Method, system and electronic device for managing data resources

Abstract

The application relates to a data resource management method, system and electronic equipment. The method comprises the following steps: constructing a multi-tenant shared storage area and private storage areas of each tenant based on resource ownership identifiers of data resources; receiving and analyzing an access request, obtaining request resource information of the access request, and determining an access request type based on the request resource information; extracting a resource ownership identifier of a target data resource based on the request resource information, and matching the target data resource with a target associated tenant and / or the multi-tenant shared storage area corresponding to the resource ownership identifier of the target data resource; and accessing the private storage area of the target associated tenant and / or the multi-tenant shared storage area to obtain the target data resource to respond to the access request, which can guarantee the isolation safety of private data of tenants and improve the sharing and reuse efficiency of public data.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a data resource management method, system and electronic device. Background Technology

[0002] With the continuous development of cloud computing and SaaS (Software as a Service) platforms, multi-tenant systems have been widely used in various data management and service scenarios. In such systems, different tenants typically require independent and secure storage and access environments for their own data, while also wanting to access public data on demand to improve resource utilization and service efficiency. Existing solutions still suffer from inadequate data isolation and sharing mechanisms, easily leading to problems such as unclear boundaries between private and public data, imprecise access control, and insufficient efficiency in cross-tenant sharing. Furthermore, there is a lack of effective tracking methods for the output of sensitive data, making it difficult to balance data security and sharing flexibility. Summary of the Invention

[0003] Therefore, it is necessary to provide a data resource management method, system, and electronic device that can both ensure the security of tenants' private data isolation and improve the efficiency of public data sharing and reuse, in response to the above-mentioned technical problems.

[0004] Firstly, this application provides a method for managing data resources, the method comprising: Based on the resource ownership identifier of data resources, a multi-tenant shared storage area and a private storage area for each tenant are constructed. Receive and parse access requests, obtain the requested resource information of the access request, and determine the access request type based on the requested resource information; Based on the requested resource information, extract the resource ownership identifier of the target data resource, match the target associated tenant and / or multi-tenant shared storage area corresponding to the resource ownership identifier of the target data resource, access the private storage area of ​​the target associated tenant and / or multi-tenant shared storage area to obtain the target data resource response to the access request.

[0005] In one embodiment, the access request type includes at least one of the following: single resource access request and collection access request; the access target associated tenant's private storage area and / or multi-tenant shared storage area includes: In response to a single resource access request, the access operation is performed in the private storage area of ​​the target associated tenant or the shared storage area of ​​the multi-tenant to obtain the target data resource; In response to a shared access condition and an access request type of set access request, access operations are performed on the private storage area and the multi-tenant shared storage area of ​​the target associated tenant, respectively, and the results of each access operation are merged to obtain the target data resource.

[0006] In one embodiment, responding to a shared access condition being met includes: Verify whether the collection access request meets the first access condition; wherein, the first access condition includes the collection access request carrying shared access parameters and / or the collection access request input interface being configured to allow access to the multi-tenant shared storage area; Verify whether the target associated tenant meets the second access condition; wherein, the second access condition includes that the target associated tenant has access rights to the multi-tenant shared storage area; If the collection access request meets the first access condition and the associated tenant meets the second access condition, it is determined that the shared access condition is met.

[0007] In one embodiment, a multi-tenant shared storage area and each tenant's private storage area are constructed based on the resource ownership identifier of the data resources, including: Acquire the data resources to be stored and determine the resource ownership identifier corresponding to the data resources; wherein, the resource ownership identifier includes the tenant identifier and the shared resource identifier, the tenant identifier corresponds one-to-one with the private storage area of ​​each tenant, and the shared resource identifier corresponds to the shared storage area of ​​multiple tenants; In response to the resource ownership identifier being a tenant identifier, the data resource is written to the private storage area of ​​the associated tenant corresponding to the tenant identifier; In response to the resource ownership identifier being a shared resource identifier, the data resource is written to the multi-tenant shared storage area.

[0008] In one embodiment, acquiring the data resource to be stored and determining the resource ownership identifier corresponding to the data resource includes: Access to data resources includes permission settings and source information; Parse the permission settings information to determine whether the data resource has a preset ownership identifier; In response to the fact that the data resource has a preset ownership identifier, the preset ownership identifier is determined as the resource ownership identifier; In response to the fact that the data resource does not have a preset attribution identifier, the source information is parsed and the source identifier is extracted; In response to the source identifier being the tenant source identifier, the tenant identifier corresponding to the data resource is determined as the resource ownership identifier of the data resource; In response to the source identifier being a public source identifier, the shared resource identifier is determined as the resource ownership identifier of the data resource.

[0009] In one embodiment, after acquiring the data resource to be stored, the process includes: Access to data resources includes permission settings, source information, and resource type information; In response to the permission setting information being private, the data sensitivity identifier is determined as the first sensitivity identifier; In response to the permission setting information being public, the data sensitivity identifier is determined to be another sensitivity identifier; In response to the absence of permission settings, the source information and resource type information are parsed to determine the source subject category and resource type category, which are then used as the current category combination; Query the first sensitivity identifier or other sensitivity identifiers corresponding to the current category combination in the preset sensitivity correspondence, and determine them as the data sensitivity identifiers of the data resources; Data resources are associated with and stored with defined data sensitivity identifiers.

