Tenant Management System

Abstract

To provide a tenant management system which can improve possibility of properly operating an application for each tenant.SOLUTION: A tenant management system according to the present invention is characterized in that if a value obtained by multiplying the number of users registered for each target tenant application for a tenant by a consumption resource unit that is an amount of resources expected to be consumed when a single user uses a target tenant application exceeds a current resource amount of the target tenant application for the target tenant (as represented by YES at step S164), then the resources of the target tenant application for the target tenant is provisioned by only a specific amount (at S165).SELECTED DRAWING: Figure 10

Description

[Technical Field]

[0001] The present invention relates to a tenant management system for managing tenants in a solution built on a public cloud. [Background technology]

[0002] BACKGROUND ART Conventionally, a tenant management system based on a multi-tenant model is known in which environments and data are separated for each customer according to tenant identification information (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2019-139591 Summary of the Invention [Problem to be solved by the invention]

[0004] However, conventional tenant management systems have a problem in that if the number of users of a tenant-specific application, which is an application prepared for each tenant, increases, the resources of the web server that realizes the tenant-specific application may become insufficient, causing the tenant-specific application to stop working properly.

[0005] Therefore, an object of the present invention is to provide a tenant management system that can improve the possibility that tenant-specific applications will operate properly. [Means for solving the problem]

[0006] The tenant management system of the present invention comprises an application management unit that receives user requests to a tenant-specific application, which is an application prepared for each tenant in a solution built on a public cloud, and a server resource management unit that provisions resources for a web server that realizes the tenant-specific application, and is characterized in that when the number of users registered for a specific tenant-specific application for a specific tenant multiplied by the amount of resources expected to be consumed when one user uses the specific tenant-specific application exceeds the current amount of resources for the specific tenant-specific application for the specific tenant, the server resource management unit provisions an additional specific amount of resources for the specific tenant-specific application for the specific tenant.

[0007] With this configuration, the tenant management system of the present invention provisions a specific amount of additional resources for the tenant-specific application for a specific tenant when the number of users registered for the specific tenant-specific application for a specific tenant multiplied by the amount of resources expected to be consumed when one user uses the tenant-specific application exceeds the current amount of resources for the tenant-specific application for the tenant.This makes it possible to automatically provision additional resources when resources are insufficient, thereby improving the likelihood that the tenant-specific application will operate properly.

[0008] The tenant management system of the present invention includes a tenant management unit that manages subdomains as identification information for the tenant, and when a user inquires about the server name of the tenant using an FQDN, the application management unit may call the tenant-specific application for the tenant identified by the subdomain in this FQDN.

[0009] With this configuration, when a user inquires about a tenant's server name using an FQDN, the tenant management system of the present invention calls a tenant-specific application for the tenant identified by the subdomain in this FQDN, making it easier for the user to specify a tenant. [Effects of the Invention]

[0010] The tenant management system of the present invention can improve the likelihood that tenant-specific applications will operate properly. [Brief explanation of the drawings]

[0011] [Figure 1] 1 is an explanatory diagram of tenants managed by a tenant management system according to an embodiment of the present invention; [Figure 2] FIG. 2 is a block diagram illustrating a software configuration of a tenant management system according to an embodiment of the present invention. [Figure 3] FIG. 3 is a block diagram of a hardware configuration of the tenant management system shown in FIG. 2. [Figure 4] FIG. 3 is a diagram illustrating an example of a management table illustrated in FIG. 2. [Figure 5] 3 is a diagram showing an example of an APL management master table shown in FIG. 2. FIG. [Figure 6] 6 is a flowchart showing an example of a method for calculating the consumed resource unit shown in FIG. 5. [Figure 7] 3 is a flowchart of the operation of the tenant management system shown in FIG. 2 when a tenant is registered. [Figure 8] 8 is a diagram showing an example of a management screen displayed on a display unit of an administrator computer in the operation shown in FIG. 7. FIG. [Figure 9] 10 is a flowchart of the operation of the tenant management system shown in FIG. 2 when a new tenant-specific application is registered for a tenant. [Figure 10]10 is a flowchart of the operation of the tenant management system shown in FIG. 2 when a user is newly registered for a specific tenant-specific application for a tenant. [Figure 11] 3 is a sequence diagram of the operation of the tenant management system shown in FIG. 2 when a user uses a tenant-specific application. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[0013] First, the configuration of a tenant management system according to an embodiment of the present invention will be described.

