service entry of the second tenant application based on the unique tenant identifier corresponding to the second tenant application, finds the container unit where the second tenant application is located in the target tenant namespace through the target tenant service entry, and sends the access request to the container unit where the second tenant application is located.

[0032] The embodiments of the present application provide a method for isolating tenant traffic in a multi-tenant environment, which can be applied to a target cluster. Specifically, the target cluster may include a tenant identification management module, a resource creation module, a resource scheduler, a network policy controller, and an access management plug-in. The specific implementation process is as follows:

[0033] When the tenant identity management module receives a tenant creation instruction, it first generates a globally unique tenant identity (such as a UUID or distributed ID), ensuring that this unique tenant identity is unique and cannot be forged within the target cluster. This unique tenant identity serves as the tenant's unique identity credential, and all subsequent resource allocation and policy control are based on this identity.

[0034] Next, the resource creation module creates three core tenant resources in the target cluster based on tenant creation requirements: the tenant namespace, the tenant service portal, and the container unit (Pod). After the tenant resources are created, the resource creation module binds the unique tenant identifier generated in the first step to the created tenant resources. This binding ensures that subsequent resource scheduling and policy control can accurately target the resources of a specific tenant. The container unit is used to deploy tenant applications.

[0035] Furthermore, the resource scheduler can obtain the tenant creation requirements (such as CPU, memory, and node affinity) corresponding to the tenant creation instruction, combine them with the current resource status of the target cluster (such as node load and remaining resources), and use a scheduling algorithm (such as Kubernetes' DefaultScheduler) to select the optimal target node from the candidate nodes. The resource scheduler then deploys the container unit (Pod) to the target node.

[0036] Afterwards, the network policy controller can dynamically generate fine-grained network policies according to the network policy definition of the tenant to be created, combined with the unique tenant identifier generated in the first step. These dynamic network policies are indexed by unique tenant identifiers and define the permission matrix for cross-tenant access (e.g., tenant A can access tenant B's API but not the database). Dynamic network policies can be converted into formats recognizable by target clusters (such as Kubernetes NetworkPolicy) and applied in real time to access management plugins (such as CNI plugins), ensuring that dynamic network policies can be automatically updated as tenant resources change. Here, network policy definitions can be automatically entered by users, such as which tenant applications are allowed to access.

[0037] When a first tenant application of a first tenant initiates an access request to a second tenant application of a second tenant, the access management plugin first intercepts the access request and extracts the unique tenant identifier of the first tenant, and calls the dynamic network policy corresponding to the unique tenant identifier to verify whether the first tenant application has the right to access the second tenant application. If the verification is passed, the access management plugin can query the target tenant namespace and target tenant service entry bound to the unique tenant identifier corresponding to the second tenant application according to the unique tenant identifier corresponding to the second tenant application, find the container unit where the second tenant application is located in the target tenant namespace through the target tenant service entry, and finally route the access request to the IP and port of the container unit (Pod) where the second tenant application is located through the target tenant service entry. If the verification fails, the access management plugin can directly reject the access request and record a security event.

[0038] In a specific embodiment in the financial field, assume that a financial technology company builds a financial transaction cloud platform, which aims to provide safe and efficient financial transaction services for multiple banks, securities companies and other financial institutions. Different financial institutions access the platform as tenants and carry out financial businesses such as stock trading, fund buying and selling, foreign exchange exchange, etc., while ensuring strict isolation of data and transaction traffic between tenants to guarantee the independence and security of businesses.

[0039] When a new bank (e.g., ABC Bank) wants to access the financial transaction cloud platform, the platform administrator initiates a tenant creation instruction through the management interface. The tenant identification management module responds to this instruction and assigns a unique tenant identification to ABC Bank, such as "tenant_abc_bank_001". This unique identification will be used throughout the platform for all operations and resource management of ABC Bank. Next, the resource creation module creates a tenant namespace for ABC Bank, such as "abc-bank-namespace", to isolate various resources of ABC Bank, including transaction data, configuration information, etc. In addition, a tenant service entry is created, for example, a service entry "abc-bank-stock-service" is created for ABC Bank's stock trading service, which contains the access address and port information of the service, making it convenient for ABC Bank's customers to access its stock trading service through a specific address. In addition, a container unit (Pod) is created, in which ABC Bank's stock trading application, fund trading application, and other financial business applications are deployed. The resource creation module also binds the unique tenant identification "tenant_abc_bank_001" with the tenant namespace, tenant service entry, and container unit created above, and records it in the Kubernetes container orchestration system through the label method for subsequent query and management.

[0040] The resource scheduler further obtains the tenant creation requirements corresponding to the ABC Bank tenant creation instruction, such as the requirement that ABC Bank's stock trading application needs high CPU and memory resources and wants to be deployed on a node close to its data center location. The resource scheduler determines the appropriate target node from the nodes of the target cluster based on the resource usage, geographical location of each node in the target cluster, and the requirements of ABC Bank, using a scheduling algorithm. For example, a node located near the city where ABC Bank's data center is located is selected, which has sufficient CPU and memory resources. The container unit where ABC Bank's stock trading application is located is scheduled to the selected target node to ensure that the application can run on a node that meets the performance requirements.

[0041] The network policy controller obtains the network policy definition corresponding to the ABC bank. Assuming that the administrator has pre-configured a network policy that stipulates that the stock trading application of the ABC bank can only communicate with the clearing system and the risk control system on the platform, and cannot directly access the transaction data and services of other tenants (such as the XYZ securities company). Based on the network policy definition and the unique tenant identifier “tenant_abc_bank_001” of the ABC bank, the network policy controller creates a dynamic network policy. The policy clearly stipulates the access rules between the ABC bank application and other systems and services, for example, allowing the stock trading application of the ABC bank to access a specific port of the platform clearing system, but prohibiting access to any service of the XYZ securities company. The dynamic network policy is applied to the network layer of the target cluster to restrict the network traffic between the ABC bank container units through the NetworkPolicy resource of Kubernetes, ensuring that only traffic that meets the policy can pass through.

