Data isolation methods, devices and equipment

Abstract

This application relates to the field of data processing technology and provides a data isolation method, apparatus, and device. The method includes: responding to a target tenant's access request for a target data resource, obtaining the target tenant's security level and the target data resource's sensitivity level; using the security level and sensitivity level as a target union key, obtaining an isolation granularity matching the target union key in a preset mapping matrix; determining the target tenant's risk level based on the target tenant's access behavior data; adjusting the matching isolation granularity according to the risk level to obtain an adjusted isolation granularity; determining a data isolation strategy for the target data resource based on the adjusted isolation granularity; and performing corresponding isolation operations on the target data resource according to the data isolation strategy. Using this application, precise adaptation between the data isolation strategy and the access scenario can be achieved, simultaneously considering data security protection needs and resource utilization efficiency.

Description

Technical Field

[0001] This application belongs to the field of data processing technology, and in particular relates to a data isolation method, apparatus and equipment. Background Technology

[0002] With the widespread adoption of multi-tenant technology, sharing the same application system among different tenants has become the mainstream deployment model. To ensure data security among tenants, multi-tenant systems typically require isolated storage and access control for the data of different tenants.

[0003] In traditional technologies, some multi-tenant data isolation solutions struggle to simultaneously address resource utilization efficiency and data security requirements in complex access scenarios, resulting in resource waste or insufficient security protection. Summary of the Invention

[0004] This application provides a data isolation method, apparatus, and device that can accurately adapt data isolation strategies to access scenarios, thereby simultaneously addressing data security protection needs and resource utilization efficiency.

[0005] In a first aspect, embodiments of this application provide a data isolation method, including: In response to a target tenant's access request to a target data resource, obtain the target tenant's security level and the target data resource's sensitivity level; Using security level and sensitivity level as target union keys, the isolation granularity matching the target union key is obtained from the preset mapping matrix; the preset mapping matrix stores the mapping relationship between different union keys and their corresponding isolation granularities; Based on the target tenant's access behavior data, determine the risk level of the target tenant; The isolation granularity is adjusted according to the risk level to obtain the adjusted isolation granularity; Based on the adjusted isolation granularity, determine the data isolation strategy for the target data resources; Perform corresponding isolation operations on the target data resources according to the data isolation strategy.

[0006] In one possible implementation of the first aspect, the access behavior data includes at least one behavioral factor among access frequency, number of abnormal accesses, number of unauthorized access attempts, access time deviation, and data access concentration; determining the risk level of the target tenant based on the target tenant's access behavior data includes: mapping the data values ​​of each behavioral factor of the target tenant to a score value; obtaining a comprehensive risk score based on each score value; and determining the risk level of the target tenant based on the comprehensive risk score.

[0007] In one possible implementation of the first aspect, the matched isolation granularity is adjusted according to the risk level to obtain the adjusted isolation granularity, including: when the risk level is normal, the matched isolation granularity is directly used as the adjusted isolation granularity; when the risk level is the target risk level, the matched isolation granularity is adjusted according to the direction of increasing isolation strength to obtain the adjusted isolation granularity; the adjusted isolation granularity is not higher than the isolation granularity with the highest strength; the target risk level is any risk level other than normal.

[0008] In one possible implementation of the first aspect, the data isolation strategy for the target data resource is determined based on the adjusted isolation granularity, including: when the adjusted isolation granularity is row-level isolation, determining a first data isolation strategy for the target data resource; the first data isolation strategy includes: adding the tenant identifier of the target tenant to the data query statement corresponding to the target data resource to generate filtering conditions; the filtering conditions are used to ensure that the query results obtained when querying the target data resource only include the data rows corresponding to the target tenant.

[0009] In one possible implementation of the first aspect, the data isolation strategy for the target data resource is determined based on the adjusted isolation granularity, including: when the adjusted isolation granularity is table-level isolation, determining a second data isolation strategy for the target data resource; the second data isolation strategy includes: routing access requests to an independent data table corresponding to the target tenant, so as to perform data access operations on the target data resource through the independent data table.

[0010] In one possible implementation of the first aspect, the data isolation strategy for the target data resource is determined based on the adjusted isolation granularity, including: when the adjusted isolation granularity is database-level isolation, a third data isolation strategy for the target data resource is determined; the third data isolation strategy includes: routing access requests to the independent database instance corresponding to the target tenant, so as to perform data access operations on the target data resource through the independent database instance.

[0011] In one possible implementation of the first aspect, the security level and the sensitivity level are stored in a first configuration structure and a second configuration structure, respectively; the first configuration structure and the second configuration structure are decoupled and independent of each other, the first configuration structure is used to independently maintain the security level of different tenants, and the second configuration structure is used to independently maintain the sensitivity level of different data resources.

[0012] In one possible implementation of the first aspect, the data isolation method further includes: acquiring attribute change trend data of the target object within a target time period; the target object is the target tenant and / or the target data resource; performing time-series smoothing processing on the attribute change trend data within a future time window to obtain a smooth curve in the future time window, and comparing the smooth curve with a change threshold to obtain the probability of change of the target object's level within the future time window; the level includes a security level and / or a sensitivity level; when the change probability exceeds a preset threshold, triggering a level change operation.

[0013] Secondly, embodiments of this application provide a data isolation device, including: The acquisition module is used to respond to the target tenant's access request for the target data resource and acquire the target tenant's security level and the target data resource's sensitivity level. The matching module is used to obtain the isolation granularity that matches the target key in a preset mapping matrix, using the security level and sensitivity level as the target key. The preset mapping matrix stores the mapping relationship between different keys and their corresponding isolation granularities. The risk assessment module is used to determine the risk level of a target tenant based on its access behavior data. The adjustment module is used to adjust the matched isolation granularity according to the risk level to obtain the adjusted isolation granularity; The strategy determination module is used to determine the data isolation strategy for the target data resources based on the adjusted isolation granularity. The execution module is used to perform corresponding isolation operations on the target data resources according to the data isolation strategy.

[0014] Thirdly, embodiments of this application provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the data isolation method described in any of the first aspects above.

[0015] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the data isolation method described in any of the first aspects above.

[0016] Fifthly, embodiments of this application provide a computer program product that, when run on a computer device, causes the computer device to execute the data isolation method described in any of the first aspects above.

[0017] The beneficial effects of the embodiments in this application compared with the prior art are: This application provides a data isolation method, apparatus, and device. In response to a target tenant's access request for target data resources, it obtains the target tenant's security level and the target data resource's sensitivity level. This ensures that the input information for access decisions simultaneously encompasses two dimensions: the access subject attribute (tenant security level) and the access object attribute (data sensitivity level), providing a more comprehensive data foundation for subsequent accurate matching. Based on this, using the security level and sensitivity level as the target joint key, it obtains the isolation granularity matching the target joint key in a preset mapping matrix. By treating the security level and sensitivity level as independent variables for joint determination, each combination of security level and sensitivity level corresponds to a unique and differentiated isolation granularity. For example, when the target tenant's security level is high and the target data resource's sensitivity level is low, the joint mapping will match a relatively loose isolation granularity, avoiding waste of computing and storage resources due to excessive isolation in this access scenario. When the target tenant's security level is low and the target data resource's sensitivity level is high, the joint mapping will match a relatively... Strict isolation granularity enables the avoidance of security risks caused by insufficient isolation in this access scenario, thus overcoming the deficiency of a single data dimension in distinguishing complex access scenarios (such as the differentiated needs of different tenants accessing data of the same sensitivity level), and significantly improving the adaptation accuracy between isolation granularity and complex access scenarios. Based on this, the risk level of the target tenant is further determined based on the target tenant's access behavior data, and the matching isolation granularity is adjusted according to the risk level, so that the isolation granularity can be dynamically adjusted with changes in tenant behavior risk, providing a data foundation for the dynamic adaptation of subsequent data isolation strategies in the spatiotemporal dimensions. Then, the data isolation strategy of the target data resource is determined according to the adjusted isolation granularity, and the corresponding isolation operation is executed on the target data resource according to the data isolation strategy, transforming the adjusted isolation granularity into actual isolation execution actions. This ensures that the final isolation operation is both accurately matched with the inherent attributes of the access scenario (the combination of security level and sensitivity level) and dynamically adapted to the real-time behavioral risks of the tenant, thus achieving a technical effect that balances data security protection and resource utilization efficiency. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart illustrating a data isolation method provided in this application; Figure 2This is a flowchart illustrating another data isolation method provided in this application; Figure 3 This is a sequence diagram of how each functional module in this application processes data query requests; Figure 4 This is a sequence diagram of the security level change processing of each functional module provided in this application; Figure 5 This is a schematic diagram of the structure of a data isolation device provided in this application; Figure 6 This is a schematic diagram of the structure of a computer device provided in this application. Detailed Implementation

[0020] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0021] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0022] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0023] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0024] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0025] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0026] In traditional technologies, some multi-tenant data isolation solutions struggle to simultaneously address resource utilization efficiency and data security requirements in complex access scenarios, resulting in resource waste or insufficient security protection.

[0027] To overcome the aforementioned technical deficiencies, in an exemplary embodiment, such as Figure 1 As shown, a data isolation method is provided. Taking the application of this method to a computer device as an example, the method includes the following steps: S101, in response to the target tenant's access request to the target data resource, obtain the target tenant's security level and the target data resource's sensitivity level.

[0028] The target tenant refers to a service subscriber or user entity that initiates a data access request under a multi-tenant architecture, and it has an independent identity and resource configuration.

[0029] The target data resource refers to the specific data object that the target tenant requests to access, such as a database table, field, file, or API (Application Programming Interface).

[0030] Security level refers to a graded identifier that characterizes the security compliance requirements or importance of a target tenant, and it exists independently of data attributes.