[0010] In one embodiment, obtaining a response to a target data resource access request includes: Obtain the data sensitivity identifier corresponding to the target data resource; In response to the data sensitivity identifier being the first sensitivity identifier, a dynamic watermark is generated based on the identity information of the target associated tenant, access time information, and resource ownership identifier of the target data resource. The dynamic watermark is then overlaid onto the rendering of the target data resource to form a new target data resource, and the watermark log corresponding to the dynamic watermark is recorded. The new target data resource is then used to respond to the access request. In response to a data sensitivity identifier being another sensitivity identifier, the target data resource is output to respond to the access request, wherein the sensitivity of the first sensitivity identifier is higher than that of the other sensitivity identifiers.

[0011] In one embodiment, determining the access request type based on requested resource information includes: Identify and extract resource identification information and / or query parameter information from the requested resource information; In response to the resource identifier information of a single target data resource carried in the access request, the access request is determined to be a single resource access request; In response to the access request carrying query parameter information corresponding to the resource list, it is determined that the access request is a collection access request; wherein, the resource list includes multiple target data resources, and the query parameter information includes resource identifier information corresponding to the multiple target data resources in the resource list.

[0012] In one embodiment, extracting the resource ownership identifier of the target data resource based on the requested resource information, and matching the target associated tenant and / or multi-tenant shared storage area corresponding to the resource ownership identifier of the target data resource, includes: The resource metadata corresponding to the target data resource is queried based on the resource identifier information; the resource metadata is used to characterize the permission settings and source information of the target data resource. In response to the retrieval of resource metadata corresponding to the target data resource, the resource ownership identifier is determined based on the permission setting information and source information, so as to determine the target storage area corresponding to the resource ownership identifier; In response to an anomaly in resource metadata retrieval, the private storage area of ​​the target associated tenant is identified as the target storage area.

[0013] In one embodiment, determining the target storage area corresponding to the resource ownership identifier includes: In response to the resource ownership identifier being a tenant identifier, the tenant corresponding to the tenant identifier is taken as the target associated tenant, and the private storage area of ​​the target associated tenant is taken as the target storage area, so as to query the target data resource that matches the resource identifier in the private storage area; In response to the resource ownership identifier being a shared resource identifier, the multi-tenant shared storage area is used as the target storage area to query the target data resource that matches the resource identifier in the multi-tenant shared storage area.

[0014] In one embodiment, the access request type includes a collection access request; determining the target storage area corresponding to the resource ownership identifier includes: In response to an access request of type collection access request, parse and extract the query conditions of the target data resource collection corresponding to the collection access request; The private storage area carrying the tenant identifier contained in the resource ownership identifier is taken as the target private area. The set of target data resources that meet the query conditions in the target private area is used to obtain the first access result. The second access result is obtained by querying the target data resource set based on the query conditions in the multi-tenant shared storage area. The target data resource is obtained by merging the first and second access results.

[0015] Secondly, this application provides a data resource management system, including: Network modules are used for communication connections with tenants' private storage areas and multi-tenant shared storage areas; A computing module includes a central processing unit and a memory connected to the central processing unit; the computing module is connected to a network module to implement the steps of the data resource management method described in the first aspect.

[0016] Thirdly, this application provides an electronic device, comprising: Memory, used to store computer programs; The processor includes a management system for the data resources described in the second aspect; The interaction module, connected to the processor and memory, is used to obtain external input data resource storage requests to acquire data resources and / or obtain access requests to output target data resources to the outside.

[0017] By constructing a multi-tenant shared storage area and each tenant's private storage area based on the resource ownership identifier of data resources, data resources belonging to a specific tenant and data resources shared by multiple tenants are stored separately. This creates clear data boundaries during the storage phase, reducing unauthorized access and data isolation failure issues caused by mixed storage of data from different tenants. Upon receiving an access request, the access request type is determined by the requested resource information, and the resource ownership identifier of the target data resource is extracted to match the corresponding target associated tenant and / or multi-tenant shared storage area. This allows single resource access requests to locate the corresponding storage area to obtain the target data resource, and allows aggregated access requests to obtain and integrate data from the private and shared storage areas according to access requirements. Therefore, it ensures the isolation and access accuracy of each tenant's private data while enabling cross-tenant reuse of shared data resources, improving the integrity, flexibility, and processing efficiency of data access in multi-tenant scenarios. Attached Figure Description

[0018] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be determined based on these drawings without creative effort.

[0019] Figure 1 A flowchart illustrating a data resource management method provided in an embodiment of this application; Figure 2 This is an overall architecture diagram of a data resource management method according to an embodiment of this application; Figure 3 This is an internal structural diagram of a computer device in one embodiment of this application. Detailed Implementation

[0020] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments determined by those skilled in the art without creative effort are within the protection scope of this application.

[0021] It should be noted that, in the description of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or treatment method that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or treatment method. The terms "first," "second," etc., in this application are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0022] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0023] In one embodiment, such as Figure 1 As shown, a data resource management method is provided, including: S100: Construct a multi-tenant shared storage area and each tenant's private storage area based on the resource ownership identifier of the data resources; S200: Receive and parse the access request, obtain the requested resource information of the access request, and determine the access request type based on the requested resource information; S300: Extract the resource ownership identifier of the target data resource based on the requested resource information, match the target associated tenant and / or multi-tenant shared storage area corresponding to the resource ownership identifier of the target data resource, access the private storage area of ​​the target associated tenant and / or multi-tenant shared storage area to obtain the target data resource response to the access request.