[0042] When a customer of the ABC bank initiates a stock trading request through the mobile application of the ABC bank, the request first arrives at the tenant service entrance “abc-bank-stock-service” of the ABC bank. Assuming that at this time the stock trading application of the ABC bank needs to access the risk control system of the platform for transaction risk assessment, the access management plug-in receives this internal access request. The access management plug-in invokes the previously created dynamic network policy to check whether the stock trading application of the ABC bank has the permission to access the risk control system. Since the network policy allows such access, the access management plug-in continues processing. According to the unique tenant identifier of the risk control system (assuming that it is the identifier of the platform itself), the access management plug-in determines the target tenant namespace and the target tenant service entrance of the risk control system. Through the target tenant service entrance, the container unit where the risk control system is located is found in the target tenant namespace, and the access request is sent to the container unit for risk assessment.

[0043] If the stock trading application of the ABC bank attempts to access the transaction service of the XYZ securities company, the access management plug-in can reject the request according to the dynamic network policy, because the dynamic network policy explicitly prohibits such cross-tenant illegal access, thereby achieving strict isolation of traffic between tenants.

[0044] Through the above application process, the tenant traffic isolation method in the multi-tenant environment can effectively guarantee the data security and business independence between financial institution tenants on the financial transaction cloud platform, and meet the strict requirements of the financial technology field for security and compliance.

[0045] By applying the technical solution of the embodiment, when the tenant identifier management module receives a tenant creation instruction, a globally unique tenant identifier is first generated. Then, the resource creation module creates a tenant namespace, a tenant service entry and a container unit in the target cluster according to tenant creation requirements. After the tenant resource is created, the resource creation module binds the unique tenant identifier generated in the first step to the created tenant resource. Further, the resource scheduler can obtain tenant creation requirements corresponding to the tenant creation instruction, and filter the optimal target node from the candidate nodes. Subsequently, the resource scheduler deploys the container unit to the target node. Then, the network policy controller can dynamically generate a fine-grained dynamic network policy according to the network policy definition of the to-be-created tenant, in combination with the unique tenant identifier generated in the first step. When a first tenant application of a first tenant initiates an access request to a second tenant application of a second tenant, the access management plug-in first intercepts the access request and extracts the unique tenant identifier of the first tenant, and calls the dynamic network policy corresponding to the unique tenant identifier to verify whether the first tenant application has the access right to the second tenant application. If the verification is passed, the access management plug-in can query the target tenant namespace and the target tenant service entry bound to the unique tenant identifier of the second tenant application according to the unique tenant identifier of the second tenant application, find the container unit where the second tenant application is located in the target tenant namespace through the target tenant service entry, and finally route the access request to the container unit where the second tenant application is located through the target tenant service entry. The embodiment of the application generates a unique and unforgeable tenant identifier, guarantees the uniqueness and security of the tenant identity, and realizes accurate resource association; creates independent tenant resources to realize physical isolation, which is flexible and difficult to bypass; can dynamically generate fine-grained network policies, which can be automatically updated with resource changes and compatible with existing cluster systems, and meet diversified security requirements; the access management plug-in strictly verifies the access right to ensure accurate routing of the access, and comprehensively guarantees the safe and stable operation of the tenant resource, and improves the system management efficiency and security.

[0046] In the embodiment of the application, the target cluster also includes an egress traffic controller. After step 101, the method further includes: when the network policy controller receives egress traffic of any second tenant, determining the unique tenant identifier of the any second tenant, embedding the unique tenant identifier of the any second tenant into the egress traffic, and sending the embedded egress traffic to the egress traffic controller; after the egress traffic controller receives the embedded egress traffic, identifying the unique tenant identifier embedded in the egress traffic, and determining a target egress gateway corresponding to the identified unique tenant identifier from a plurality of egress gateways, so as to forward the embedded egress traffic to a target receiving object through the target egress gateway, wherein each egress gateway forwards the egress traffic of one tenant.

[0047] In this embodiment, in the target cluster, in addition to the tenant identification management module, the resource creation module, the resource scheduler, the network policy controller, and the access management plug-in mentioned earlier, an egress traffic controller can also be included. The entire architecture aims to achieve the all-round isolation of tenant traffic in a multi-tenant environment, including internal traffic and egress traffic.

[0048] Specifically, when the application of any second tenant (e.g., tenant B) in the target cluster generates egress traffic, the traffic can first be received by the network policy controller. Egress traffic refers to traffic that is sent out from the tenant application, such as accessing external services, communicating with other tenants across clusters, etc. Next, the network policy controller determines the unique tenant identification of the second tenant to which the egress traffic belongs. After determining the unique tenant identification, the network policy controller embeds the identification in the egress traffic. There are multiple ways to embed, such as adding the unique tenant identification in a specific header field of the traffic (such as a custom HTTP header, a TCP option field, etc.), or inserting a specific identifier in the data packet of the traffic. The egress traffic with the embedded unique tenant identification is then sent to the egress traffic controller for subsequent egress gateway selection and forwarding operations.