[0031] In one embodiment, the computer device determines the tenant's security level as follows: Information is collected from five dimensions: the tenant's industry compliance requirements, security level protection classification, security service level agreement, historical security incident records, and business scale and development stage. Each dimension is quantified and scored according to the following rules, with a total score of 100 points: (1) Industry compliance requirements (0-20 points): 0 points for industries without strong regulatory constraints; 20 points for industries with strong regulation such as finance and government affairs; 10 points for other industries subject to certain regulations.

[0032] (2) Level protection classification (0-20 points): Level 1 or Level 2 is worth 0 points; Level 3 is worth 15 points; Level 4 and above is worth 20 points.

[0033] (3) Security Service Level Agreement (0-15 points): 0 points for no agreement on high availability or rapid security response requirements; 15 points for an agreement on higher security service standards; 8 points for general agreements.

[0034] (4) Historical security incident records (0-20 points): 0 points for no major security incident records; 10 points for general security incident records; 20 points for major security incident records.

[0035] (5) Business scale and development stage (0-25 points): 5 points for the start-up stage; 15 points for the growth stage; 25 points for strategic tenants.

[0036] The scores for the five dimensions are added together to obtain a comprehensive evaluation score (0-100 points). The comprehensive evaluation score is then compared with the security level range: 0-40 points is normal; 41-70 points is advanced; and 71-100 points is core.

[0037] For example, a fintech company, as a tenant, meets the following industry compliance requirements: strong financial regulation (20 points), Level 3 security protection classification (15 points), 99.99% availability requirement (15 points), no major historical security incident records (0 points), and is in a growth stage (15 points). Its comprehensive assessment score is 20+15+15+0+15=65 points, falling within the 41-70 point range. Therefore, the tenant's security level is determined to be high. If the tenant subsequently upgrades its security protection classification to Level 4, the comprehensive assessment score will increase accordingly to 70 points (20+20+15+0+15=70 points), still within the 41-70 point range. If it simultaneously enters the strategic development stage, the comprehensive assessment score will increase to 80 points (20+20+15+0+25=80 points), falling within the 71-100 point range. The computer equipment will then update its security level to core.

[0038] When the regulatory standards of the tenant's industry are upgraded, the above assessment process will be repeated to update the tenant's security level.

[0039] Sensitivity level refers to a classification label that characterizes the confidentiality of the target data resource content or the impact of leakage. It can be determined according to the data classification and grading specifications and is unrelated to the identity of the tenant accessing the data.

[0040] In one embodiment, the specific implementation method for a computer device to determine the sensitivity level of data resources is as follows: Information is collected on four dimensions of the data resource: data content type, scope of impact after leakage, legal or regulatory requirements, and economic and compliance losses. Each dimension is quantified and scored according to the following rules, with a total score of 100 points: (1) Data content type (0-25 points): Publicly available announcements are worth 0-5 points; general business data is worth 6-15 points; personal privacy or core business data is worth 16-25 points.

[0041] (2) Scope of impact after leakage (0-25 points): Determined based on three sub-factors: number of users involved, business coverage area, and number of related systems. The specific scoring rules for each sub-factor are as follows: Number of users (0-10 points): 0 points for less than 1,000 users; 3 points for 1,000 to 10,000 users; 5 points for 10,000 to 100,000 users; 7 points for 100,000 to 1,000,000 users; 10 points for more than or equal to 1,000,000 users.

[0042] Business coverage area (0-8 points): 0 points for covering a single province or city; 4 points for covering multiple provinces or cities but not nationwide; 8 points for covering the whole country or across countries.

[0043] Number of associated systems (0-7 points): 0 points for unrelated connections; 3 points for 1 to 3 associated systems; 5 points for 4 to 6 associated systems; 7 points for 7 or more associated systems.

[0044] The scores of the three sub-factors are added together to obtain the score for the scope of impact after the leak, with a total score range of 0-25 points.

[0045] (3) Legal and regulatory requirements or industry standards (0-25 points): 0-5 points for no specific legal requirements; 6-15 points for being subject to general legal requirements; 16-25 points for being subject to the financial, government, medical and other strongly regulated industry standards, or involving specific legal requirements such as the Personal Information Protection Law and the Data Security Law.

[0046] (4) Economic and Compliance Losses (0-25 points): Estimated based on the potential direct economic losses, regulatory fines, business interruption duration, and reputational damage. For example, no loss is scored as 0-5 points; general loss as 6-15 points; and significant loss as 16-25 points.

[0047] Add the scores from the four dimensions to obtain the overall hazard score (0-100 points). Compare the overall hazard score with the sensitivity level range: 0-25 points are public; 26-50 points are ordinary; 51-75 points are sensitive; 76-100 points are confidential.

[0048] For example, a certain data resource is personal privacy data, with the data content type accounting for 20 points; it involves approximately 100,000 users (7 points), covers the entire country (8 points), and is associated with 5 systems (5 points), so the total score for the scope of impact after leakage is 7+8+5=20 points; it is subject to the Personal Information Protection Law, so the regulatory requirements account for 20 points; it may cause significant compliance fines and reputational damage, so the damage accounts for 15 points; the comprehensive harm score is 20+20+20+15=75 points, which is in the range of 51-75 points, so the sensitivity level of this data resource is determined to be sensitive.

[0049] One feasible approach is for the computer device to read the security level of the target tenant and the sensitivity level of the target data resource from the cache upon receiving an access request from a target tenant for a target data resource. Specifically, upon system startup or upon receiving a configuration update event, the system pre-loads tenant configuration information and data dictionary information into the memory cache. The tenant configuration information includes the tenant identifier and its corresponding security level for each tenant; the data dictionary information includes the data resource identifier and its corresponding sensitivity level for each data resource. When an access request from a target tenant for a target data resource arrives, the system retrieves the corresponding security level from the memory cache using the tenant identifier as the key, and the corresponding sensitivity level from the memory cache using the data resource identifier of the target data resource as the key. This approach reduces the latency in obtaining security and sensitivity levels, meeting the performance requirements of high-concurrency scenarios.

[0050] Another feasible approach is for the computer device, upon receiving an access request from a target tenant for a target data resource, to initiate a query request to the configuration management service via a remote procedure call or Hypertext Transfer Protocol (HTTP) interface. The configuration management service manages the persistently stored tenant configuration table and data dictionary table. The tenant configuration table stores the tenant identifier and its corresponding security level for each tenant, while the data dictionary table stores the data resource identifier and its corresponding sensitivity level for each data resource. The configuration management service then retrieves the security level corresponding to the target tenant's tenant identifier from the tenant configuration table and the sensitivity level corresponding to the target data resource's data resource identifier from the data dictionary table, and returns the retrieval results. This method ensures that the security and sensitivity levels obtained are always the latest versions, avoiding policy misjudgments caused by cache synchronization delays, and is suitable for scenarios with extremely high real-time requirements for security policies.

[0051] As an optional implementation, the security level and sensitivity level are stored in a first configuration structure and a second configuration structure, respectively. The first configuration structure and the second configuration structure are decoupled and independent of each other. The first configuration structure is used to independently maintain the security level of different tenants, and the second configuration structure is used to independently maintain the sensitivity level of different data resources.

[0052] The first configuration structure refers to a data organization form specifically used for persistent storage of tenant-side security attributes. It can use the tenant identifier as the primary key or index to record the security level and other compliance attributes corresponding to each tenant.

[0053] The second configuration structure refers to a data organization form specifically used for persistent storage of sensitive attributes on the data side. It can use the data resource identifier as the primary key or index to record the sensitivity level and classification information corresponding to each data resource.

[0054] Decoupling and independence mean that the first configuration structure and the second configuration structure do not have any mandatory association constraints in physical storage or logical management. For example, they do not contain foreign key constraints, cascading update triggers or transactional dependencies. Reading, writing or deleting operations on either configuration structure will not automatically trigger any modification or verification of the other configuration structure. The two are only associated at runtime through application layer business logic.

[0055] The computer device can maintain a tenant configuration table (tenant_config), which serves as the first configuration structure. This table can contain fields such as tenant unique identifier (tenant_id), tenant name (tenant_name), security level (security_level), compliance type (compliance_type), and level protection level (level_protection_grade). The security level field can use an enumeration type to store "Normal," "Advanced," or "Core." The computer device can also maintain a data dictionary table (data_dictionary), which serves as the second configuration structure. This table can contain fields such as data resource unique identifier (resource_id), resource name (resource_name), sensitivity level (sensitivity_level), and data classification (data_classification). The sensitivity level field uses an enumeration type to store "Public," "Normal," "Sensitive," or "Confidential."

[0056] The tenant configuration table and the data dictionary table do not have any foreign key relationships. Therefore, when it is necessary to modify the security level of a tenant, the computer device can execute update statements only for the tenant configuration table, and the database engine will not check or lock any records in the data dictionary table; conversely, when reassessing the sensitivity level of a certain type of data, only the data dictionary table is manipulated.

[0057] As a specific implementation method, the computer equipment can establish an independent tenant configuration table for each tenant, as shown in Table 1. The tenant's security level (i.e., security grade) is completely independent of any data attribute, and its value can be independently set by the platform administrator, without depending on the sensitivity of the data possessed by the tenant. The configuration of the tenant's security level is based on, but is not limited to: industry compliance requirements (such as those in the financial or government sectors subject to strict regulation), graded protection level (GB / T 22240-2020, Level 3 and above require physical isolation), security service level agreement, historical security incident records, the tenant's business scale and development stage (e.g., startup tenants can be configured as "normal," growth-stage tenants can be upgraded to "advanced," and strategic-level tenants can be configured as "core"), and the regulatory dynamics of the tenant's industry (e.g., when industry regulatory standards are upgraded, the system can prompt the administrator to reassess the tenant's security level).