[0014] FIG. 1 is an explanatory diagram of tenants managed by a tenant management system according to the present embodiment.

[0015] 1, a solution 12 is built on a public cloud 11. Here, as the solution 12, for example, a document management solution that manages documents can be adopted.

[0016] The provider of the solution 12 can rent at least a part of the solution 12 to others. A unit to which the provider of the solution 12 rents at least a part of the solution 12 is called a tenant. The solution 12 can have multiple tenants, such as tenant 13.

[0017] Tenant 13 can have multiple users, such as user 14. The configurations of tenants other than tenant 13 are similar to that of tenant 13.

[0018] FIG. 2 is a block diagram of the software configuration of the tenant management system 20 according to this embodiment.

[0019] 2, the tenant management system 20 includes, in the public cloud 11 (see FIG. 1), an external access point 21 which is an accessible endpoint published outside the public cloud 11, such as outside a data center; an external load balancer 22 which is a service that maintains connections from outside via HTTP (Hypertext Transfer Protocol) / HTTPS (Hypertext Transfer Protocol Secure) and realizes a load balancing function for a web server described later; a connection request receiving unit 23 which is a service that receives connection requests from the external load balancer 22; a request processing unit 24 which is a service that processes external requests including authentication; an application management unit 25 which is a service that causes requests from users to arrive at a tenant-specific application described later; tenant-specific applications 26 which are applications prepared for each tenant; a tenant management unit 27 which manages various types of information about tenants; a server resource management unit 28 which is a service that provisions new cloud resources when web server resources are insufficient; a database service 29 which stores data tables necessary for managing tenants; and a DNS (Domain Name Server) which is a service that registers the FQDN (Fully Qualified Domain Name) of the external access point 21. The tenant management system 20 includes a tenant-specific application 26 and a tenant-specific application service 30. In addition to the tenant-specific application 26, the tenant management system 20 can also include at least one other tenant-specific application.

[0020] A plurality of tenant-specific applications can be prepared for each tenant. As tenant-specific applications, various applications such as a document management application, a schedule book application, and a chat tool can be adopted.

[0021] The database service 29 stores a management table 29a for managing tenants and an APL management master table 29b for managing applications for each tenant as data tables required for managing tenants.

[0022] FIG. 3 is a block diagram of the hardware configuration of the tenant management system 20. As shown in FIG.

[0023] 3, the tenant management system 20 includes an external access point system 41 for implementing the external access point 21, an external load balancer system 42 for implementing the external load balancer 22, a group of web servers 43, a database service system 44 for implementing the database service 29, and a DNS service system 45 for implementing the DNS service 30. The external access point system 41, the external load balancer system 42, the web servers, the database service system 44, and the DNS service system 45 can communicate with each other via a network 46 such as the Internet.

[0024] The external access point system 41, the external load balancer system 42, the database service system 44, and the DNS service system 45 are each realized by at least one computer.

[0025] The group 43 of web servers implements the connection request reception unit 23, the request processing unit 24, the application management unit 25, the tenant-specific application 26, the tenant management unit 27, and the server resource management unit 28. At least one of the connection request reception unit 23, the request processing unit 24, the application management unit 25, the tenant-specific application 26, the tenant management unit 27, and the server resource management unit 28 may be implemented by a single web server or by multiple web servers. At least one web server in the group 43 may implement at least two of the connection request reception unit 23, the request processing unit 24, the application management unit 25, the tenant-specific application 26, the tenant management unit 27, and the server resource management unit 28.

[0026] FIG. 4 is a diagram showing an example of the management table 29a.

[0027] The management table 29a shown in FIG. 4 stores a combination of a user's address, a user's last name, a user's first name, a user's email address, an APID as identification information for a tenant-specific application, a subdomain as identification information for the tenant, a user ID as identification information for the user, and a user's password.

[0028] FIG. 5 is a diagram showing an example of the APL management master table 29b.

[0029] The APL management master table 29b shown in Figure 5 stores, for each tenant-specific application, a combination of an AP name, which is the name of the tenant-specific application, an APID, a resource consumption unit indicating the amount of resources expected to be consumed when one user uses the tenant-specific application, and a required resource consumption limit, which is the upper limit of the amount of resources that guarantees that the same tenant-specific application can be used simultaneously.