[0049] After the egress traffic controller receives the egress traffic with the embedded unique tenant identification from the network policy controller, it identifies the embedded unique tenant identification from the received egress traffic. Specifically, it can perform corresponding parsing operations on the egress traffic according to the way the network policy controller embeds the unique tenant identification. For example, if it is embedded through the HTTP header, the identification information is extracted from the HTTP header; if it is embedded through a specific field in the data packet, the identification is read from the corresponding field. The egress traffic controller maintains a mapping relationship table between egress gateways and unique tenant identifications, which records the tenant traffic forwarded by each egress gateway. According to the identified unique tenant identification, the egress traffic controller can query this mapping relationship table to determine the target egress gateway corresponding to the unique tenant identification. After determining the target egress gateway, the egress traffic controller forwards the embedded egress traffic to the target receiving object through the target egress gateway. The target receiving object can be an external service provider, a tenant application in another cluster, etc. Each egress gateway is responsible for forwarding the egress traffic of a specific tenant, ensuring that the egress traffic of different tenants can also be isolated at the egress link, avoiding confusion and interference between tenants.

[0050] In the field of financial technology, assume that a financial transaction cloud platform provides services for multiple banks. Each bank accesses the platform as a tenant to conduct stock trading, fund trading, and other businesses. When an application of a bank (e.g., bank A) needs to access an external financial data service provider to obtain market quote data, the generated export traffic can be received by the network policy controller. The network policy controller determines that the traffic belongs to bank A, and embeds the unique tenant identifier of bank A into the traffic, and then sends it to the export traffic controller. The export traffic controller identifies the tenant identifier of bank A, determines the target export gateway corresponding to bank A according to the mapping relationship table. Finally, the export traffic controller forwards the traffic to the financial data service provider through the target export gateway, ensuring that the export traffic of bank A safely and independently reaches the target service provider, while avoiding confusion with the export traffic of other tenants (e.g., bank B).

[0051] In the embodiments of the present application, optionally, after the export traffic controller receives the embedded export traffic, the method further comprises: the export traffic controller parses the export traffic, identifies the target receiving object corresponding to the export traffic, and calls the tenant whitelist corresponding to the unique tenant identifier of any second tenant to determine whether the target receiving object exists in the tenant whitelist. When the target receiving object exists in the tenant whitelist, the steps of identifying the unique tenant identifier embedded in the export traffic and determining the target export gateway corresponding to the identified unique tenant identifier from the plurality of export gateways are performed, otherwise, the export traffic is intercepted, and an alarm prompt is output.

[0052] In this embodiment, the security of the export traffic is further enhanced to ensure that the export traffic of the tenant can only flow to the pre-authorized target receiving object. Specifically, after the export traffic controller receives the export traffic embedded with the unique tenant identifier from the network policy controller, the export traffic controller can parse the received export traffic. The parsing method depends on the type of export traffic, for example, if it is HTTP traffic, the HTTP request header, request body, and other information can be parsed; if it is TCP traffic, relevant fields in the TCP packet can be parsed. Subsequently, the relevant information of the target receiving object is extracted from the parsed traffic information. The target receiving object usually exists in the traffic in the form of an IP address, domain name, or specific service identifier. For example, in an HTTP request, the domain name of the target receiving object may appear in the Host header field; when a TCP connection is established, the IP address and port number of the target receiving object can be contained in the header information of the TCP packet.

[0053] In addition, the egress traffic controller can also retrieve the tenant's corresponding whitelist from a pre-configured tenant whitelist storage system according to the unique tenant identifier of the second tenant embedded in the egress traffic. The tenant whitelist is a list of target receiving objects that the tenant is allowed to access, which can be stored in a database, a configuration file, or a dedicated access control system. Further, the egress traffic controller compares the identified target receiving object with the retrieved tenant whitelist. If the target receiving object exists in the whitelist, it means that the tenant has the right to access the target receiving object, and then the subsequent egress gateway selection and traffic forwarding steps are continued; if the target receiving object does not exist in the whitelist, it means that the tenant is not authorized to access the target receiving object, and the egress traffic needs to be intercepted and an alarm prompt is output. In a specific embodiment, the egress traffic controller generates an alarm prompt message and outputs the message to a log system, a monitoring platform, or a notification channel of a related administrator. The alarm prompt message can include detailed information such as the unique tenant identifier, the target receiving object, the interception time, the traffic type, etc., so that the administrator can understand and handle the abnormal situation in a timely manner.

[0054] The embodiments of the present application further limit the access range of the tenant's egress traffic through the whitelist verification mechanism. Only the authorized target receiving objects can receive the tenant's egress traffic. This can effectively prevent the tenant's application from accessing malicious websites, leaking sensitive data, or making unauthorized external communication, thereby improving security.

[0055] In a specific embodiment, a tenant whitelist is configured for each participating medical institution tenant on a medical health data sharing cloud platform. This whitelist strictly limits the external medical data sources that each medical institution can access to ensure the legality, security, and compliance of data access. When the medical information system of medical institution A generates egress traffic and attempts to obtain the latest disease research data from an external authoritative medical research database, the egress traffic controller quickly receives the traffic and immediately analyzes the egress traffic to accurately identify the target receiving object as the specific domain name of the authoritative medical research database. Then, the egress traffic controller quickly retrieves the tenant whitelist of medical institution A for comparison and verification. After checking, it is found that the domain name of the authoritative medical research database exists in the whitelist, which means that medical institution A has the legal right to access the database. Subsequently, the egress traffic controller accurately identifies the unique tenant identifier of medical institution A, determines the corresponding target egress gateway according to the identifier, and then forwards the egress traffic to the authoritative medical research database through the egress gateway, ensuring that medical institution A can successfully obtain the required data.