[0058] Table 1 Tenant Configuration Table

[0059] Computer equipment can establish an independent data dictionary table for each data resource, as shown in Table 2. The data sensitivity level (i.e., sensitivity level) is configured based on the confidentiality of the data content itself, and is unrelated to the security level of the tenant accessing the data.

[0060] Table 2 Data Dictionary Table

[0061] The tenant configuration table and the data dictionary table are two logically separate and independent storage structures. They can reside in different tables within the same database instance or in different storage systems. There are no foreign key constraints or cascading update relationships between the tenant configuration table and the data dictionary table; modifications to one will not automatically affect the other. When a tenant's security requirements change (e.g., upgrading from normal to core, or downgrading from core to normal), the `security_level` field in the `tenant_config` table can be modified directly. This change will not trigger any modifications to the `data_dictionary` table, and the sensitivity level of the data itself will not automatically increase or decrease due to the tenant upgrade. When a type of data is reclassified due to regulatory updates or business needs, the `sensitivity_level` field in the `data_dictionary` table can be modified directly. This change will not trigger any modifications to the `tenant_config` table, and the tenant's security level will not automatically adjust due to the data reclassification.

[0062] S102, using security level and sensitivity level as target union keys, obtain the isolation granularity that matches the target union key in the preset mapping matrix.

[0063] The preset mapping matrix refers to a two-dimensional lookup table structure that is pre-configured and loaded into the computer device's memory. It stores the mapping relationship between different composite keys and their corresponding isolation granularities. For example, the row dimension of the preset mapping matrix can correspond to the enumeration value set of security levels, the column dimension can correspond to the enumeration value set of sensitivity levels, and the intersection of the row and column can be the corresponding isolation granularity.

[0064] A target composite key is a binary index composed of the security level value and the sensitivity level value carried or parsed from the current access request.

[0065] Isolation granularity refers to the degree of physical or logical separation of data isolation, which can include row-level isolation, table-level isolation, and database-level isolation, each corresponding to different levels of resource exclusivity and security strength.

[0066] Specifically, the degree of physical or logical separation corresponding to the isolation granularity is determined in the following way: Row-level isolation: Data from multiple tenants is stored in the same table and logically distinguished by a tenant identifier field. The data rows are not separated in physical storage, which is logical isolation. This method has the lowest resource exclusivity and the lowest security strength.

[0067] Table-level isolation: Each tenant's data is stored in its own independent data table. The data tables of different tenants are physically independent of each other, but share the same database instance. This is a combination of physical and logical isolation, with moderate resource exclusivity and moderate security.

[0068] Database-level isolation: Each tenant's data is stored in an independent database instance corresponding to that tenant. Computing resources, storage space, and network configuration are completely independent, which is physically isolated. It offers the highest level of resource exclusivity and security.

[0069] Therefore, the degree of physical or logical separation is determined by the physical location of data storage, the degree of resource sharing, and the access control method. The granularity of isolation increases sequentially from row-level to table-level and then to database-level, with increasing physical separation, higher resource exclusivity, and greater security strength.

[0070] One possible approach is to store the predefined mapping matrix as a two-dimensional array in the computer device's memory. Specifically, the row indices of the two-dimensional array can correspond to security levels (e.g., normal, high, core), the column indices can correspond to sensitivity levels (e.g., public, normal, sensitive, confidential), and the array elements represent isolation granularities. During union mapping, the security and sensitivity levels are mapped to the predefined mapping matrix, and the matching isolation granularity at the corresponding location in the predefined mapping matrix is ​​read through a single memory addressing operation.

[0071] Another feasible approach is to store the pre-defined mapping matrix in the form of a hash table. Specifically, the computer device can concatenate the security level and sensitivity level identifiers into a union key string using a specific delimiter, perform a hash operation on this union key string, and store it in the hash table. When performing union mapping, the target union key strings for the security level and sensitivity level are similarly constructed and their hash values ​​are calculated. The corresponding isolation granularity is then retrieved from the hash table based on this hash value. This method does not rely on the continuity of the level enumeration values ​​(i.e., the security level enumeration values ​​and the sensitivity level enumeration values), flexibly supporting non-contiguous level definitions or sparse matrix scenarios. Furthermore, the hash table structure supports dynamic addition, deletion, and modification operations, facilitating real-time updates of mapping rules via configuration center push during runtime.

[0072] As a specific implementation method, the computer device has a built-in rule engine that establishes a Cartesian product mapping matrix (i.e., mapping matrix) between tenant security level and data sensitivity level, and maps it to the isolation granularity. This Cartesian product mapping matrix can be dynamically configured, as shown in Table 3.

[0073] Table 3 Cartesian product mapping matrix

[0074] The determination of isolation granularity follows a comprehensive trade-off principle that prioritizes security while also considering efficiency. Specifically, computer equipment can be comprehensively evaluated from the following three dimensions: (1) Security dimension, i.e. the potential harm of data leakage. Sensitivity levels reflect the potential harm caused by a data breach. The higher the sensitivity level, the greater the harm from the data breach, and the stronger the isolation measures required.

[0075] Security levels reflect a tenant's compliance requirements and level of trust. The lower the security level, the lower the tenant's credibility, and the more robust the isolation measures needed to compensate for the lack of trust.

[0076] (2) Cost dimension, namely the implementation and maintenance costs of the isolation solution. The costs of the three isolation granularities differ significantly. Row-level isolation has low implementation costs (requiring only SQL rewriting), low maintenance costs, and excellent scalability. Table-level isolation has moderate implementation costs (requiring the creation of independent tables), moderate maintenance costs, and good scalability. Database-level isolation has high implementation costs (requiring independent instances), high maintenance costs, and poor scalability.

[0077] It is important to note that the scalability metrics in the aforementioned cost dimension refer to situations where the number of tenants grows rapidly (e.g., from hundreds to tens of thousands). Row-level isolation incurs almost no additional storage cost, table-level isolation requires managing a large number of table structures but remains within the database's capacity, while database-level isolation requires continuous requests for new computing / storage resources, with its marginal cost increasing exponentially. Therefore, excluding database-level isolation in scenarios where security risks are controllable (e.g., high-level tenants and sensitive data) is a necessary technical constraint to ensure the long-term scalability of computer equipment.

[0078] (3) Performance dimension, namely the impact of isolation schemes on the performance of computer equipment. When the isolation granularity is row-level isolation, tenant filtering conditions need to be added during querying, which may affect query performance, but the resource utilization is the highest.

[0079] When the isolation granularity is table-level isolation, there is no need for row-level filtering, and the query performance is good, but multiple tables need to be managed.

[0080] When the isolation granularity is library-level isolation, the performance isolation is the most thorough, but the resource utilization is the lowest.

[0081] Based on a comprehensive consideration of the above three dimensions, under the following exemplary configuration, the isolation granularity can follow the following decision boundary conditions: When the data sensitivity level is "public," row-level isolation is applied regardless of the security level. The decision logic is as follows: if the data itself is not sensitive, excessive isolation is not necessary regardless of the tenant's level; row-level isolation can avoid wasting resources when high-level tenants access low-sensitivity data.

[0082] When the data sensitivity level is "sensitive" and the security level is "normal", table-level isolation is applied. The decision logic is: the data has a certain degree of sensitivity, and the tenant's security level is low (insufficient trust), so table-level physical isolation is needed to bridge the trust gap.

[0083] When the data sensitivity level is "Sensitive" and the security level is "High", table-level isolation is applied. The decision logic is: the data has a certain degree of sensitivity, but the tenant's trustworthiness is high, and table-level isolation is sufficient to ensure security, so there is no need to upgrade to the more costly database-level isolation.

[0084] When the data sensitivity level is "Confidential" and the security level is "Normal," table-level isolation is applied. The decision logic is: the data is highly sensitive, but considering the actual access scenarios of ordinary tenants, table-level isolation can meet basic security requirements.

[0085] When the data sensitivity level is "Confidential" and the security level is "High" or "Core", database-level isolation is applied. The determination logic is: the data is highly sensitive, and core tenants have the highest requirements for data security, requiring database-level physical isolation protection.

[0086] Taking the case where the security level is "high" and the data sensitivity level is "sensitive" to match "table-level isolation" as an example, the determination logic is as follows: The first step is to exclude row-level isolation. The data sensitivity level is "sensitive," meaning that a data breach could have significant negative impacts. Row-level isolation relies solely on SQL-level tenant ID filtering, which carries the risk of SQL injection, missing filter conditions in queries, or underlying vulnerabilities leading to unauthorized data access. For "sensitive" data, row-level isolation is insufficiently secure and is therefore excluded.

[0087] The second step is to exclude database-level isolation. A security level of "Advanced" rather than "Core" indicates that while the tenant has certain security requirements, they haven't reached the highest level. Database-level isolation requires allocating a separate database instance for each tenant, resulting in extremely high implementation and maintenance costs, with marginal costs increasing exponentially in large-scale multi-tenant scenarios. For scenarios where "Advanced" tenants access "sensitive" data, database-level isolation suffers from significant over-isolation—the highest cost is invested, but the security requirements haven't reached a corresponding level, leading to wasted resources.

[0088] The third step is to select table-level isolation. Table-level isolation provides each tenant with an independent data table, achieving data separation between tenants at the physical storage level. Its security strength is significantly higher than row-level isolation. Simultaneously, multiple tenants share the same database instance, making implementation and maintenance costs far lower than database-level isolation. For scenarios where "advanced" tenants access "sensitive" data, table-level isolation achieves the optimal balance between security strength and resource cost, providing sufficient physical isolation to protect sensitive data while avoiding the excessive costs and scalability bottlenecks associated with database-level isolation.