[0024] The resource ownership identifier indicates whether a data resource belongs to a specific tenant or is a shared resource; the target associated tenant is the tenant corresponding to the target data resource; the multi-tenant shared storage area stores data resources accessible to multiple tenants, while each tenant's private storage area stores its own private data resources. A single resource access request is a request initiated for a single target data resource, a collection access request is a request initiated for multiple target data resources or a certain data range, and the shared access condition is a preset condition for determining whether a collection access request can simultaneously access both the private and shared storage areas. Data resources can include data objects such as questions, exam papers, answers, explanations, documents, images, audio / video, configuration files, or model files.

[0025] Specifically, during data writing, tenant private data and shared data are stored in their respective private storage areas and multi-tenant shared storage areas based on resource ownership identifiers. This delineates the storage boundaries between tenant private data and shared data, reducing the risks of mixed data storage and cross-tenant access. Upon receiving an access request, the access request type is determined based on the requested resource information, and the resource ownership identifier of the target data resource is extracted to match the target associated tenant and / or multi-tenant shared storage area. Single resource access requests directly access the corresponding storage area to quickly locate and obtain the target data resource. When a set of access requests meets the shared access conditions, both the private storage area and the shared storage area are accessed simultaneously, and the access results are merged. When the shared access conditions are not met, only the private storage area of ​​the target associated tenant is accessed. This balances tenant data isolation and shared data reuse, improving the accuracy, flexibility, and processing efficiency of data access.

[0026] In one embodiment, the access request type includes at least one of the following: single resource access request and collection access request; the access target associated tenant's private storage area and / or multi-tenant shared storage area includes: In response to a single resource access request, the access operation is performed in the private storage area of ​​the target associated tenant or the shared storage area of ​​the multi-tenant to obtain the target data resource; In response to a shared access condition and an access request type of set access request, access operations are performed on the private storage area and the multi-tenant shared storage area of ​​the target associated tenant, respectively, and the results of each access operation are merged to obtain the target data resource.

[0027] Among them, a single resource access request is an access request initiated for a single target data resource; shared access conditions are preset conditions used to determine whether simultaneous access to the private storage area of ​​the target associated tenant and the multi-tenant shared storage area is allowed during the collection access process, which can be determined according to request parameters, tenant access permissions, or resource sharing policies; access operations can include querying, reading, downloading, or calling; result merging is to summarize, deduplicate, or sort the data returned by the private storage area and the multi-tenant shared storage area according to preset rules to form the target data resource corresponding to the collection access request.

[0028] Specifically, when the access request type is a single resource access request, the access operation is performed in the private storage area of ​​the target associated tenant or the multi-tenant shared storage area, enabling the access request to directly locate the storage area corresponding to the target data resource and reducing the retrieval of irrelevant storage areas. When the access request type is a collection access request and meets the shared access conditions, the private storage area of ​​the target associated tenant and the multi-tenant shared storage area are accessed separately, and the access results are merged so that the returned result contains both tenant private data and shared data. When the access request type is a collection access request but does not meet the shared access conditions, the access scope is restricted to the private storage area of ​​the target associated tenant to prevent unauthorized access to the multi-tenant shared storage area. Therefore, while ensuring the isolation of tenant private data and the security of shared data access, the location efficiency of single resource access, the integrity of collection access results, and the reuse efficiency of shared data resources can be improved.

[0029] In one embodiment, responding to a shared access condition being met includes: Verify whether the collection access request meets the first access condition; wherein, the first access condition includes the collection access request carrying shared access parameters and / or the collection access request input interface being configured to allow access to the multi-tenant shared storage area; Verify whether the target associated tenant meets the second access condition; wherein, the second access condition includes that the target associated tenant has access rights to the multi-tenant shared storage area; If the collection access request meets the first access condition and the associated tenant meets the second access condition, it is determined that the shared access condition is met.

[0030] The first access condition is a request-side condition used to determine whether a collection access request has the intent to access shared data; the shared access parameter is a parameter in the collection access request used to indicate the need to access the multi-tenant shared storage area; the input interface configuration is a shared access attribute pre-set for the input interface of the collection access request; the second access condition is a tenant-side condition used to determine whether the target associated tenant has the qualification to access shared data; and the access permission is the permission granted to the target associated tenant to access the multi-tenant shared storage area.

[0031] Specifically, the shared access request is first validated by checking whether it carries shared access parameters and whether the interface is configured to allow access to the multi-tenant shared storage area. Then, the permissions of the target associated tenant to access the multi-tenant shared storage area are validated. Shared access is deemed valid only if the request meets the first access condition and the tenant meets the second access condition. This approach restricts shared data access from both the request intent and tenant permissions, preventing access to shared data due to missing request parameters, disallowed interface configurations, or unauthorized tenants, thus improving the accuracy and security of shared access determination.

[0032] In one embodiment, a multi-tenant shared storage area and each tenant's private storage area are constructed based on the resource ownership identifier of the data resources, including: Acquire the data resources to be stored and determine the resource ownership identifier corresponding to the data resources; wherein, the resource ownership identifier includes the tenant identifier and the shared resource identifier, the tenant identifier corresponds one-to-one with the private storage area of ​​each tenant, and the shared resource identifier corresponds to the shared storage area of ​​multiple tenants; In response to the resource ownership identifier being a tenant identifier, the data resource is written to the private storage area of ​​the associated tenant corresponding to the tenant identifier; In response to the resource ownership identifier being a shared resource identifier, the data resource is written to the multi-tenant shared storage area.

[0033] Among them, the data resources to be stored are data objects that have not yet been written to the corresponding storage area; the associated tenant is the tenant pointed to by the tenant identifier and corresponding to the ownership relationship of the data resources; the tenant identifier corresponds one-to-one with the private storage area of ​​each tenant, which means that each tenant identifier corresponds to the private storage area of ​​the corresponding tenant, as the writing location of the tenant's private data resources.