[0056] In the embodiments of the present application, the target cluster optionally further comprises a gateway monitoring module; the method further comprises: the gateway monitoring module counting the number of egress traffic processing of each egress gateway according to a preset frequency; when the number of egress traffic processing of any egress gateway is greater than a first preset number threshold, the gateway monitoring module determines a target unique tenant identifier corresponding to the any egress gateway, and determines the number of egress gateways corresponding to the target unique tenant identifier in the current egress gateway, when the number is 1, a new egress gateway is created, and the new egress gateway is bound to the target unique tenant identifier; and / or, when the number of egress traffic processing of any egress gateway is less than a second preset number threshold, the gateway monitoring module determines a target unique tenant identifier corresponding to the any egress gateway, and determines the number of egress gateways corresponding to the target unique tenant identifier in the current egress gateway, when the number is greater than 1, the number of egress traffic processing of each egress gateway corresponding to the target unique tenant identifier is respectively determined, the egress gateway redundancy value of the target unique tenant identifier is calculated based on the number of egress traffic processing of each egress gateway, and egress gateway closing processing is performed according to the egress gateway redundancy value.

[0057] In this embodiment, the target cluster further comprises a gateway monitoring module. The gateway monitoring module can count the number of egress traffic processing of each egress gateway according to a preset frequency (such as every minute, every five minutes, etc.), to obtain the number of egress traffic processing of each egress gateway in a statistical period. The counting method can be realized by recording the number of data packets, the number of connections, etc. forwarded by the egress traffic controller through each egress gateway.

[0058] When the gateway monitoring module counts that the number of the exit traffic processed by any exit gateway is greater than a first preset number threshold, the gateway monitoring module determines a target unique tenant identifier corresponding to the exit gateway. Since each exit gateway is responsible for forwarding the exit traffic of a specific tenant, the target unique tenant identifier can be obtained by querying a mapping relationship table between the exit gateway and the unique tenant identifier. Here, the first preset number threshold can be determined according to the performance indicators of the exit gateway, historical traffic data, business requirements and other factors, for example, it can be set to 80% of the maximum number of traffic that the exit gateway can process under normal load. Further, the gateway monitoring module determines the number of exit gateways corresponding to the target unique tenant identifier in the current exit gateway. This step is to determine whether the tenant already has multiple exit gateways to process its exit traffic. When the number of exit gateways corresponding to the target unique tenant identifier is determined to be 1, it means that the exit traffic of the tenant is only processed by one exit gateway, and the load of the current exit gateway is already high. At this time, the gateway monitoring module creates a new exit gateway and binds the new exit gateway to the target unique tenant identifier. In this way, the exit traffic of the tenant can be distributed to multiple exit gateways for processing, reducing the load of a single exit gateway and improving the performance and reliability of the system.

[0059] When the gateway monitoring module counts that the number of the exit traffic processed by any exit gateway is less than a second preset number threshold, the gateway monitoring module determines a target unique tenant identifier corresponding to the exit gateway. Here, the second preset number threshold is usually set to a lower value, for example, 30% of the minimum number of traffic that the exit gateway can process under normal load, to determine whether the exit gateway is in a low load state. Further, the gateway monitoring module determines the number of exit gateways corresponding to the target unique tenant identifier in the current exit gateway. When the number of exit gateways corresponding to the target unique tenant identifier is greater than 1, it means that the tenant has multiple exit gateways to process its exit traffic, and there may be resource redundancy. At this time, the gateway monitoring module determines the number of exit traffic processed by each exit gateway corresponding to the target unique tenant identifier, and calculates an exit gateway redundancy value of the target unique tenant identifier based on these numbers. The calculation method of the exit gateway redundancy value can be designed according to actual needs, for example, the average value of all exit gateway processing numbers and the sum of the difference between each exit gateway processing number can be calculated, or other indicators that can reflect the degree of exit gateway resource redundancy can be used. According to the calculated exit gateway redundancy value, the gateway monitoring module performs exit gateway closing processing. For example, a redundancy value threshold can be set, and when the exit gateway redundancy value is greater than the threshold, part of the exit gateways are closed to release system resources. When closing the exit gateway, it is necessary to ensure that the remaining exit gateways can meet the exit traffic processing requirements of the tenant, and to do a good job of traffic migration and load balancing.

[0060] The embodiments of the present application can improve the performance and response speed of the system by dynamically adjusting the number of export gateways, allocating system resources according to the export traffic processing requirements of tenants. When the export traffic of a tenant is large, increasing the number of export gateways can share the load and avoid a single export gateway becoming a performance bottleneck. When the export traffic of a tenant is small, reducing the number of export gateways can release system resources and improve resource utilization. In addition, dynamically managing export gateways can improve the reliability and fault tolerance of the system. When a certain export gateway fails, traffic can be migrated to other export gateways in time to ensure the continuity of tenant services.

[0061] In the embodiments of the present application, the target cluster further includes a traffic prediction module and a gateway monitoring module; the method further includes: the traffic prediction module predicts the export traffic corresponding to each tenant at a preset frequency to obtain an export traffic prediction value; and the gateway monitoring module determines the gateway capacity of the export gateway corresponding to each tenant, and if the gateway capacity of the export gateway of any third tenant is less than the corresponding export traffic prediction value, a new export gateway is created and the new export gateway is bound to the unique tenant identifier of the any third tenant.

[0062] In this embodiment, the target cluster can further include a traffic prediction module and a gateway monitoring module. The traffic prediction module is responsible for predicting the export traffic of each tenant at a preset frequency, and the gateway monitoring module dynamically adjusts based on the prediction results and the capacity of the export gateway to ensure stable processing of export traffic and reasonable use of resources in a multi-tenant environment.