[0089] It is important to emphasize that the aforementioned boundary conditions are not fixed, hard-coded rules. The preset mapping matrix supports administrator customization, allowing computer equipment administrators to adjust the isolation granularity corresponding to any composite key at any time based on changes in actual business scenarios, industry compliance requirements, or security policies. For example, in the financial industry, the isolation threshold can be appropriately increased (e.g., changing "Advanced Sensitivity" from "table-level isolation" to "database-level isolation"); in internal testing environments, the isolation threshold can be appropriately decreased to save resources. This configurability ensures that the preset mapping matrix can flexibly adapt to the actual needs of multi-tenant computer equipment of different industries, sizes, and security policies.

[0090] When a high-security-level tenant accesses low-sensitivity data (such as a core tenant accessing public data), the computer equipment will not force the use of high-strength isolation because of the tenant's high level. Instead, it will use row-level isolation based on the low-sensitivity attributes of the data to avoid wasting resources.

[0091] When a tenant with a low security level accesses highly sensitive data (such as a regular tenant accessing confidential data), the computer equipment will use table-level isolation to ensure data security due to the high sensitivity of the data.

[0092] It should be understood that the above Cartesian product mapping matrix is ​​only an illustrative example. In practical applications, the specific content of the preset mapping matrix can be customized according to business needs and security compliance standards, and can be dynamically adjusted during system operation.

[0093] When an administrator adds, deletes, or modifies level enumeration values ​​in the data dictionary management module or tenant configuration management module through the configuration management interface of a computer device, the change event is captured by the change event listening module, which then triggers the dynamic adjustment process of the preset mapping matrix structure. The preset mapping matrix can be logically viewed as a two-dimensional lookup table, with row dimensions corresponding to the set of enumerated values ​​for security levels and column dimensions corresponding to the set of enumerated values ​​for sensitivity levels. When the enumerated value of any dimension changes, the computer device can adaptively adjust the matrix structure according to the following rules: When a new enumerated value is added (e.g., adding "Top Secret" to the sensitivity level), the computer device can automatically add the corresponding row or column dimension to the preset mapping matrix. All intersections on the newly added dimension are initially in a "pending configuration" state, which is recorded and triggers a configuration reminder from the administrator. When an enumerated value is deleted (e.g., a security level is no longer used), the computer device can mark the corresponding dimension as "obsolete," but retain historical mapping records for audit traceability, without immediately physically deleting the matrix entry. When an enumerated value is modified (e.g., renaming "Normal" to "Standard"), the computer device only updates the display name of the dimension; all mapping relationships corresponding to that dimension in the preset mapping matrix remain unchanged.

[0094] When a new dimension is added, the computer device automatically derives the default mapping relationship based on the relative position of the new level in the hierarchy. For example, if a "Top Secret" level is added (higher than the existing "Confidential"), the computer device automatically inherits the mapping rules of "Top Secret" from those of "Confidential." Based on this, combinations that originally matched "table-level isolation" are upgraded to "database-level isolation," while combinations that originally matched "database-level isolation" remain at "database-level isolation." This design follows the fundamental principle of applying the highest and strictest level of data security classification.

[0095] After the computer devices generate default mapping relationships, all newly added or changed mapping entries are highlighted in the management interface for security administrators to review and fine-tune. Newly added mapping rules only take effect after administrator confirmation.

[0096] To ensure the controllability and security of the dynamic expansion process, the computer equipment can generate a new version number for each modification to the preset mapping matrix (including dimensional expansion and rule adjustments), while the old version is fully retained. New or modified mapping rules support gradual rollout, meaning the computer equipment can first enable new rules for some tenants or some data resources, observe the operational effects, and then release them to the entire system. If a new rule causes an anomaly, the administrator can quickly restore the mapping matrix to any historical version through version rollback.

[0097] Taking the addition of a "Top Secret" level to the sensitivity level as an example, the dynamic expansion process of the preset mapping matrix includes: Step 1: The administrator adds a "Top Secret" enumeration value in the data dictionary management module, and the computer device detects the change in the set of sensitivity level enumeration values. Step 2: The computer device automatically adds a "Top Secret" column to the preset mapping matrix, expanding the matrix column dimension from four columns to five columns. Step 3: The computer device fills the default mapping according to the inheritance rules: "Normal" plus "Top Secret" is mapped to "Table-level Isolation"; "Advanced" plus "Top Secret" is mapped to "Library-level Isolation"; "Core" plus "Top Secret" is mapped to "Library-level Isolation". This mapping rule is inherited from the mapping rule of the "Confidential" column and appropriately adjusted upwards. Step 4: The administrator reviews and fine-tunes the default mapping through the management interface, for example, changing "Normal" plus "Top Secret" from "Table-level Isolation" to "Library-level Isolation". Step 5: After the administrator confirms, the new matrix version takes effect, the change event listening module captures the change, and triggers policy re-matching for affected tenants.

[0098] Through the three-layer dynamic expansion mechanism of dimensional expansion, rule filling and version management, the preset mapping matrix can achieve smooth and controllable dynamic expansion when the level enumeration value changes, ensuring that the preset mapping matrix continues to adapt as business development and compliance requirements evolve.

[0099] S103. Based on the target tenant's access behavior data, determine the risk level of the target tenant.

[0100] Among them, access behavior data refers to a set of quantitative indicators that reflect the access characteristics of target tenants to system resources within a specific time window.

[0101] Risk level refers to the threat level classification derived from a comprehensive assessment of access behavior data, used to characterize the security and trustworthiness of the current access request.

[0102] Computer devices acquire access behavior data of target tenants within a specific time window. As shown in Table 4, this access behavior data includes, but is not limited to, at least one behavioral factor such as access frequency, number of abnormal accesses, number of unauthorized access attempts, access time deviation, and data access concentration. Among these factors, access frequency includes short-term access frequency and long-term access frequency.

[0103] For short-term access frequency, computer equipment can count the total number of access requests from the target tenant within the first target time period (e.g., the last five minutes) using real-time counting. For long-term access frequency, computer equipment can count the total number of access requests from the target tenant within the second target time period (e.g., the last 24 hours) using a sliding window method. For abnormal access frequency, computer equipment can count the number of abnormal behaviors triggered by the target tenant (e.g., SQL injection attempts and unauthorized access) within the third target time period (e.g., the last hour) using security event logs. For unauthorized access attempts, computer equipment can count the number of times the target tenant attempted to access unauthorized data within the fourth target time period (e.g., the last hour) using permission verification logs. For access time deviation, computer equipment can calculate the degree of deviation between the current access time and the target tenant's historical access time patterns using time series analysis. For data access concentration, computer equipment can aggregate and analyze access logs to determine whether the data resources accessed by the target tenant are concentrated in a certain type of sensitive data. After collecting the above behavioral factors, the computer equipment summarizes the target tenant's access behavior data, providing multi-dimensional data support for subsequent risk level determination.

[0104] Table 4 Access Behavior Data

[0105] After obtaining access behavior data, the computer equipment determines the risk level of the target tenant based on the access behavior data.

[0106] One approach is for computer devices to use rule-based pattern matching to determine the risk level of a target tenant. Specifically, computer devices can define a set of conditional rules, and directly determine the risk level when access behavior data meets the conditional rules. For example, conditional rules such as "if the number of unauthorized attempts is greater than or equal to three within an hour, it is directly determined as high risk" or "if sensitive data is accessed three times consecutively during non-working hours, it is determined as medium risk" can be set.

[0107] Another approach is for the computer to map the data values ​​of each behavioral factor of the target tenant to a score value; based on each score value, a comprehensive risk score is obtained; and based on the comprehensive risk score, the risk level of the target tenant is determined.

[0108] The score is a normalized result obtained by mapping the original values ​​of each behavioral factor to a unified quantification range (e.g., 0 to 100). Since the original values ​​of different behavioral factors have different dimensions and value ranges (e.g., access frequency may be at the level of "times / minute", while the number of abnormal accesses may be at the level of "times / hour"), they cannot be directly compared or weighted. Therefore, it is necessary to convert the original value of each behavioral factor into a score under the same scale according to a preset mapping rule.

[0109] The comprehensive risk score is a numerical value obtained by weighting and summing the scores of each behavioral factor according to a preset weighting coefficient.

[0110] Different behavioral factors reflect overall risk to varying degrees, therefore it is necessary to assign appropriate weight coefficients to each behavioral factor.

[0111] In one embodiment, the specific configuration of the weighting coefficients is as follows: First, collect access behavior data and corresponding risk result labels for the target tenant within historical time periods. Risk result labels include whether a security incident occurred and whether it was judged as high-risk. Then, use statistical analysis methods to calculate the correlation between each behavioral factor and the risk result. Statistical analysis methods include Pearson correlation coefficient analysis, logistic regression coefficient analysis, or random forest feature importance analysis. Finally, normalize the correlation between each behavioral factor so that the sum of the weights of all behavioral factors is 1, thus obtaining the weighting coefficient for each behavioral factor. For example, statistical analysis of historical data reveals that the correlation between abnormal access frequency and risk result is highest, followed by unauthorized access attempts, then short-term access frequency, and lowest access time deviation. After normalization, the weights are: abnormal access frequency 0.35, unauthorized access attempts 0.30, short-term access frequency 0.20, and access time deviation 0.15. Optionally, an expert scoring method can also be used, where multiple security experts independently score the importance of each behavioral factor, remove extreme values, take the average, and normalize to obtain the weighting coefficient for each behavioral factor. The weighting coefficients can be recalculated and updated periodically based on the latest historical data.

[0112] Based on this, the computer equipment maps the original values ​​of each behavioral factor to normalized score values, and then performs a weighted summation of the score values ​​of each behavioral factor to obtain a comprehensive risk score. After calculating the comprehensive risk score, it is then mapped to discrete risk levels, such as normal, low risk, medium risk, and high risk.