[0030] For example, when the resources of a web server that realizes a tenant-specific application are the CPU, memory, storage, and network bandwidth of a virtual machine that realizes the tenant-specific application, the resource consumption unit may be calculated as shown in FIG.

[0031] FIG. 6 is a flowchart showing an example of a method for calculating the resource consumption unit shown in FIG.

[0032] As shown in FIG. 6, when one user uses a tenant-specific application for which the unit of consumed resources is to be calculated, the utilization rates of the CPU, memory, storage, and network bandwidth of the virtual machine are measured (S101).

[0033] Then, the total of the four utilization rates measured in S101 is normalized using the formula shown in Equation 1 with a maximum value of 100 and a minimum value of 0 to calculate the consumed resource units (S102).

number

[0034] In the formula 1, X represents the sum of the four utilization rates measured in S101. Y represents the consumed resource unit, which is the value obtained by dividing X by 4 and rounding up the decimal point.

[0035] For example, if the utilization rates of the CPU, memory, storage, and network bandwidth of a virtual machine when one user uses a tenant-specific application that is the subject of the calculation of the consumed resource units are, for example, 40%, 50%, 30%, and 50%, respectively, the total of these is 170%, so the consumed resource units are 43%.

[0036] The required consumed resources may be calculated, for example, by multiplying the consumed resource unit of the target tenant-specific application by the number of users who are guaranteed to be able to use the target tenant-specific application simultaneously.

[0037] Next, the operation of the tenant management system 20 will be described.

[0038] First, the operation of the tenant management system 20 when registering a tenant will be described.

[0039] FIG. 7 is a flowchart showing the operation of the tenant management system 20 when registering a tenant.

[0040] When an administrator of the tenant management system 20 wishes to register a new tenant, the administrator can send an instruction to start tenant registration to the tenant management unit 27 via a computer (not shown) (hereinafter referred to as the "administrator computer"). The administrator computer can be realized by a computer such as a PC (Personal Computer). When the administrator of the tenant management system 20 receives the instruction to start tenant registration, the tenant management unit 27 starts the operation shown in FIG. 7.

[0041] As shown in Fig. 7, the tenant management unit 27 transmits display data for a management screen 60 (see Fig. 8) for registering a tenant to the administrator computer, thereby causing the administrator computer to display the management screen 60 (S121). When the administrator computer receives the display data for the management screen 60, it displays the management screen 60 corresponding to the received data on a display unit (not shown) of the administrator computer itself. Therefore, the administrator can check the management screen 60 displayed on the display unit of the administrator computer, and can also operate the management screen 60 via an operation unit (not shown) of the administrator computer.

[0042] FIG. 8 is a diagram showing an example of a management screen 60 displayed on the display unit of the administrator computer.

[0043] As shown in FIG. 8, the management screen 60 includes a text box 61 for entering the user's address, a text box 62a for entering the user's last name, a text box 62b for entering the user's first name, a text box 63 for entering the user's email address, a text box 64 for entering the APID, a text box 65 for entering the subdomain, a text box 66 for entering the user ID, a text box 67 for entering the user's password, a cancel button 68 for canceling the tenant registration, and a register button 69 for registering the tenant.

[0044] The administrator can input values ​​into text boxes 61, 62a, 62b, 63, 64, 65, 66, and 67 via the operation unit of the administrator computer. Note that only one of the APIDs stored in the APL management master table 29b can be input into text box 64.

[0045] The administrator can press a cancel button 68 and a registration button 69 via the operation unit of the administrator computer.

[0046] As shown in FIG. 7, after the process of S121, the tenant management unit 27 determines whether or not the cancel button 68 has been pressed (S122).

[0047] If the tenant management unit 27 determines in S122 that the cancel button 68 has been pressed, it causes the administrator computer to end the display of the management screen 60 (S123), and ends the operation shown in FIG.

[0048] If the tenant management unit 27 determines in S122 that the cancel button 68 has not been pressed, it determines whether the register button 69 has been pressed (S124).

[0049] If the tenant management unit 27 determines in S124 that the registration button 69 has not been pressed, it executes the process of S122.

[0050] If the tenant management unit 27 determines in S124 that the registration button 69 has been pressed, it causes the administrator computer to end the display of the management screen 60 (S125).