[0063] Specifically, the traffic prediction module performs prediction work at a preset frequency. This frequency can be flexibly determined according to business characteristics, traffic fluctuation rules, and system requirements for real-time performance. For example, for a business scenario with frequent traffic fluctuations and high real-time performance requirements, the frequency can be set to once per minute; for a scenario with relatively stable traffic and low real-time performance requirements, prediction can be performed every half hour or every hour. The traffic prediction module can use various prediction algorithms to calculate the predicted values of the export traffic of each tenant. Common algorithms include: time series analysis algorithms, such as ARIMA (Autoregressive Integrated Moving Average Model), which analyzes historical traffic data in time series to mine trends, seasonality, periodicity, and other characteristics, thereby predicting future traffic values. For example, if historical data shows that the export traffic of a tenant increases significantly in the morning of weekdays and is relatively stable in the afternoon, the ARIMA model can capture this trend and make accurate predictions. Machine learning algorithms, such as support vector machines (SVM), neural networks, etc. For example, a neural network can use a large amount of historical traffic data as training samples to learn the complex relationship between traffic and various influencing factors (such as time, business activities, etc.) by continuously adjusting network parameters, thereby predicting future traffic. For example, for an e-commerce tenant, a neural network can consider factors such as promotional activities, holidays, etc. to affect export traffic and improve prediction accuracy. After the above prediction algorithms are calculated, the traffic prediction module finally obtains the predicted values of the export traffic of each tenant in the future period. These predicted values will serve as an important basis for decision-making by the gateway monitoring module.

[0064] The gateway monitoring module determines the gateway capacity of the export gateway corresponding to each tenant. Gateway capacity can be measured from multiple dimensions, and common indicators include: bandwidth capacity, i.e., the maximum network bandwidth that the export gateway can support, usually measured in Mbps or Gbps. For example, an export gateway with a bandwidth capacity of 1 Gbps means that it can transmit up to 1 GB of data per second. Connection number capacity refers to the maximum number of connections that the export gateway can handle simultaneously. Different application scenarios have different requirements for the number of connections. For example, for high-concurrency web applications, the export gateway needs to support a large number of concurrent connections. Processing capacity capacity can be evaluated by CPU usage, memory usage, etc. of the export gateway. When the CPU usage is too high or the memory usage is too large, it indicates that the processing capacity of the export gateway is close to saturation.

[0065] Then, the gateway monitoring module compares the gateway capacity of the egress gateway corresponding to each tenant with the egress traffic prediction value of the tenant obtained by the traffic prediction module. This comparison process is a key step of dynamically adjusting the number of egress gateways. When it is found that the gateway capacity of the egress gateway of any third tenant is less than the corresponding egress traffic prediction value, it means that the egress gateway of the tenant cannot meet the future traffic demand that may occur, which may cause traffic congestion, processing delay and other problems. At this time, the gateway monitoring module triggers the operation of creating a new egress gateway. After the creation is completed, the gateway monitoring module binds the new egress gateway to the unique tenant identifier of the third tenant. In this way, the new egress gateway can be used to process the egress traffic of the tenant, ensuring the isolation and independent processing of tenant traffic.

[0066] The embodiment of the present application predicts the egress traffic of each tenant in advance through the traffic prediction module, so that the gateway monitoring module can take measures before the traffic reaches the upper limit of the egress gateway capacity, and create a new egress gateway to share the traffic, thereby effectively preventing the occurrence of traffic congestion problems and ensuring the continuity and stability of tenant business.

[0067] In a specific embodiment, in a financial transaction cloud platform, an egress gateway is allocated to each bank tenant to process its egress traffic. The traffic prediction module predicts the egress traffic of each bank tenant according to historical transaction data, market conditions, holidays and other factors, at a frequency of every 15 minutes. For example, before the holiday, it is predicted that the egress traffic of a certain bank tenant will increase significantly, because customers may conduct more financial transactions during the holiday. The gateway monitoring module monitors the bandwidth capacity and connection capacity of the egress gateway corresponding to each bank tenant in real time. When it is found that the egress traffic prediction value of a certain bank tenant will exceed the bandwidth capacity of its egress gateway in a future period of time, the gateway monitoring module immediately triggers the operation of creating a new egress gateway. After the creation of the new egress gateway is completed, it is bound to the unique tenant identifier of the bank tenant, ensuring that the egress traffic of the bank tenant can be processed in a timely and stable manner, avoiding transaction delay or failure due to excessive traffic.

[0068] In the embodiment of the present application, if the number of egress gateways corresponding to any unique tenant identifier is greater than 1, a round robin mechanism is used to determine the target egress gateway of the egress traffic sent by the tenant corresponding to the unique tenant identifier.

[0069] In this embodiment, when the number of corresponding egress gateways for a certain unique tenant identifier is greater than 1, a round-robin mechanism can be used to determine which egress gateway the egress traffic sent by the tenant is forwarded through. Round-robin is a common load balancing algorithm, and its core idea is to distribute requests to different servers (in this scenario, egress gateways) in turn according to a fixed order. Each egress gateway receives the egress traffic of the tenant in turn according to the fixed order, ensuring that each egress gateway can bear the traffic processing task relatively evenly, avoiding that a certain egress gateway is overloaded and affects performance, and also fully utilizing all available egress gateway resources.