[0113] In a specific example, the weight of abnormal access frequency is set to 0.35, the weight of unauthorized access attempts is set to 0.30, the weight of short-term access frequency is set to 0.20, and the weight of access time deviation is set to 0.15. Each factor's score is mapped to a range of 0-100 based on its numerical value; for example, 0 abnormal accesses result in a score of 0, 1-2 abnormal accesses in a score of 20, 3-5 abnormal accesses in a score of 50, and 6 or more abnormal accesses in a score of 80. After calculating the comprehensive risk score, it is then mapped to discrete risk levels: 0-15 is considered normal, 16-40 is considered low risk, 41-70 is considered medium risk, and 71-100 is considered high risk. This method, through multi-factor weighted fusion, can comprehensively reflect the tenant's overall security posture and avoid misjudgments caused by fluctuations in a single indicator.

[0114] Regardless of the method used, computer equipment can determine the risk level of a target tenant based on access behavior data, thereby providing a basis for decision-making for the dynamic adjustment of subsequent isolation granularity.

[0115] S104, adjust the matching isolation granularity according to the risk level to obtain the adjusted isolation granularity.

[0116] The adjusted isolation granularity refers to the isolation granularity that is dynamically corrected based on the real-time risk status, on the basis of the original isolation granularity obtained through static two-dimensional joint mapping. This adjusted isolation granularity only applies to the request processing flow in the current or specific time period and does not change the basic configuration values ​​in the preset mapping matrix.

[0117] One implementation involves determining the risk level of the target tenant, then using a computer device to obtain the risk score corresponding to that risk level. This risk score is then input into a pre-defined adjustment function to calculate the target isolation strength value. Specifically, the computer device pre-arranges the isolation granularities in the isolation granularity sequence according to their isolation strength from low to high, and assigns a corresponding strength level value to each granularity (e.g., row-level isolation corresponds to strength level value 1, table-level isolation to strength level value 2, and database-level isolation to strength level value 3). Simultaneously, the computer device pre-sets an adjustment function that maps the risk score to the isolation strength level value. This adjustment function is a monotonically increasing function; the higher the risk score, the greater the calculated target isolation strength value. After calculating the target isolation strength value, the computer device uses the matched isolation granularity as a benchmark and compares the strength level value of the benchmark isolation granularity with the target isolation strength value. If the target isolation strength value is greater than the strength level value of the benchmark isolation granularity, the isolation granularity is adjusted upwards to the isolation granularity corresponding to the target isolation strength value, and the adjusted result is used as the adjusted isolation granularity. If the target isolation strength value is less than or equal to the strength level value of the benchmark isolation granularity, the matched isolation granularity remains unchanged, that is, the matched isolation granularity is directly used as the adjusted isolation granularity. After the computer device completes the above comparison and adjustment, it obtains the adjusted isolation granularity.

[0118] Another approach is to use the matched isolation granularity directly as the adjusted isolation granularity when the risk level is normal; and to adjust the matched isolation granularity according to the direction of increasing isolation strength when the risk level is the target risk level, thus obtaining the adjusted isolation granularity.

[0119] Isolation strength refers to the degree of data protection capability measured by different isolation granularities. In this embodiment, the isolation strength of row-level isolation, table-level isolation, and database-level isolation increases sequentially. The level of isolation strength determines the thoroughness of data isolation and the level of resource consumption.

[0120] The adjusted isolation granularity will not exceed the highest isolation strength granularity. The highest isolation strength granularity refers to the upper limit of isolation strength supported by the system. In this embodiment, library-level isolation is the highest isolation strength granularity. When the adjusted isolation granularity reaches this level, it will not be adjusted upwards further even if the risk level increases further.

[0121] The direction of isolation strength enhancement refers to the direction of change when adjusting the isolation granularity, that is, adjusting from the isolation granularity with lower isolation strength to the isolation granularity with higher isolation strength (for example, adjusting from row-level isolation to table-level isolation, or from table-level isolation to database-level isolation). This direction of isolation strength enhancement is unidirectional, adjusting only upwards and not downwards, to ensure that the isolation strength only increases and does not decrease when the risk increases, thus not reducing the level of data security protection.

[0122] The target risk level refers to any level of risk other than normal (such as low risk, medium risk, high risk, etc.) among the multiple values ​​of risk level.

[0123] After determining the risk level of the target tenant, the computer equipment adjusts the matching isolation granularity according to the risk level and the direction of increasing isolation strength, resulting in the adjusted isolation granularity. For example, when the risk level is normal, the matching isolation granularity remains unchanged; when the risk level is low, the isolation granularity is increased by one level (e.g., from row level to table level, from table level to database level; note that if the original isolation granularity was database level, it remains unchanged); when the risk level is medium, the isolation granularity is increased by two levels (e.g., from row level to database level); when the risk level is high, it is forcibly increased to the highest level of database-level isolation, and security alarms can be triggered simultaneously. The adjustment direction of isolation granularity is limited to increasing isolation strength (i.e., the isolation granularity is only adjusted upwards), with a maximum cap of database-level isolation, and the isolation strength is not reduced downwards, ensuring that the adjusted isolation granularity is not lower than the original isolation granularity. Furthermore, this dynamic adjustment has a timely recovery mechanism. Specifically, when the computer equipment detects that the risk level of the target tenant has fallen back to the normal or low-risk range, and this stable low-risk state continues for a preset observation period, the computer equipment automatically cancels the previous temporary upgrade instruction and restores the isolation granularity to the original isolation granularity obtained by matching the preset mapping matrix. Thus, the computer equipment can perform upward adjustment or restoration operations on the isolation granularity according to the risk level to obtain the adjusted isolation granularity. It is important to note that dynamic adjustment only applies to fine-tuning of the isolation granularity at the execution level; it does not change the stored values ​​of the tenant's security level and data sensitivity level, and does not disrupt the core architecture with its dual independent dimensions.

[0124] S105, Determine the data isolation strategy for the target data resources based on the adjusted isolation granularity.

[0125] Among them, data isolation strategy refers to a set of rules or parameter configurations used to guide how to implement isolation protection for target data resources, which determines the specific form and intensity of subsequent isolation operations.

[0126] Different isolation granularities correspond to different data isolation strategies. Computer equipment can determine the data isolation strategy corresponding to the adjusted isolation granularity as the data isolation strategy for the target data resource. This data isolation strategy can adaptively adjust to real-time changes in tenant behavior, while ensuring that it can automatically revert to the original strategy after the risk is eliminated, avoiding long-term resource consumption caused by temporary adjustments.

[0127] By introducing a tenant behavior-based isolation granularity adjustment process, the system can automatically increase isolation strength when a tenant exhibits abnormal behavior, compensating for the inability of static strategies to detect runtime risks. Once the abnormal behavior subsides and stabilizes for a period, the system can automatically revert to the original isolation granularity, preventing tenants from being in an over-isolated state for extended periods due to temporary risks, thus avoiding unnecessary resource consumption. The entire dynamic adjustment process only affects the isolation granularity at the execution level, without modifying tenant security levels, data sensitivity levels, or mapping relationships in the preset mapping matrix. This preserves the flexibility and low maintenance costs brought by dimensional decoupling while improving the system's adaptability to sudden security risks.

[0128] S106, Perform the corresponding isolation operation on the target data resource according to the data isolation policy.

[0129] Isolation operations refer to specific technical means indicated by the data isolation strategy, such as the actual intervention in the access path, storage structure, or query logic of the target data resource. The purpose is to achieve the separation and protection of data between tenants at the physical or logical level.

[0130] One possible approach is to use a database proxy, API gateway, or middleware component in a computer device as a unified entry point. When a target tenant requests access to a target data resource, the unified entry point first intercepts the access request, parses the request to determine the data isolation policy, and then automatically rewrites the query statement, switches the data source, or routes it to a specific storage node according to the data isolation policy before forwarding the access request to the underlying storage. This transforms the data isolation policy into specific underlying storage access control actions.

[0131] Another approach is to perform isolation operations at the application layer using a Software Development Kit (SDK). Specifically, the business application integrates a dedicated data isolation SDK. This SDK intercepts data access calls within the application and, based on the defined data isolation policy, constructs filtered query objects or selects the corresponding database connection, thereby translating the data isolation policy into application-layer executable access control actions. This approach is more tightly integrated with the application context, enabling more precise isolation control using session information or transaction states within the application, and reducing additional network hop overhead.

[0132] The above embodiments, in response to a target tenant's access request for target data resources, obtain the target tenant's security level and the target data resource's sensitivity level. This ensures that the input information for access decisions simultaneously encompasses two dimensions: the access subject attribute (tenant security level) and the access object attribute (data sensitivity level), providing a more comprehensive data foundation for subsequent accurate matching. Based on this, using the security level and sensitivity level as the target joint key, the isolation granularity matching the target joint key is obtained from a preset mapping matrix. By treating the security level and sensitivity level as independent variables for joint determination, each combination of security level and sensitivity level corresponds to a unique and differentiated isolation granularity. For example, when the target tenant's security level is high and the target data resource's sensitivity level is low, the joint mapping will match a relatively lenient isolation granularity, preventing waste of computing and storage resources due to excessive isolation in this access scenario. Conversely, when the target tenant's security level is low and the target data resource's sensitivity level is high, the joint mapping will match a relatively strict isolation granularity. This approach avoids security risks caused by insufficient isolation in this access scenario, overcoming the limitation of a single data dimension in distinguishing complex access scenarios (such as the differentiated needs of different tenants accessing data of the same sensitivity). It significantly improves the accuracy of the adaptation between isolation granularity and complex access scenarios. Based on this, the risk level of the target tenant is further determined based on their access behavior data, and the matching isolation granularity is adjusted according to the risk level. This allows the isolation granularity to dynamically adjust with changes in tenant behavior risk, providing a data foundation for the dynamic adaptation of subsequent data isolation strategies in the spatiotemporal dimensions. Furthermore, the data isolation strategy for the target data resource is determined based on the adjusted isolation granularity, and corresponding isolation operations are performed on the target data resource according to the data isolation strategy. This transforms the adjusted isolation granularity into actual isolation execution actions, ensuring that the final isolation operation accurately matches the inherent attributes of the access scenario (the combination of security and sensitivity levels) and dynamically adapts to the real-time behavioral risks of the tenant. This achieves a technical effect that balances data security protection and resource utilization efficiency.