[0051] Next, the tenant management unit 27 determines whether the subdomain input in the text box 65 at the time the registration button 69 was pressed is stored in the management table 29a (S126).

[0052] If the tenant management unit 27 determines in S126 that the subdomain entered in the text box 65 at the time the register button 69 was pressed is stored in the management table 29a, it causes the administrator computer to display the error screen by sending data for displaying an error screen (not shown) to the administrator computer (S127), and ends the operation shown in FIG. 7. When the administrator computer receives the data for displaying the error screen, it displays an error screen corresponding to the received data on the display unit of the administrator computer itself. Therefore, the administrator can check the error screen displayed on the display unit of the administrator computer.

[0053] If the tenant management unit 27 determines in S126 that the subdomain input in the text box 65 at the time the register button 69 was pressed is not stored in the management table 29a, the tenant management unit 27 registers in the management table 29a the value input in the management screen 60 at the time the register button 69 was pressed (S128). That is, the tenant management unit 27 registers in the management table 29a a combination of the address input in the text box 61 at the time the register button 69 was pressed, the last name input in the text box 62a at the time the register button 69 was pressed, the first name input in the text box 62b at the time the register button 69 was pressed, the email address input in the text box 63 at the time the register button 69 was pressed, the APID input in the text box 64 at the time the register button 69 was pressed, the subdomain input in the text box 65 at the time the register button 69 was pressed, the user ID input in the text box 66 at the time the register button 69 was pressed, and the password input in the text box 67 at the time the register button 69 was pressed.

[0054] After the processing of S128, the server resource management unit 28 provisions specific resources, that is, the required consumption resources associated in the APL management master table 29b with the APID registered in the management table 29a in S128, as resources for the tenant-specific application specified by this APID for the tenant registered in the management table 29a in S128 (S129). Note that the types of resources to be provisioned and the amount of each type are determined in advance for each tenant-specific application.

[0055] After the process of S129, the server resource management unit 28 ends the operation shown in FIG.

[0056] Next, the operation of the tenant management system 20 when a new tenant-specific application is registered for a tenant will be described.

[0057] FIG. 9 is a flowchart of the operation of the tenant management system 20 when a new tenant-specific application is registered for a tenant.

[0058] When the administrator wishes to newly register a specific tenant-specific application (hereinafter referred to as the "target tenant-specific application" in the description of the operations shown in FIG. 9 ) for a specific tenant (hereinafter referred to as the "target tenant-specific application" in the description of the operations shown in FIG. 9 ), the administrator can send an instruction to start new registration of the target tenant-specific application for the target tenant to the tenant management unit 27 via the administrator computer. Here, when newly registering the target tenant-specific application for the target tenant, the address, last name, first name, email address, user ID, and password of any one target user of the target tenant-specific application for the target tenant are also specified. When the tenant management unit 27 receives the instruction to start new registration of the target tenant-specific application for the target tenant, it starts the operations shown in FIG. 9 .

[0059] 9, the tenant management unit 27 executes a specific operation to newly register a target tenant-specific application for the target tenant in the management table 29a (S141). Here, the tenant management unit 27 registers in the management table 29a a combination of the APID of the target tenant-specific application, the address, surname, first name, email address, user ID, and password of the specified user, and the subdomain of the target tenant.

[0060] After the process of S141, the server resource management unit 28 provisions specific resources, corresponding to the required consumption resources associated with the APID of the target tenant-specific application in the APL management master table 29b, as resources for the target tenant-specific application for the target tenant (S142). Note that the types of resources to be provisioned and the amount of each type are determined in advance for each tenant-specific application.

[0061] After the process of S142, the server resource manager 28 ends the operation shown in FIG.

[0062] Next, the operation of the tenant management system 20 when a user is newly registered for a specific tenant-specific application for a tenant will be described.

[0063] FIG. 10 is a flowchart of the operation of the tenant management system 20 when a user is newly registered for a specific tenant-specific application for a tenant.

[0064] When the administrator wishes to newly register a user for a specific tenant-specific application (hereinafter referred to as the "target tenant-specific application" in the description of the operation shown in FIG. 10) for a specific tenant (hereinafter referred to as the "target tenant-specific application" in the description of the operation shown in FIG. 10), the administrator can send an instruction to start new registration of a user for the target tenant-specific application for the target tenant to the tenant management unit 27 via the administrator computer. When the tenant management unit 27 receives the instruction to start new registration of a user for the target tenant-specific application for the target tenant, it starts the operation shown in FIG. 10.