[0070] Specifically, a list of egress gateways corresponding to each unique tenant identifier can be maintained. When a new egress gateway is allocated to a tenant or an egress gateway is removed, this list is updated in a timely manner. For example, a data structure such as an array or a linked list can be used to store the information of egress gateways, including the IP address, port number, etc. of the egress gateway. Assuming that the unique tenant identifier of tenant A is Tenant_A, and its corresponding egress gateway list is [Gateway_1, Gateway_2, Gateway_3]. Then, a round-robin pointer (usually an integer index) is set for each unique tenant identifier corresponding to the egress gateway list. Initially, the pointer points to the first egress gateway in the list. For example, for the egress gateway list of tenant A, the initial round-robin pointer index = 0, pointing to Gateway_1. When the tenant sends egress traffic, the corresponding egress gateway list and the current round-robin pointer are found according to the unique tenant identifier of the tenant. The current traffic is assigned to the egress gateway pointed to by the round-robin pointer for forwarding. For example, when tenant A sends egress traffic, according to index = 0, the egress traffic is assigned to Gateway_1. And the round-robin pointer is updated to point to the next egress gateway in the list. If the pointer has pointed to the last egress gateway in the list, the pointer is reset to 0, back to the beginning of the list, to achieve round-robin. For example, after assigning egress traffic to Gateway_1, index is updated to 1, and next time tenant A sends egress traffic, it will be assigned to Gateway_2; when index is updated to 3, it is reset to 0 again, and assigned to Gateway_1.

[0071] The embodiments of the present application can more evenly distribute egress traffic to multiple egress gateways processing egress traffic of the same tenant, avoid overloading of a certain egress gateway, and improve the overall performance and stability of the system.

[0072] In a specific embodiment, in a large medical health data sharing cloud service platform, a plurality of participating medical institution tenants use the platform to interact with external medical research institutions, drug regulatory departments, etc. Each medical institution tenant is assigned a unique tenant identifier. When medical institution A needs to upload a batch of patient clinical research data to an external authoritative medical research institution, first, according to the unique tenant identifier of medical institution A, the corresponding export gateway list [Channel_A, Channel_B, Channel_C] and the current polling pointer index = 1 (which points to Channel_B at this time) are quickly found in its configuration information. Then, according to the established rules, the clinical research data traffic to be uploaded by medical institution A this time is accurately allocated to Channel_B for forwarding. Channel_B will quickly start the data transmission process to ensure that the data can be accurately delivered to the authoritative medical research institution. After completing this data forwarding, the polling pointer can be automatically updated, and the value of index is updated to 2. In this way, when the next time medical institution A has data to send to the outside, the data traffic can be allocated to Channel_C for transmission according to the updated pointer. Through such a cycle of updating the polling pointer, balanced allocation of medical institution A's data traffic is achieved, avoiding congestion or failure of a certain data export channel due to excessive use, thereby ensuring the efficiency and stability of data interaction between medical institution A and external institutions.

[0073] In the embodiments of the present application, optionally, after the "binding the unique tenant identifier with the tenant resource" in step 102, the method further comprises: the access management plug-in determines the physical network in which the to-be-created tenant is located, and creates a virtual network of the to-be-created tenant in the physical network, and binds the virtual network with the unique tenant identifier; accordingly, the "sending the access request to the container unit in which the second tenant application is located" in step 105 comprises: the access management plug-in determines the target virtual network corresponding to the any first tenant, and sends the access request to the container unit in which the second tenant application is located through the target virtual network.

[0074] In this embodiment, after the unique tenant identifier is bound to the tenant resources, the access management plug-in first determines the physical network where the tenant to be created is located. The physical network can be a local area network within a data center, or a wide area network spanning multiple data centers. Then, the access management plug-in creates a virtual network for the tenant to be created in the physical network. The virtual network can be implemented using technologies such as virtual local area network (VLAN) and virtual extensible local area network (VXLAN), and is configured and managed by a software-defined network (SDN) controller. After the creation is completed, the virtual network is bound to the unique tenant identifier, so that the tenant to which each virtual network belongs can be clearly identified.

[0075] When any first tenant initiates an access request to access the container unit where the second tenant's application is located, the access management plug-in first determines the target virtual network corresponding to the first tenant based on the first tenant's unique tenant identifier carried in the access request. This process can be achieved by querying a pre-established mapping table between unique tenant identifiers and virtual networks. The access management plug-in then sends the access request to the container unit where the second tenant's application is located via the target virtual network.

[0076] This embodiment of the application creates an independent virtual network for each tenant, achieving network isolation between tenants and improving system security and stability. Applications and data of different tenants will not interfere with each other, and even if a tenant's network has problems, it will not affect the normal operation of other tenants.

[0077] Further, as Figure 1 The specific implementation of the method, the embodiment of the present application provides a tenant traffic isolation system in a multi-tenant environment, such as Figure 2 As shown, the system includes:

[0078] A tenant identification management module, configured to allocate a unique tenant identification to a tenant to be created in response to a tenant creation instruction;

[0079] A resource creation module, configured to create tenant resources for the tenant to be created and bind the unique tenant identifier to the tenant resources, wherein the tenant resources include a tenant namespace, a tenant service portal, and a container unit, and the container unit is used to deploy tenant applications;

[0080] A resource scheduler, configured to obtain a tenant creation requirement corresponding to the tenant creation instruction, determine a target node from the nodes of the target cluster according to the tenant creation requirement, and schedule the container unit on the target node;

[0081] a network policy controller configured to obtain a network policy definition corresponding to the to-be-created tenant, and create a dynamic network policy matching the unique tenant identifier based on the network policy definition, wherein the dynamic network policy comprises an access policy between tenant applications of different tenants;

[0082] an access management plug-in configured to, when receiving an access request of a first tenant application of any first tenant to a second tenant application of any second tenant, invoke the dynamic network policy, determine whether the first tenant application has access permission of the second tenant application based on the dynamic network policy, and when the access permission is available, determine a target tenant namespace and a target tenant service entry of the second tenant application based on a unique tenant identifier corresponding to the second tenant application, find a container unit where the second tenant application is located in the target tenant namespace through the target tenant service entry, and send the access request to the container unit where the second tenant application is located.

[0083] Optionally, the target cluster further comprises an egress traffic controller.