[0133] Based on the above embodiments, in an exemplary embodiment, the isolation granularity includes row-level isolation, table-level isolation, and database-level isolation. Therefore, step S105 specifically includes: when the adjusted isolation granularity is row-level isolation, determining a first data isolation strategy for the target data resource; when the adjusted isolation granularity is table-level isolation, determining a second data isolation strategy for the target data resource; and when the adjusted isolation granularity is database-level isolation, determining a third data isolation strategy for the target data resource.

[0134] The first data isolation strategy refers to the set of specific logical isolation rules adopted when the isolation granularity is determined to be at the row level. Its core feature is to achieve data separation by modifying the query logic rather than the physical storage structure. The first data isolation strategy includes: adding the tenant identifier of the target tenant to the data query statement corresponding to the target data resource to generate filtering conditions.

[0135] A tenant identifier is a string or numeric primary key used to uniquely distinguish different tenants in a multi-tenant environment, such as a tenant ID. This tenant identifier can be passed as an implicit context parameter in the request chain.

[0136] Filtering conditions are used to ensure that the query results for a target data resource include only the data rows corresponding to the target tenant. A filtering condition is a predicate expression in the query statement used to limit the scope of data retrieval. In this embodiment, it specifically refers to a conditional clause containing tenant identifier matching logic, which forces the database engine to return only data records belonging to the currently accessing subject.

[0137] The second data isolation strategy refers to the set of specific physical isolation rules adopted when the isolation granularity is determined to be at the table level. Its core feature is to achieve physical separation of data from different tenants through independent storage spaces or namespaces. The second data isolation strategy includes: routing access requests to the independent data table corresponding to the target tenant, so as to perform data access operations on the target data resources through the independent data table.

[0138] An independent data table refers to a data table object that belongs exclusively to a specific target tenant at the database namespace or physical storage level. This independent data table is independent of the data tables of other tenants in terms of storage structure. Even if multiple tenants access the same type of business data (such as order data), the underlying table entities they actually operate on are different.

[0139] The third data isolation strategy refers to the set of the strongest physical isolation rules adopted when the isolation granularity is determined to be at the database level. Its core feature is to achieve physical separation of data from different tenants through completely independent database service units. The third data isolation strategy includes: routing access requests to the independent database instance corresponding to the target tenant, so that data access operations on the target data resources can be performed through the independent database instance.

[0140] An independent database instance refers to a complete database service environment exclusively for a target tenant. This database service environment has independent computing resources, storage space, and network configuration at the physical or virtualization level. It is completely decoupled from other tenants' database instances in terms of resource scheduling and data access paths. Even if multiple tenants belong to the same business type, their underlying database processes, file systems, and buffer pools are not shared.

[0141] When the adjusted isolation granularity is row-level isolation, the computer device, according to the first data isolation strategy, obtains the tenant identifier of the target tenant from the original query statement corresponding to the target data resource, and appends the tenant identifier as a filtering condition to the filtering conditions of the original query statement. One possible approach is for the computer device to perform condition injection based on SQL abstract syntax tree parsing after receiving the original query statement. Specifically, the computer device first uses an SQL parser to convert the query statement into a structured abstract syntax tree object; then it traverses the abstract syntax tree to locate the WHERE clause node or query body node; next, it constructs a condition node representing "tenant identifier equals the target tenant's tenant identifier," and attaches the condition node to the original condition tree of the abstract syntax tree using a logical AND operator; finally, it re-serializes the modified abstract syntax tree into an executable SQL statement containing the filtering conditions. Thus, the above process achieves the addition of the target tenant's tenant identifier to the query statement to generate filtering conditions.

[0142] Another possible approach is for the computer device to obtain a predefined query template, using placeholders to mark the insertion positions of isolation conditions. When executing the query, the computer device retrieves the target tenant's tenant identifier based on the current request context, formats the tenant identifier into a filter condition string, and replaces the placeholders in the query template with this filter condition string, generating the final SQL statement containing the filter conditions. Thus, the process described above allows for the addition of the target tenant's tenant identifier to the query statement to generate filter conditions.

[0143] The database filters the target data resources based on the filtering conditions, and the final query results only contain the data rows corresponding to the target tenant. This process is completely transparent to the upper-layer business code. The original query statement issued by the business layer does not need to be aware of the existence of the tenant identifier. The computer device automatically injects the filtering conditions before the query statement reaches the database.

[0144] When the adjusted isolation granularity is table-level isolation, the database access layer searches for the corresponding independent data table name from the pre-established mapping relationship between tenants and independent data tables based on the tenant identifier of the target tenant. After finding the corresponding independent data table name, the table name that originally pointed to the shared data table in the access request is replaced with the name of the independent data table, so that the access request is routed to the independent data table corresponding to the target tenant. Subsequently, data access operations are performed on the target data resource through the independent data table, thus completing the implementation of table-level isolation.

[0145] When the adjusted isolation granularity is database-level isolation, the data access layer, based on the target tenant's tenant identifier, searches for the connection information of the corresponding independent database instance from the pre-configured mapping between tenants and independent database instances. Once the connection information is found, the database connection bound to the current data access operation is switched to that independent database instance, routing the access request to the target tenant's corresponding independent database instance. Subsequent data access operations are executed within this independent database instance, thus achieving physical isolation of data between tenants at the database instance level; data from other tenants is completely invisible. The entire switching process is automatically completed by the data access layer according to the isolation strategy. Upper-layer business code does not need to be aware of changes in the database instance, nor does it need to write differentiated data access logic for different tenants.

[0146] In the above embodiments, different tenants use different data isolation strategies, resulting in different isolation operations. When the adjusted isolation granularity is row-level isolation, isolation is achieved simply by adding filtering conditions to data queries, without involving the addition or migration of storage resources. This avoids wasting computing and storage resources due to excessive isolation in resource-sensitive scenarios. When the adjusted isolation granularity is database-level isolation, access is switched to an independent database instance, physically blocking cross-tenant data access paths. This avoids security risks caused by insufficient isolation in scenarios with high data protection requirements. Thus, by executing isolation operations that strictly correspond to the matching results, the scenario adaptation accuracy achieved by the two-dimensional joint mapping is transmitted to the actual resource scheduling and access control level. Overall, this achieves accurate adaptation between the isolation strategy and the current access scenario. For example, row-level isolation can be matched for scenarios where high-security-level tenants access low-sensitivity data, avoiding excessive allocation of storage resources due to high tenant levels. Table-level isolation can be matched for scenarios where low-security-level tenants access high-sensitivity data, compensating for insufficient security protection that may be caused by low tenant levels. Therefore, this embodiment effectively balances data security protection needs with resource utilization efficiency.

[0147] Based on the above embodiments, in an exemplary embodiment, such as Figure 2 As shown, this data isolation method also includes: S201, Obtain the attribute change trend data of the target object within the target time period.

[0148] The target objects are the target tenants and / or the target data resources.

[0149] Attribute change trend data refers to time series data or feature vector sets that reflect the evolution of the state of a target object over a historical period.

[0150] When acquiring attribute change trend data for a target object within a target time period, computer devices can collect different attribute data for different types of objects. Specifically, when the target object is a tenant, the computer device retrieves the tenant's attribute change trend data within a specified time period from the tenant's historical records, including but not limited to historical security event records, compliance audit results, business scale change trends, and evolution of access behavior patterns. When the target object is a data resource, the computer device retrieves the data resource's attribute change trend data within a specified time period from the data history, including but not limited to changes in data access frequency, changes in business requirements regarding data content sensitivity, and updates to regulations and policies. If the target object includes both tenants and data resources, both types of data are collected separately. After collection, the computer device organizes the data according to a unified time series format to obtain the target object's attribute change trend data within the target time period, providing input for subsequent predictions.

[0151] S202, perform time-series smoothing on the attribute change trend data within the future time window to obtain a smooth curve within the future time window, and compare the smooth curve with the change threshold to obtain the probability of the target object's level changing within the future time window.

[0152] The levels include security level and / or sensitivity level.

[0153] A future time window refers to a pre-defined forward-looking time frame used to assess the likelihood of a change in the rating, such as the next 30 days or the next quarter.

[0154] Time series smoothing is a method for processing time series data to eliminate random fluctuations and short-term noise, making the overall trend of the data clearer and more stable. Smoothing methods such as moving averages and exponential smoothing can be used for time series smoothing.

[0155] A smoothed curve is a trend line obtained after time-series smoothing. Compared with the original data, the smoothed curve retains the overall direction of data change over time while eliminating abnormal fluctuations caused by occasional events or random factors, making the trend of data change more intuitive and identifiable.

[0156] A change threshold is a pre-defined judgment threshold used to determine whether changes in the attributes of a target object have reached or exceeded the triggering conditions for a grade change. This change threshold can be determined based on historical experience data or business rules. When the value of the smoothing curve approaches or exceeds this change threshold, it indicates that the grade of the target object may be about to change.

[0157] Change probability refers to the likelihood that the grade of a target object will change within a future time window, and can be expressed as a percentage. This change probability can be calculated based on the relative relationship between the trend of a smooth curve and the change threshold. The closer the smooth curve is to, or the more likely it is to exceed, the change threshold, the higher the change probability.