[0034] Specifically, after acquiring the data resources to be stored, the storage scope is determined by identifying the resource ownership identifier corresponding to the data resource. When the resource ownership identifier is a tenant identifier, the data resource is written to the private storage area corresponding to that tenant identifier, allowing different tenants' proprietary data to be stored separately during the writing phase. When the resource ownership identifier is a shared resource identifier, the data resource is written to the multi-tenant shared storage area, enabling data resources usable by multiple tenants to be stored centrally. Thus, data resources can be accurately written to their corresponding storage areas based on their ownership, forming a storage boundary between tenant private data and shared data. This reduces the risks of data mixing, ownership errors, and cross-tenant access, and provides a clear storage basis for subsequent access and sharing based on resource ownership.

[0035] In one embodiment, acquiring the data resource to be stored and determining the resource ownership identifier corresponding to the data resource includes: Access to data resources includes permission settings and source information; Parse the permission settings information to determine whether the data resource has a preset ownership identifier; In response to the fact that the data resource has a preset ownership identifier, the preset ownership identifier is determined as the resource ownership identifier; In response to the fact that the data resource does not have a preset attribution identifier, the source information is parsed and the source identifier is extracted; In response to the source identifier being the tenant source identifier, the tenant identifier corresponding to the data resource is determined as the resource ownership identifier of the data resource; In response to the source identifier being a public source identifier, the shared resource identifier is determined as the resource ownership identifier of the data resource.

[0036] The information includes: permission setting information, which indicates the scope of permissions, usage, or ownership of data resources; preset ownership identifier, which is a pre-configured identifier in the data resource that directly indicates the ownership of the data resource; source information, which indicates the source or provider of the data resource; source identifier, which is a source category identifier obtained by parsing the source information; tenant source identifier, which indicates that the data resource originates from the tenant side; and public source identifier, which indicates that the data resource originates from the public or shared side.

[0037] Specifically, after obtaining the permission setting information and source information of data resources, the permission setting information is parsed first. When a data resource has a preset ownership identifier, the preset ownership identifier is directly determined as the resource ownership identifier to reduce unnecessary ownership determination processes. When a data resource does not have a preset ownership identifier, the source information is further parsed and the source identifier is extracted. If the source identifier is a tenant source identifier, the tenant identifier corresponding to the data resource is determined as the resource ownership identifier; if the source identifier is a public source identifier, the shared resource identifier is determined as the resource ownership identifier. By prioritizing the use of preset ownership identifiers and supplementing the determination based on the data source when a preset ownership identifier is missing, data resources from different sources and with different permission settings can obtain clear ownership results, reducing situations where resource ownership is unclear or incorrectly determined, and providing an accurate basis for subsequently writing data resources into the corresponding storage area.

[0038] In one embodiment, such as Figure 2 As shown, after obtaining the data resources to be stored, the process includes: Access to data resources includes permission settings, source information, and resource type information; In response to the permission setting information being private, the data sensitivity identifier is determined as the first sensitivity identifier; In response to the permission setting information being public, the data sensitivity identifier is determined to be another sensitivity identifier; In response to the absence of permission settings, the source information and resource type information are parsed to determine the source subject category and resource type category, which are then used as the current category combination; Query the first sensitivity identifier or other sensitivity identifiers corresponding to the current category combination in the preset sensitivity correspondence, and determine them as the data sensitivity identifiers of the data resources; Data resources are associated with and stored with defined data sensitivity identifiers.

[0039] Among them, resource type information is used to characterize the business type or data form to which the data resource belongs; data sensitivity identifier is used to characterize the sensitivity level of the data resource; the first sensitivity identifier is used to characterize the sensitivity corresponding to private data, and other sensitivity identifiers are used to characterize the sensitivity corresponding to public data or other types of data; source subject category is the type of data provider determined based on source information; resource type category is the data classification result determined based on resource type information; current category combination is a combination formed by the source subject category and the resource type category; preset sensitivity correspondence is the pre-established correspondence between different category combinations and corresponding data sensitivity identifiers.

[0040] Specifically, when the permission settings are private or public, the corresponding data sensitivity identifier is directly determined, reducing additional category parsing and querying processes. When no permission settings are set, the current category combination is formed by parsing the source information and resource type information, and the corresponding data sensitivity identifier is determined by querying the preset sensitivity correspondence. This allows data resources without explicit permission settings to complete sensitivity determination based on the source subject and resource type. Associating data resources with determined data sensitivity identifiers provides a basis for subsequent data isolation, access control, and security management, reducing the problem of unidentified or inaccurate sensitivity identification due to missing permission information, and improving the completeness and accuracy of data sensitivity determination.

[0041] In one embodiment, obtaining a response to a target data resource access request includes: Obtain the data sensitivity identifier corresponding to the target data resource; In response to the data sensitivity identifier being the first sensitivity identifier, a dynamic watermark is generated based on the identity information of the target associated tenant, access time information, and resource ownership identifier of the target data resource. The dynamic watermark is then overlaid onto the rendering of the target data resource to form a new target data resource, and the watermark log corresponding to the dynamic watermark is recorded. The new target data resource is then used to respond to the access request. In response to a data sensitivity identifier being another sensitivity identifier, the target data resource is output to respond to the access request, wherein the sensitivity of the first sensitivity identifier is higher than that of the other sensitivity identifiers.