[0084] The network policy controller is further configured to, after allocating the unique tenant identifier for the to-be-created tenant, receive egress traffic of any second tenant, determine a unique tenant identifier of the any second tenant, embed the unique tenant identifier of the any second tenant into the egress traffic, and send the embedded egress traffic to the egress traffic controller.

[0085] The egress traffic controller is further configured to, after receiving the embedded egress traffic, identify the unique tenant identifier embedded in the egress traffic, and determine a target egress gateway corresponding to the identified unique tenant identifier from a plurality of egress gateways, so as to forward the embedded egress traffic to a target receiving object through the target egress gateway, wherein each egress gateway forwards egress traffic of one tenant.

[0086] Optionally, the egress traffic controller is further configured to, after receiving the embedded egress traffic, parse the egress traffic, identify a target receiving object corresponding to the egress traffic, invoke a tenant whitelist corresponding to the unique tenant identifier of the any second tenant, determine whether the target receiving object exists in the tenant whitelist, when the target receiving object exists in the tenant whitelist, perform the steps of identifying the unique tenant identifier embedded in the egress traffic and determining the target egress gateway corresponding to the identified unique tenant identifier from the plurality of egress gateways, and otherwise, intercept the egress traffic and output an alarm prompt.

[0087] Optionally, the target cluster further comprises a gateway monitoring module.

[0088] The gateway monitoring module is configured to count the number of egress traffic processes of each egress gateway according to a preset frequency.

[0089] The gateway monitoring module is further configured to determine a target unique tenant identifier corresponding to any egress gateway when the number of egress traffic processes of the egress gateway is greater than a first preset number threshold, determine the number of egress gateways corresponding to the target unique tenant identifier in the current egress gateways, create a new egress gateway when the number is 1, and bind the new egress gateway to the target unique tenant identifier; and / or,

[0090] The gateway monitoring module is further configured to determine a target unique tenant identifier corresponding to any egress gateway when the number of egress traffic processes of the egress gateway is less than a second preset number threshold, determine the number of egress gateways corresponding to the target unique tenant identifier in the current egress gateways, determine the number of egress traffic processes of each egress gateway corresponding to the target unique tenant identifier when the number is greater than 1, calculate an egress gateway redundancy value of the target unique tenant identifier based on the number of egress traffic processes of each egress gateway, and perform egress gateway closing processing according to the egress gateway redundancy value.

[0091] Optionally, the target cluster further includes a traffic prediction module and a gateway monitoring module.

[0092] The traffic prediction module is configured to predict the egress traffic corresponding to each tenant according to a preset frequency to obtain an egress traffic prediction value.

[0093] The gateway monitoring module is configured to determine the gateway capacity of the egress gateway corresponding to each tenant respectively, and create a new egress gateway and bind the new egress gateway to the unique tenant identifier of any third tenant if the gateway capacity of the egress gateway of the third tenant is less than the corresponding egress traffic prediction value.

[0094] Optionally, if the number of egress gateways corresponding to any unique tenant identifier is greater than 1, a polling mechanism is used to determine the target egress gateway of the egress traffic sent by the tenant corresponding to the unique tenant identifier.

[0095] Optionally, the access management plug-in is further configured to determine a physical network in which the to-be-created tenant is located after the unique tenant identifier is bound to the tenant resource, create a virtual network of the to-be-created tenant in the physical network, and bind the virtual network to the unique tenant identifier.

[0096] Correspondingly, the access management plug-in is further configured to determine a target virtual network corresponding to any first tenant, and send the access request to the container unit in which the second tenant application is located through the target virtual network.

[0097] It should be noted that for other corresponding descriptions of the functional units involved in the tenant traffic isolation system in a multi-tenant environment provided in the embodiment of the present application, please refer to Figure 1 The corresponding description in the method will not be repeated here.

[0098] The present application also provides a computer device, which can be a personal computer, a server, a network device, etc. Figure 3 As shown, the computer device includes a bus, a processor, a memory, and a communication interface, and may also include an input / output interface and a display device. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store location information. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, the steps of each method embodiment are implemented.

[0099] Those skilled in the art will understand that Figure 3 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0100] In one embodiment, a computer-readable storage medium is provided. The computer-readable storage medium may be non-volatile or volatile, and stores a computer program thereon. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0101] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0102] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0103] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the processes of the above-mentioned embodiments of the methods can be included. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (Read-Only Memory, ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (Magnetoresistive Random Access Memory, MRAM), ferroelectric memory (Ferroelectric Random Access Memory, FRAM), phase change memory (Phase Change Memory, PCM), graphene memory, etc. Volatile memory can include random access memory (Random Access Memory, RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (Static Random Access Memory, SRAM) or dynamic random access memory (Dynamic Random Access Memory, DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0104] Any combination of the technical features of the above embodiments can be made. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, however, as long as the combination of the technical features does not exist contradictory, it should be considered as the scope of the present application.

[0105] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent of the present application. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are within the scope of protection of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A tenant traffic isolation method in a multi-tenant environment, characterized in that: Applied to a target cluster, the target cluster includes a tenant identification management module, a resource creation module, a resource scheduler, a network policy controller, and an access management plug-in, the method includes: The tenant identification management module allocates a unique tenant identification to the tenant to be created in response to the tenant creation instruction; The resource creation module creates tenant resources for the tenant to be created and binds the unique tenant identifier to the tenant resources, wherein the tenant resources include a tenant namespace, a tenant service entry, and a container unit, and the container unit is used to deploy tenant applications; The resource scheduler obtains a tenant creation requirement corresponding to the tenant creation instruction, determines a target node from the nodes of the target cluster according to the tenant creation requirement, and schedules the container unit on the target node; The network policy controller obtains a network policy definition corresponding to the tenant to be created, and creates a dynamic network policy that matches the unique tenant identifier based on the network policy definition, wherein the dynamic network policy includes an access policy between tenant applications of different tenants; When the access management plug-in receives an access request from a first tenant application of any first tenant to a second tenant application of another tenant, the access management plug-in calls the dynamic network policy, determines whether the first tenant application has access rights to the second tenant application based on the dynamic network policy, and if it has access rights, determines the target tenant namespace and target tenant service portal of the second tenant application based on the unique tenant identifier corresponding to the second tenant application, finds the container unit where the second tenant application is located in the target tenant namespace through the target tenant service portal, and sends the access request to the container unit where the second tenant application is located.