[0158] Computer equipment performs time-series smoothing on attribute change trend data within a future time window to obtain a smoothed curve within the future time window. The smoothed curve is then compared with the change threshold to obtain the probability of the target object's level changing within the future time window.

[0159] One specific implementation involves a computer device acquiring the original time series of attribute change trend data over a historical period. This data is then processed using exponential smoothing, for example, assigning higher weights to recent data and lower weights to older data. This preserves sensitivity to recent changes while filtering out random noise from historical data. The computer device connects the smoothed data points chronologically to form a smooth curve reflecting the overall evolution direction of the attribute. The device extends this smooth curve forward along the time axis to a future time window, obtaining the predicted value at the end of the future time window. Simultaneously, the device reads a pre-configured change threshold, calculates the difference between the predicted value and the threshold, and maps the difference to a change probability value. When the predicted value is significantly lower than the threshold, the change probability approaches 0; when the predicted value is close to or reaches the threshold, the change probability approaches 100%. After completing these calculations, the computer device obtains the change probability of the target object's level within the future time window.

[0160] As an alternative implementation, the computer device can also input attribute change trend data into the prediction model to predict the probability of a target object's grade changing within a future time window.

[0161] Among them, the predictive model refers to a mathematical model built based on machine learning algorithms, which is used to learn the evolutionary patterns from historical data and infer future states.

[0162] Attribute change trend data is input into a predictive model to predict the probability of a target object's rating changing within a future time window. The predictive model can be a time-series predictive model (such as LSTM (Long Short-Term Memory) or a prophetic time-series predictive model), which can output the probability value of a target object's rating changing within a specified future time window based on historical attribute change trend data; alternatively, a classification model (such as random forest or XGBoost (eXtreme Gradient Boosting)) can be used to predict whether a tenant's security level or data sensitivity level needs to be upgraded / downgraded.

[0163] Taking a time-series prediction model as an example, the training process of this prediction model includes: The computer extracts time-stamped attribute change trend data from a historical database as training samples, and simultaneously obtains corresponding historical grade change records as labels; the training samples are input into the prediction model to be trained in chronological order; the prediction model predicts the probability of future grade changes based on the input data; the prediction results are compared with actual grade change records to calculate the prediction bias, and the internal parameters of the prediction model are adjusted through backpropagation; after multiple rounds of iterative training, the prediction accuracy of the prediction model on the validation set meets the preset requirements, thus completing the training. After training, the computer inputs the attribute change trend data obtained within the target time period into the trained prediction model; the model calculates and outputs the probability that the grade of the target object will change within a future time window based on the input data.

[0164] S203, when the probability of change exceeds the preset threshold, a level change operation is triggered.

[0165] A level change operation refers to the action of modifying the level field in the first configuration structure or the second configuration structure.

[0166] The preset threshold is a probability judgment benchmark value pre-configured in the computer device, used to determine whether the probability of change has reached the condition for triggering a level change operation.

[0167] The computer device compares the probability of change with a preset threshold. If the probability of change is greater than or equal to the preset threshold, the automatic triggering condition is met. The computer device then generates a security level change instruction and executes the security level change operation. Specifically, when the target object is a tenant, the security level change operation updates the tenant's security level; when the target object is a data resource, the sensitivity level change operation updates the data resource's sensitivity level. If the probability of change does not exceed the preset threshold, the computer device does not execute any security level change operation and continues to maintain the current security level. The entire prediction and triggering process can run periodically in the background of the computer device or be triggered when a security level change event or configuration update event occurs.

[0168] As an optional implementation, the preset threshold can range from 0 to 1 (or 0% to 100%), and its value determines the sensitivity of triggering a level change. The computer device can statistically analyze the historical probability of changes obtained by comparing a smooth curve with a change threshold, and compare this probability with the actual level changes that occur. Multiple samples are extracted from the historical data, each containing the probability of changes obtained by comparing the smooth curve with the change threshold and the corresponding actual change result. The computer device then statistically analyzes the proportion of actual level changes occurring within different probability intervals, and selects the lowest probability value where this proportion reaches an acceptable level (e.g., above 90%) as the preset threshold. For example, if statistics show that when the change probability reaches above 80%, the proportion of actual level changes is consistently above 92%, then the preset threshold can be set to 80%. Exemplarily, the preset threshold can be set to values ​​such as 80%, 85%, or 90%, and the specific value can be manually configured by the administrator based on their risk control preferences according to the business scenario, or dynamically adjusted based on the balance between the cost of false triggering and the cost of missed triggering.

[0169] Through the above methods, this application introduces a prediction-based automatic level update mechanism, which can predict the change trend in advance before the level changes. When the predicted probability exceeds a preset threshold, the level change operation is automatically triggered, realizing the upgrade from passive response to proactive prediction. While reducing the cost of manual operation and maintenance, it improves the system's adaptability to business changes and security situation.

[0170] The following example illustrates the execution process of this data isolation method.

[0171] When a tenant initiates a data access request, the computer device performs the following process: Read tenant security level: Read the security_level field from the tenant configuration table (tenant_config) based on the tenant ID in the request, and get t.

[0172] Reading data sensitivity level: Read the sensitivity_level field from the data dictionary table (data_dictionary) based on the resource_id of the target data resource, and get d.

[0173] Union query mapping matrix: Using (t, d) as the union key, query the predefined Cartesian product mapping matrix to obtain the corresponding isolation granularity I (row level / table level / database level).

[0174] Perform isolation operations: Press I to execute the corresponding isolation method. For row-level isolation, the tenant ID condition is automatically appended to the SQL query statement; for table-level isolation, the route is routed to the tenant's independent table (i.e., independent data table); for database-level isolation, the route is routed to the tenant's independent database instance.

[0175] When a tenant’s security level or data sensitivity level changes, the computer device automatically triggers a policy rematch for the affected tenant or data: when a tenant’s security level changes, the computer device only needs to recalculate the isolation granularity corresponding to all d in the (t, d) combination of that tenant, without having to reassess the sensitivity level of any data.

[0176] When the data sensitivity level changes, the computer equipment only needs to recalculate the isolation granularity corresponding to all t in the (t, d) combination of the data, without reassessing the security level of any tenant. This mechanism ensures that the impact of the change is minimized and the computational overhead is extremely low.

[0177] To more intuitively understand the entire data isolation process, this embodiment configures multiple functional modules within the computer device to implement the data isolation method, as shown in Table 5. Then, it dynamically demonstrates the interaction process between the functional modules through two typical real-world scenarios (normal data access and tenant level change).

[0178] Table 5 Functional Modules

[0179] The above functional modules can be deployed on the same server or in a distributed manner (such as TCM / DDM / REM as the configuration center, ARM as an independent gateway, and SEM embedded in the data access layer).

[0180] Scenario 1: Tenant A is a bank with a security level of "core". They want to query a weather data table with a sensitivity level of "public".

[0181] The interaction process of each functional module is as follows: Figure 3As shown, specifically, when tenant A initiates a data query request, the request first reaches the access interception and routing module. After parsing the request, the access interception and routing module extracts tenant A's tenant identifier and the target data resource identifier (e.g., a weather data table). Subsequently, the access interception and routing module sends a query request to the tenant configuration management module, carrying tenant A's tenant identifier, to obtain the security level corresponding to tenant A. The tenant configuration management module searches the tenant configuration table based on the tenant identifier and returns the security level of tenant A as "core". After receiving the tenant's security level, the access interception and routing module sends a query request to the data dictionary management module, carrying the data resource identifier of the target data resource, to obtain the sensitivity level of that data resource. The data dictionary management module searches the data dictionary table based on the data resource identifier and returns the sensitivity level of that data resource as "public". After obtaining the tenant's security level "core" and sensitivity level "public", the access interception and routing module combines them into a target composite key (core, public) and sends a composite query request to the rule engine module. The rule engine module uses this composite key to search the preset mapping matrix for the corresponding isolation granularity and returns the matching result as "row-level isolation". The access interception and routing module determines the data isolation strategy based on the row-level isolation results. This strategy involves adding a tenant identifier filter condition to the query statement. The module then sends an execution instruction to the storage execution module, which includes the original query statement, the tenant identifier, and the isolation strategy type. Upon receiving the instruction, the storage execution module appends the tenant identifier of tenant A as a filter condition to the original query statement, generating an SQL statement with the tenant filter condition. This statement is then sent to the shared database for execution. After executing the query, the shared database returns the query results, containing only the data rows corresponding to tenant A, to the storage execution module. The storage execution module then returns the result set to the access interception and routing module, which ultimately returns the query results to tenant A.

[0182] Scenario 2: Tenant B was originally a "premium" tenant, but due to business expansion, it needs to be upgraded to "core".

[0183] After the level change, tenant B's access strategy for all data needs to be recalculated (originally, "advanced" and "sensitive data" corresponded to table-level isolation, but now "core" and "sensitive data" have been changed to database-level isolation), but the sensitivity level of the data resources themselves does not change.

[0184] The interaction process of each functional module is as follows: Figure 4As shown, specifically, when tenant B's security level changes from "Advanced" to "Core," the administrator can initiate a level change operation through the management interface to modify tenant B's security level from "Advanced" to "Core." After receiving the change request, the tenant configuration management module updates the security level field corresponding to tenant B in the tenant configuration table, changing the field value from "Advanced" to "Core," and publishes a tenant level change event after the update. This event carries tenant B's tenant identifier and the changed security level (i.e., "Core"). The change event listening module subscribes to and captures this tenant level change event, then sends a request to the data dictionary management module to obtain a list of sensitivity levels for all data resources. The data dictionary management module returns the data resource identifier and its corresponding sensitivity level for each data resource. Upon receiving the returned list, the change event listening module, for each data record in the list, combines tenant B's changed security level with the sensitivity level of the data resource to form a composite key, and sends a query request to the rule engine module. The rule engine module retrieves the new isolation granularity corresponding to this composite key from the preset mapping matrix and returns the matching result. After the change event listening module aggregates the new isolation granularity for all data resources, it pushes the mapping relationship between tenant B and each data resource to the access interception and routing module to update the policy mapping table cached locally. Once the above re-matching process is complete, the change event listening module reports the policy update completion information to the tenant configuration management module. Afterward, when tenant B initiates any data access request again, the access interception and routing module directly uses the updated policy mapping table in its local cache to determine the isolation granularity, eliminating the need for temporary queries to the rule engine module.