[0042] Among them, dynamic watermarking is watermark information generated in real time based on the identity information, access time information and resource ownership identifier of the target associated tenant and the target data resource. It is used to represent the access subject, access time and resource ownership of the target data resource; watermark log is used to record the dynamic watermark content, generation time, associated tenant and corresponding target data resource information; rendering is the process of overlaying the dynamic watermark onto the display content or output content of the target data resource.

[0043] Specifically, after obtaining the data sensitivity identifier of the target data resource, when the data sensitivity identifier is the first sensitivity identifier, a dynamic watermark is generated based on the identity information, access time information, and resource ownership identifier of the target associated tenant. The dynamic watermark is then superimposed on the target data resource, and the corresponding watermark log is recorded. The target data resource with the superimposed watermark is then used to respond to access requests, so that the access subject and access process of sensitive data can be identified and traced, reducing the risk of not being able to determine the responsible party after data interception, dissemination, or leakage. When the data sensitivity identifier is other sensitivity identifiers, the target data resource is directly output, avoiding unnecessary watermarking processing on data with low sensitivity, thereby improving the security and traceability of access to sensitive data while reducing the processing overhead of non-sensitive data.

[0044] In one embodiment, determining the access request type based on requested resource information includes: Identify and extract resource identification information and / or query parameter information from the requested resource information; In response to the resource identifier information of a single target data resource carried in the access request, the access request is determined to be a single resource access request; In response to the access request carrying query parameter information corresponding to the resource list, it is determined that the access request is a collection access request; wherein, the resource list includes multiple target data resources, and the query parameter information includes resource identifier information corresponding to the multiple target data resources in the resource list.

[0045] Among them, resource identification information is the identification information used to uniquely point to the target data resource; query parameter information is the parameter information used to characterize the query object, query scope or query conditions of the access request; and the resource list is a data set composed of the resource identification information of multiple target data resources.

[0046] Specifically, by identifying resource identifiers and query parameters from the requested resource information, the access request type can be determined based on the quantity and organization of the target data resources in the request. When an access request carries the resource identifier of a single target data resource, it is identified as a single-resource access request; when an access request carries query parameters corresponding to a resource list, it is identified as a collection access request. This allows for accurate differentiation between accesses targeting a single data resource and batch accesses targeting multiple data resources, providing a basis for subsequent appropriate storage area location, shared access verification, and result processing methods, reducing inaccurate or invalid access scope due to incorrect request type identification.

[0047] In one embodiment, extracting the resource ownership identifier of the target data resource based on the requested resource information, and matching the target associated tenant and / or multi-tenant shared storage area corresponding to the resource ownership identifier of the target data resource, includes: Based on the resource identifier information, query the resource metadata corresponding to the target data resource. The resource metadata is used to characterize the permission settings and source information of the target data resource. In response to the retrieval of resource metadata corresponding to the target data resource, the resource ownership identifier is determined based on the permission setting information and source information, so as to determine the target storage area corresponding to the resource ownership identifier; In response to an anomaly in resource metadata retrieval, the private storage area of ​​the target associated tenant is identified as the target storage area.

[0048] Among them, resource metadata is data used to describe the permission settings, source information and other management attributes of the target data resource; the target storage area is the actual access area determined according to the resource ownership identifier of the target data resource, including the private storage area of ​​the target associated tenant or the shared storage area of ​​multiple tenants; resource metadata acquisition anomaly refers to the situation where the resource metadata is not found, or the resource metadata is erroneous during reading, transmission or parsing, resulting in the inability to determine the resource ownership identifier based on the resource metadata.

[0049] Specifically, the resource metadata corresponding to the target data resource is queried based on the resource identifier information. When the resource metadata is obtained normally, the resource ownership identifier is determined by combining the permission setting information and source information. Based on the resource ownership identifier, the target data resource is located in the private storage area or multi-tenant shared storage area of ​​the target associated tenant. This allows access requests to enter the corresponding storage area according to the actual ownership of the data resource, reducing invalid access caused by traversing multiple storage areas and improving the accuracy of target data resource location and access efficiency. When the resource metadata is obtained abnormally, the private storage area of ​​the target associated tenant is used as the target storage area. This can limit the access scope to within the data isolation boundary of the current tenant, avoiding incorrect access to the multi-tenant shared storage area or expansion of the data access scope due to the inability to confirm the resource ownership. At the same time, the access process can continue to execute according to the preset security path, thus balancing the continuity of data access and the security of tenant data isolation in abnormal situations.

[0050] In one embodiment, determining the target storage area corresponding to the resource ownership identifier includes: In response to the resource ownership identifier being a tenant identifier, the tenant corresponding to the tenant identifier is taken as the target associated tenant, and the private storage area of ​​the target associated tenant is taken as the target storage area, so as to query the target data resource that matches the resource identifier in the private storage area; In response to the resource ownership identifier being a shared resource identifier, the multi-tenant shared storage area is used as the target storage area to query the target data resource that matches the resource identifier in the multi-tenant shared storage area.

[0051] Among them, matching with resource identifiers means searching for data resources with the same or corresponding resource identifiers in the determined target storage area based on the resource identifiers carried in the access request, so as to obtain the target data resource pointed to by the access request.