2. The method according to claim 1, characterized in that The target cluster further includes an egress traffic controller; after allocating a unique tenant identifier to the tenant to be created, the method further includes: When the network policy controller receives the egress traffic of any second tenant, it determines the unique tenant identifier of any second tenant, embeds the unique tenant identifier of any second tenant into the egress traffic, and sends the embedded egress traffic to the egress traffic controller; After receiving the embedded egress traffic, the egress traffic controller identifies the unique tenant identifier embedded in the egress traffic, and determines a target egress gateway corresponding to the identified unique tenant identifier from multiple egress gateways, so as to forward the embedded egress traffic to the target receiving object through the target egress gateway, wherein each egress gateway forwards the egress traffic of one tenant.

3. The method according to claim 2, characterized in that After the outlet flow controller receives the embedded outlet flow, the method further includes: The export traffic controller parses the export traffic, identifies the target receiving object corresponding to the export traffic, and calls the tenant whitelist corresponding to the unique tenant identifier of any second tenant to determine whether the target receiving object exists in the tenant whitelist. When the target receiving object exists in the tenant whitelist, the steps of identifying the unique tenant identifier embedded in the export traffic and determining the target export gateway corresponding to the identified unique tenant identifier from multiple export gateways are executed. Otherwise, the export traffic is intercepted and an alarm prompt is output.

4. The method according to claim 2, characterized in that The target cluster further includes a gateway monitoring module; the method further includes: The gateway monitoring module counts the number of egress traffic processed by each egress gateway according to a preset frequency; When the egress traffic processing quantity of any egress gateway is greater than a first preset quantity threshold, the gateway monitoring module determines the target unique tenant identifier corresponding to any egress gateway, and determines the number of egress gateways corresponding to the target unique tenant identifier in the current egress gateway; when the number is 1, creates a new egress gateway, and binds the new egress gateway to the target unique tenant identifier; and / or, When the number of export traffic processed by any export gateway is less than a second preset number threshold, the gateway monitoring module determines the target unique tenant identifier corresponding to any export gateway, and determines the number of export gateways corresponding to the target unique tenant identifier in the current export gateway. When the number is greater than 1, the export traffic processing number of each export gateway corresponding to the target unique tenant identifier is determined respectively. Based on the export traffic processing number of each export gateway, the export gateway redundancy value of the target unique tenant identifier is calculated, and the export gateway shutdown processing is performed according to the export gateway redundancy value.

5. The method according to claim 2, characterized in that The target cluster further includes a traffic prediction module and a gateway monitoring module; the method further includes: The traffic prediction module predicts the egress traffic corresponding to each tenant according to a preset frequency to obtain an egress traffic prediction value; The gateway monitoring module determines the gateway capacity of the export gateway corresponding to each tenant respectively. If the gateway capacity of the export gateway of any third tenant is less than the corresponding export traffic prediction value, a new export gateway is created and the new export gateway is bound to the unique tenant identifier of any third tenant.

6. The method according to claim 4 or 5, characterized in that If the number of egress gateways corresponding to any unique tenant identifier is greater than 1, a polling mechanism is used to determine the target egress gateway of the egress traffic sent by the tenant corresponding to the unique tenant identifier.

7. The method according to claim 1, characterized in that After binding the unique tenant identifier with the tenant resource, the method further includes: The access management plug-in determines the physical network where the tenant to be created is located, creates a virtual network of the tenant to be created in the physical network, and binds the virtual network to the unique tenant identifier; Accordingly, sending the access request to the container unit where the second tenant application is located includes: The access management plug-in determines a target virtual network corresponding to any first tenant, and sends the access request to the container unit where the second tenant application is located through the target virtual network.

8. A tenant traffic isolation system in a multi-tenant environment, characterized in that: include: A tenant identification management module, configured to allocate a unique tenant identification to a tenant to be created in response to a tenant creation instruction; A resource creation module, configured to create tenant resources for the tenant to be created and bind the unique tenant identifier to the tenant resources, wherein the tenant resources include a tenant namespace, a tenant service portal, and a container unit, and the container unit is used to deploy tenant applications; A resource scheduler, configured to obtain a tenant creation requirement corresponding to the tenant creation instruction, determine a target node from the nodes of the target cluster according to the tenant creation requirement, and schedule the container unit on the target node; A network policy controller, configured to obtain a network policy definition corresponding to the tenant to be created, and create a dynamic network policy that matches the unique tenant identifier based on the network policy definition, wherein the dynamic network policy includes an access policy between tenant applications of different tenants; An access management plug-in is used to call the dynamic network policy when receiving an access request from a first tenant application of any first tenant to a second tenant application of other tenants, determine whether the first tenant application has access rights to the second tenant application based on the dynamic network policy, and if it has access rights, determine the target tenant namespace and target tenant service entry of the second tenant application based on the unique tenant identifier corresponding to the second tenant application, find the container unit where the second tenant application is located in the target tenant namespace through the target tenant service entry, and send the access request to the container unit where the second tenant application is located.

9. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

10. A computer device comprising a storage medium, a processor, and a computer program stored in the storage medium and executable on the processor, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

Images