[0185] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0186] Corresponding to the data isolation method in the above embodiments, in an exemplary embodiment, such as Figure 5 As shown, a data isolation device is provided. For ease of explanation, only the parts relevant to the embodiments of this application are shown. The data isolation device includes: The acquisition module 501 is used to acquire the security level of the target tenant and the sensitivity level of the target data resource in response to the target tenant's access request for the target data resource; The matching module 502 is used to obtain the isolation granularity that matches the target combination key in a preset mapping matrix, using the security level and sensitivity level as the target combination key; the preset mapping matrix stores the mapping relationship between different combination keys and their corresponding isolation granularities; The risk determination module 503 is used to determine the risk level of a target tenant based on the target tenant's access behavior data; The adjustment module 504 is used to adjust the matched isolation granularity according to the risk level to obtain the adjusted isolation granularity; The strategy determination module 505 is used to determine the data isolation strategy for the target data resources based on the adjusted isolation granularity. The execution module 506 is used to perform corresponding isolation operations on the target data resources according to the data isolation strategy.

[0187] In an optional embodiment, the access behavior data includes at least one behavioral factor among access frequency, number of abnormal accesses, number of unauthorized access attempts, access time deviation, and data access concentration; the risk determination module 503 is specifically used to: map the data values ​​of each behavioral factor of the target tenant to a score value; obtain a comprehensive risk score based on each score value; and determine the risk level of the target tenant based on the comprehensive risk score.

[0188] In an optional embodiment, when the risk level is normal, the adjustment module 504 directly uses the matched isolation granularity as the adjusted isolation granularity; when the risk level is the target risk level, the matching isolation granularity is adjusted according to the direction of increasing isolation strength to obtain the adjusted isolation granularity; the adjusted isolation granularity is not higher than the isolation granularity with the highest strength; the target risk level is any risk level other than normal.

[0189] In an optional embodiment, the strategy determination module 505 is specifically used to: determine a first data isolation strategy for the target data resource when the matching isolation granularity is row-level isolation; the first data isolation strategy includes: adding the tenant identifier of the target tenant to the data query statement corresponding to the target data resource to generate filtering conditions; the filtering conditions are used to ensure that the query results obtained when querying the target data resource only include the data rows corresponding to the target tenant.

[0190] In an optional embodiment, the policy determination module 505 is specifically used to: determine a second data isolation policy for the target data resource when the adjusted isolation granularity is table-level isolation; the second data isolation policy includes: routing the access request to the independent data table corresponding to the target tenant, so as to perform data access operations on the target data resource through the independent data table.

[0191] In an optional embodiment, the strategy determination module 505 is specifically used to: determine a third data isolation strategy for the target data resource when the adjusted isolation granularity is library-level isolation; the third data isolation strategy includes: routing the access request to the independent database instance corresponding to the target tenant, so as to perform data access operations on the target data resource through the independent database instance.

[0192] In an optional embodiment, the security level and the sensitivity level are stored in a first configuration structure and a second configuration structure, respectively; the first configuration structure and the second configuration structure are decoupled and independent of each other, the first configuration structure is used to independently maintain the security level of different tenants, and the second configuration structure is used to independently maintain the sensitivity level of different data resources.

[0193] In an optional embodiment, the data isolation device further includes: a trend data acquisition module, used to acquire attribute change trend data of a target object within a target time period; the target object is a target tenant and / or a target data resource; a prediction module, used to perform time-series smoothing processing on the attribute change trend data within a future time window to obtain a smooth curve in the future time window, and compare the smooth curve with a change threshold to obtain the probability of a change in the target object's level within the future time window; and a change module, used to trigger a level change operation when the change probability exceeds a preset threshold.

[0194] It should be noted that the information interaction and execution process between the modules in the above-mentioned data isolation device are based on the same concept as the method embodiment of this application. For details on their specific functions and technical effects, please refer to the method embodiment section, and they will not be repeated here.

[0195] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 6 As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores data required for a data isolation method. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements a data isolation method.

[0196] Those skilled in the art will understand that Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0197] In one exemplary embodiment, a computer-readable storage medium is provided that stores a computer program, which, when executed by a processor, can implement the steps in the various method embodiments described above.

[0198] In one exemplary embodiment, a computer program product is provided that, when run on a computer device, enables the computer device to perform the steps described in the various method embodiments above.

[0199] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of this application can be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include at least: any entity or device capable of carrying the computer program code to a photographic device / terminal device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium. Examples include USB flash drives, portable hard drives, magnetic disks, or optical disks.

[0200] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0201] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0202] In the embodiments provided in this application, it should be understood that the disclosed apparatus / network devices and methods can be implemented in other ways. For example, the apparatus / network device embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0203] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0204] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A data isolation method, characterized in that, include: In response to a target tenant's access request to a target data resource, the security level of the target tenant and the sensitivity level of the target data resource are obtained; Using the security level and the sensitivity level as target union keys, the isolation granularity matching the target union key is obtained from a preset mapping matrix; the preset mapping matrix stores the mapping relationship between different union keys and their corresponding isolation granularities. Based on the access behavior data of the target tenant, the risk level of the target tenant is determined; The isolation granularity is adjusted according to the risk level to obtain the adjusted isolation granularity; Based on the adjusted isolation granularity, determine the data isolation strategy for the target data resource; Perform corresponding isolation operations on the target data resources according to the data isolation strategy.

2. The data isolation method according to claim 1, characterized in that, The access behavior data includes at least one behavioral factor among access frequency, number of abnormal accesses, number of unauthorized access attempts, access time deviation, and data access concentration; determining the risk level of the target tenant based on the access behavior data includes: Map the data values ​​of each behavioral factor of the target tenant to a score value; Based on the scores mentioned above, a comprehensive risk score is obtained; The risk level of the target tenant is determined based on the comprehensive risk score.

3. The data isolation method according to claim 1, characterized in that, The step of adjusting the matching isolation granularity according to the risk level to obtain the adjusted isolation granularity includes: When the risk level is normal, the matched isolation granularity will be directly used as the adjusted isolation granularity. When the risk level is the target risk level, the matching isolation granularity is adjusted according to the direction of increasing isolation strength to obtain the adjusted isolation granularity; the adjusted isolation granularity is not higher than the isolation granularity with the highest strength; the target risk level is any risk level other than the normal level.

4. The data isolation method according to claim 1, characterized in that, The step of determining the data isolation strategy for the target data resource based on the adjusted isolation granularity includes: When the adjusted isolation granularity is row-level isolation, a first data isolation strategy for the target data resource is determined; the first data isolation strategy includes: adding the tenant identifier of the target tenant to the data query statement corresponding to the target data resource to generate filtering conditions; the filtering conditions are used to ensure that the query results obtained when querying the target data resource only include the data rows corresponding to the target tenant.

5. The data isolation method according to claim 1, characterized in that, The step of determining the data isolation strategy for the target data resource based on the adjusted isolation granularity includes: When the adjusted isolation granularity is table-level isolation, a second data isolation strategy for the target data resource is determined; the second data isolation strategy includes: routing the access request to an independent data table corresponding to the target tenant, so as to perform data access operations on the target data resource through the independent data table.

6. The data isolation method according to claim 1, characterized in that, The step of determining the data isolation strategy for the target data resource based on the adjusted isolation granularity includes: When the adjusted isolation granularity is library-level isolation, a third data isolation strategy for the target data resource is determined; the third data isolation strategy includes: routing the access request to the independent database instance corresponding to the target tenant, so as to perform data access operations on the target data resource through the independent database instance.

7. The data isolation method according to any one of claims 1-6, characterized in that, The security level and the sensitivity level are stored in a first configuration structure and a second configuration structure, respectively. The first configuration structure and the second configuration structure are decoupled and independent of each other. The first configuration structure is used to independently maintain the security level of different tenants, and the second configuration structure is used to independently maintain the sensitivity level of different data resources.

8. The data isolation method according to any one of claims 1-6, characterized in that, Also includes: Obtain attribute change trend data of the target object within a target time period; The target object is the target tenant and / or the target data resource; The attribute change trend data is smoothed over a future time window to obtain a smooth curve within that future time window. The smooth curve is then compared with a change threshold to obtain the probability of a change in the target object's level within the future time window. The level includes the security level and / or the sensitivity level. When the probability of change exceeds a preset threshold, a level change operation is triggered.

9. A data isolation device, characterized in that, include: The acquisition module is used to acquire the security level of the target tenant and the sensitivity level of the target data resource in response to the target tenant's access request for the target data resource; The matching module is used to obtain the isolation granularity that matches the target association key in a preset mapping matrix, using the security level and the sensitivity level as target association keys; the preset mapping matrix stores the mapping relationship between different association keys and corresponding isolation granularities; The risk determination module is used to determine the risk level of the target tenant based on the target tenant's access behavior data; An adjustment module is used to adjust the matched isolation granularity according to the risk level to obtain the adjusted isolation granularity; The strategy determination module is used to determine the data isolation strategy for the target data resource based on the adjusted isolation granularity. The execution module is used to perform corresponding isolation operations on the target data resource according to the data isolation strategy.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the data isolation method as described in any one of claims 1 to 8.

Images