[0052] Specifically, when the resource ownership identifier is a tenant identifier, the tenant corresponding to that identifier is identified as the target associated tenant, and the private storage area of ​​the target associated tenant is identified as the target storage area. This allows for querying target data resources matching the resource identifier within the data isolation scope limited to that tenant, avoiding access to other tenants' private storage areas or multi-tenant shared storage areas. When the resource ownership identifier is a shared resource identifier, the multi-tenant shared storage area is identified as the target storage area, and the target data resources matching the resource identifier are queried within the shared data scope. By determining the private storage area or multi-tenant shared storage area as the target storage area based on the resource ownership identifier, access requests can directly enter the storage area corresponding to the actual ownership of the data resource, reducing traversal queries and repeated searches of irrelevant storage areas, narrowing the data query scope, and improving the accuracy of target data resource location and query efficiency. At the same time, it can avoid cross-tenant data access, confusion between private and shared data, or target resource query failures caused by incorrect storage area selection. Thus, while ensuring tenant data isolation and unified access to shared resources, it improves the security, accuracy, and processing efficiency of data access in multi-tenant scenarios.

[0053] In one embodiment, the access request type includes a collection access request; determining the target storage area corresponding to the resource ownership identifier includes: In response to an access request of type collection access request, parse and extract the query conditions of the target data resource collection corresponding to the collection access request; The private storage area carrying the tenant identifier contained in the resource ownership identifier is taken as the target private area. The set of target data resources that meet the query conditions in the target private area is used to obtain the first access result. The second access result is obtained by querying the target data resource set based on the query conditions in the multi-tenant shared storage area. The target data resource is obtained by merging the first and second access results.

[0054] The query conditions are data filtering conditions used to limit the target data resource set, and may include at least one of the following: resource identifier, resource type, creation time, update time, business attributes, or other search conditions; the target private area is the private storage area corresponding to the tenant identifier contained in the resource ownership identifier; the first access result is the set of tenant private data resources that meet the query conditions and are obtained from the target private area; the second access result is the set of shared data resources that meet the query conditions and are obtained from the multi-tenant shared storage area.

[0055] Specifically, when the access request type is a collection access request, the collection access request is parsed to extract the query conditions corresponding to the target data resource set, and the target private area is determined based on the tenant identifier contained in the resource ownership identifier. Queries are then performed in the target private area and the multi-tenant shared storage area according to the same or corresponding query conditions, yielding a first access result containing the tenant's private data and a second access result containing shared data. The first and second access results are then merged to form the target data resource corresponding to the collection access request. By limiting the query scope of private data based on the tenant identifier, access to other tenants' private storage areas can be avoided, ensuring the isolation of tenant data during the collection query process. By simultaneously querying the target private area and the multi-tenant shared storage area, the returned results can take into account both the proprietary data of the target associated tenant and the shared data that can be reused by multiple tenants, reducing data omissions caused by querying only a single storage area. By merging the query results from different storage areas, a unified data resource set can be provided to the access request, avoiding the requester from accessing multiple storage areas separately and integrating data independently, thereby improving the completeness of the collection access results, the accuracy of data queries, and the processing efficiency of multi-storage area joint access.

[0056] In one embodiment, this method can be applied to a multi-tenant question bank platform. Tenant A uploads a set of internal monthly exam papers to the platform. After obtaining the exam paper resources to be stored, the platform obtains the permission settings and source information of the exam paper resources, and determines the resource ownership identifier of the exam paper resources based on the permission settings and source information. The platform identifies that the exam paper resources belong to Tenant A's private resources, determines the tenant identifier corresponding to Tenant A as the resource ownership identifier of the exam paper resources, and writes the exam paper resources into Tenant A's private storage area. At the same time, for the general practice question resources maintained by the platform, since their source information corresponds to a public source identifier, the platform determines the shared resource identifier as the resource ownership identifier of the general practice question resources, and writes it into the multi-tenant shared storage area.

[0057] Through the above processing, tenant private resources and shared resources can be written into the corresponding storage areas according to the resource ownership identifier of the data resources. This allows data resources with different ownership to be partitioned and stored during the data entry stage, reducing the situation of mixed storage of private and shared resources, unclear resource ownership, or data being written to the wrong storage area. This provides a clear storage basis for subsequent data access and classification management according to resource ownership.

[0058] When a teacher from tenant A searches for high school senior math function questions, the platform receives and parses the access request, obtains the requested resource information, and determines that the access request is a collection access request based on the resource information. The platform further verifies whether the collection access request carries shared access parameters or whether the corresponding input interface is configured to allow access to the multi-tenant shared storage area, and verifies whether tenant A has access permissions to the multi-tenant shared storage area. After determining that the collection access request meets the shared access conditions, the platform identifies tenant A as the target associated tenant and identifies tenant A's private storage area as the target private area.

[0059] The platform parses and extracts the query conditions corresponding to the collection access request, such as the educational level being high school, the grade being senior high school, the subject being mathematics, and the knowledge point being functions. The platform queries the private storage area of ​​tenant A for a set of target data resources that meet these query conditions, obtaining the first access result; simultaneously, it queries the shared storage area of ​​multiple tenants for a set of target data resources that meet these query conditions, obtaining the second access result. Subsequently, the platform merges, deduplicates, and sorts the first and second access results according to preset merging rules to obtain the target data resources used to respond to the collection access request. For example, if the first and second access results contain questions with the same resource identifier, the question version in tenant A's private storage area can be retained first.

[0060] Through the above processing, while ensuring that the private storage areas of other tenants are not accessed, the private resources and allowed shared resources of the target associated tenant can be queried simultaneously. This allows teachers to obtain the private questions of their own tenant and the shared questions provided by the platform with a single aggregated access request, reducing data omissions caused by querying only a single storage area. Furthermore, by merging and deduplicating the results, the duplicate display of the same questions is reduced, thereby improving the completeness and accuracy of aggregated access results and the reuse efficiency of shared data resources.

[0061] Furthermore, when a teacher from tenant A opens and previews an internal monthly exam paper from the search results, the platform queries the resource metadata corresponding to the exam paper based on the resource identifier information carried in the access request. Based on the permission settings and source information represented by the resource metadata, the platform determines that the resource ownership identifier of the exam paper is tenant A's tenant identifier. Accordingly, the platform identifies tenant A as the target associated tenant, determines tenant A's private storage area as the target storage area, and queries the private storage area for exam paper resources that match the resource identifier information, thus obtaining the target data resource.

[0062] The platform further obtains the data sensitivity identifier corresponding to the target data resource. When the data sensitivity identifier of the target data resource is determined to be the first sensitivity identifier, the platform generates a dynamic watermark based on the teacher's identity information, access time information, and resource ownership identifier of the target data resource, and overlays the dynamic watermark onto the rendered output of the test paper to form a new target data resource. Simultaneously, the platform records a watermark log corresponding to the dynamic watermark and responds to the teacher's preview request using the target data resource with the overlaid dynamic watermark. The watermark log can record the teacher's identity information, access time information, resource identifier of the target data resource, resource ownership identifier, and dynamic watermark content.

[0063] Through the above processing, highly sensitive tenant-owned exam papers can be protected with dynamic watermarks, ensuring that the output exam paper content carries identity information, access time information, and resource ownership information related to the access behavior. When the exam paper content is intercepted, copied, or disseminated, the relevant access subject, access time, and resource source can be identified based on the dynamic watermark and its corresponding watermark logs. This reduces the difficulty in tracing highly sensitive data resources after output and improves the security and traceability of tenant-owned data resources during previewing, reading, or downloading.

[0064] The aforementioned data resource management method, by storing data resources in each tenant's private storage area or multi-tenant shared storage area according to resource ownership identifiers, can establish storage boundaries between tenant private resources and shared resources during the data ingestion stage, reducing the risk of mixed storage of data resources with different ownership and accidental access across tenants; by identifying single resource access requests and aggregate access requests, and determining the corresponding target storage area based on resource ownership identifiers, access requests can be directed to the storage area corresponding to the actual ownership of the target data resource, improving the accuracy of data resource location and access; by querying the private storage area of ​​the target associated tenant and the multi-tenant shared storage area separately when aggregate access requests meet the shared access conditions, and merging the query results, the integrity of aggregate access results and the reuse efficiency of shared resources can be improved; by overlaying dynamic watermarks on highly sensitive data resources according to data sensitivity identifiers and recording watermark logs, the security control capabilities and leakage tracing capabilities of the sensitive data resource output process can be improved.

[0065] An embodiment of this application also provides a data resource management system, the system comprising: Network modules are used for communication connections with tenants' private storage areas and multi-tenant shared storage areas; The computing module includes a central processing unit and a memory connected to the central processing unit; the computing module is connected to a network module to implement a data resource management method.

[0066] An embodiment of this application also provides an electronic device, the electronic device comprising: Memory, used to store computer programs; Processors, including data resource management systems; The interaction module, connected to the processor and memory, is used to acquire external input data resource storage requests and / or access requests, and to output the target data resource to the outside.

[0067] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above-described data resource management method embodiments when running.

[0068] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0069] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 3 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and the database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The database stores training data for the detection model. The network interface communicates with external terminals via a network connection. When the computer program is executed by the processor, it implements the steps of a data resource management method.

[0070] Embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above-described data resource management method embodiments.

[0071] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0072] The above provides a detailed description of a data resource management method provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only intended to help understand the method and core ideas of this application. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of the claims of this application.

Claims

1. A method for managing data resources, characterized in that, The data resource management methods include: Based on the resource ownership identifier of data resources, a multi-tenant shared storage area and a private storage area for each tenant are constructed. Receive and parse access requests, obtain the request resource information of the access request, and determine the access request type based on the request resource information; Based on the requested resource information, extract the resource ownership identifier of the target data resource, match the target associated tenant and / or the multi-tenant shared storage area corresponding to the resource ownership identifier of the target data resource, access the private storage area of ​​the target associated tenant and / or the multi-tenant shared storage area, and obtain the target data resource response to the access request.

2. The data resource management method according to claim 1, characterized in that, The access request types include at least one of the following: single resource access request and collection access request; access to the private storage area of ​​the target associated tenant and / or the multi-tenant shared storage area includes: In response to the access request type being the single resource access request, an access operation is performed in the private storage area of ​​the target associated tenant or the shared storage area of ​​the multi-tenant to obtain the target data resource; In response to a shared access condition being met and the access request type being the set access request, access operations are performed on the private storage area of ​​the target associated tenant and the multi-tenant shared storage area, respectively, and the results of each access operation are merged to obtain the target data resource.

3. The data resource management method according to claim 2, characterized in that, The response prior to meeting the shared access conditions includes: Verify whether the collection access request meets the first access condition; wherein, the first access condition includes the collection access request carrying shared access parameters and / or the collection access request input interface being configured to allow access to the multi-tenant shared storage area; Verify whether the target associated tenant meets the second access condition; wherein, the second access condition includes that the target associated tenant has access rights to the multi-tenant shared storage area; In response to the collection access request meeting the first access condition and the associated tenant meeting the second access condition, it is determined that the shared access condition is met.

4. The data resource management method according to claim 1, characterized in that, The construction of a multi-tenant shared storage area and each tenant's private storage area based on the resource ownership identifier of data resources includes: Obtain the data resources to be stored and determine the resource ownership identifier corresponding to the data resources; wherein, the resource ownership identifier includes a tenant identifier and a shared resource identifier, the tenant identifier corresponds one-to-one with the private storage area of ​​each tenant, and the shared resource identifier corresponds to the multi-tenant shared storage area; In response to the resource ownership identifier being a tenant identifier, the data resource is written to the private storage area of ​​the associated tenant corresponding to the tenant identifier; In response to the resource ownership identifier being a shared resource identifier, the data resource is written to the multi-tenant shared storage area.

5. The data resource management method according to claim 4, characterized in that, The step of acquiring the data resource to be stored and determining the resource ownership identifier corresponding to the data resource includes: Obtain the permission settings and source information of the data resources; The permission setting information is parsed to determine whether the data resource has a preset ownership identifier; In response to the fact that the data resource has a preset ownership identifier, the preset ownership identifier is determined as the resource ownership identifier; In response to the fact that the data resource does not have a preset attribution identifier, the source information is parsed and the source identifier is extracted; In response to the source identifier being a tenant source identifier, the tenant identifier corresponding to the data resource is determined as the resource ownership identifier of the data resource; In response to the source identifier being a public source identifier, the shared resource identifier is determined as the resource ownership identifier of the data resource.

6. The data resource management method according to claim 4, characterized in that, After acquiring the data resources to be stored, the process includes: Obtain the permission settings, source information, and resource type information of the data resources; In response to the permission setting information being private, the data sensitivity identifier is determined to be the first sensitivity identifier; In response to the permission setting information being public, the data sensitivity identifier is determined to be another sensitivity identifier; In response to the absence of permission settings, the source information and resource type information are parsed to determine the source subject category and resource type category, which are then used as the current category combination. Query the first sensitivity identifier or the other sensitivity identifier corresponding to the current category combination in the preset sensitivity correspondence, and determine it as the data sensitivity identifier of the data resource; The data resources are associated with and stored in conjunction with the determined data sensitivity identifier.

7. The data resource management method according to claim 1, characterized in that, The step of obtaining the target data resource in response to the access request includes: Obtain the data sensitivity identifier corresponding to the target data resource; In response to the data sensitivity identifier being a first sensitivity identifier, a dynamic watermark is generated based on the identity information of the target associated tenant, access time information, and resource ownership identifier of the target data resource. The dynamic watermark is then overlaid onto the rendering of the target data resource to form a new target data resource, and the watermark log corresponding to the dynamic watermark is recorded. The access request is then responded to using the new target data resource. In response to the data sensitivity identifier being another sensitivity identifier, the target data resource is output to respond to the access request, wherein the sensitivity of the first sensitivity identifier is higher than the sensitivity of the other sensitivity identifiers.

8. The data resource management method according to claim 1, characterized in that, Determining the access request type based on the requested resource information includes: Resource identification information and / or query parameter information are identified and extracted from the requested resource information; In response to the resource identifier information of a single target data resource carried in the access request, the access request is determined to be a single resource access request; In response to the access request carrying query parameter information corresponding to the resource list, the access request is determined to be a collection access request; wherein, the resource list includes multiple target data resources, and the query parameter information includes resource identifier information corresponding to the multiple target data resources in the resource list respectively.

9. The data resource management method according to claim 8, characterized in that, The step of extracting the resource ownership identifier of the target data resource based on the requested resource information, and matching the target associated tenant and / or the multi-tenant shared storage area corresponding to the resource ownership identifier of the target data resource, includes: The resource metadata corresponding to the target data resource is queried based on the resource identification information; the resource metadata is used to characterize the permission settings and source information of the target data resource; In response to the query of resource metadata corresponding to the target data resource, the resource ownership identifier is determined based on the permission setting information and the source information, so as to determine the target storage area corresponding to the resource ownership identifier; In response to the abnormal resource metadata acquisition, the private storage area of ​​the target associated tenant is identified as the target storage area.

10. The data resource management method according to claim 9, characterized in that, Determining the target storage area corresponding to the resource ownership identifier includes: In response to the resource ownership identifier being a tenant identifier, the tenant corresponding to the tenant identifier is taken as the target associated tenant, and the private storage area of ​​the target associated tenant is taken as the target storage area, so as to query the target data resource that matches the resource identifier in the private storage area; In response to the resource ownership identifier being a shared resource identifier, the multi-tenant shared storage area is used as the target storage area to query the target data resource that matches the resource identifier in the multi-tenant shared storage area.

11. The data resource management method according to claim 9, characterized in that, The access request type includes a collection access request; determining the target storage area corresponding to the resource ownership identifier includes: In response to the access request type being a collection access request, the query conditions for the target data resource set corresponding to the collection access request are parsed and extracted; The private storage area carrying the tenant identifier contained in the resource ownership identifier is taken as the target private area, and the set of target data resources that meet the query conditions in the target private area is used to obtain the first access result; The target data resource set according to the query conditions is queried in the multi-tenant shared storage area to obtain the second access result; The target data resource is obtained by merging the first access result and the second access result.

12. A data resource management system, characterized in that, The data resource management system includes: Network modules are used for communication connections with tenants' private storage areas and multi-tenant shared storage areas; A computing module includes a central processing unit and a memory connected to the central processing unit; the computing module is connected to the network module and is used to implement the data resource management method as described in any one of claims 1-11.

13. An electronic device, characterized in that, The electronic device includes: Memory, used to store computer programs; The processor includes the data resource management system as described in claim 12; An interaction module, connected to the processor and the memory, is used to acquire externally input data resource storage requests to obtain data resources and / or acquire access requests to output target data resources to the outside.

Images