[0065] 10, the tenant management unit 27 executes a specific operation to newly register a user designated by the administrator for a target tenant-specific application for the target tenant in the management table 29a (S161). Here, the tenant management unit 27 registers in the management table 29a a combination of the address, surname, first name, email address, user ID, and password of the new user, the subdomain of the target tenant, and the APID of the target tenant-specific application.

[0066] After the process of S161, the server resource management unit 28 acquires the number of users registered in the management table 29a for the target tenant-specific application for the target tenant (S162).

[0067] Next, the server resource management unit 28 acquires the consumed resource unit associated with the APID of the target per-tenant application in the APL management master table 29b (S163).

[0068] Next, the server resource management unit 28 determines whether the value obtained by multiplying the consumption resource unit acquired in S163 by the number of people acquired in S162 exceeds the current amount of resources of the target tenant-specific application for the target tenant (S164).

[0069] When the server resource management unit 28 determines in S164 that the value obtained by multiplying the consumed resource unit acquired in S163 by the number of people acquired in S162 exceeds the current amount of resources of the target tenant-specific application for the target tenant, the server resource management unit 28 additionally provisions a specific amount of specific resources as resources for the target tenant-specific application for the target tenant (S165). Note that the amount of resources to be provisioned may be, for example, the amount obtained by multiplying the consumed resource unit acquired in S163 by the number of people acquired in S162 minus the current amount of resources of the target tenant-specific application for the target tenant. Furthermore, the types of resources to be provisioned and the amount of each type may be determined in advance for each tenant-specific application.

[0070] The server resource management unit 28 terminates the operation shown in FIG. 10 when it determines in S164 that the value obtained by multiplying the consumed resource unit acquired in S163 by the number of people acquired in S162 does not exceed the current amount of resources of the target tenant-specific application for the target tenant, or when the processing of S165 is completed.

[0071] Next, the operation of the tenant management system 20 when a tenant-specific application is used by a user will be described.

[0072] FIG. 11 is a sequence diagram of the operation of the tenant management system 20 when a user uses a tenant-specific application.

[0073] When a user desires to use a tenant-specific application, the user can instruct a computer (not shown) (hereinafter referred to as a "client") to use the tenant-specific application. The client can be realized by a computer such as a PC, for example.

[0074] Hereinafter, the service name, i.e., the name of the solution 12, is assumed to be "service.com." The domain name of the external access point 21 is assumed to be "cloud.app." The subdomain of the tenant (hereinafter referred to as the "target tenant" in the description of the operation shown in FIG. 11) that realizes the tenant-specific application that the user wishes to use (hereinafter referred to as the "target tenant-specific application" in the description of the operation shown in FIG. 11) is assumed to be "aap1."

[0075] When the client is instructed to use a tenant-specific application, the client queries the DNS service 30 for the server name of the target tenant using the FQDN, i.e., "aap1.service.com," as shown in FIG. 11 (S181). Here, the DNS service 30 has registered as its server name a wildcard including the external access point 21, i.e., "*.cloud.app." If the subdomain is, for example, "XX," the DNS service 30 responds with "XX.cloud.app" in response to a query including "XX.service.com." Therefore, the DNS service 30 responds with "aap1.cloud.app" in response to a query including "aap1.service.com."

[0076] After the process of S181, when the server name of the target tenant is returned from the DNS service 30, the client connects to the external access point 21 using the server name returned from the DNS service 30, that is, "aap1.cloud.app" (S182).

[0077] After the process of S182, when the client is connected to the external access point 21, the client transmits an HTTP / HTTPS connection request to the external access point 21 (S183).

[0078] When the external access point 21 receives the HTTP / HTTPS connection request sent from the client in S183, it transfers the received HTTP / HTTPS connection request to the external load balancer 22 (S184).

[0079] When the external load balancer 22 receives the HTTP / HTTPS connection request transferred from the external access point 21 in S184, it establishes an HTTP / HTTPS connection with the client and transfers the connection request received from the external access point 21 to the connection request receiving unit 23 (S185). Note that the external load balancer 22 terminates SSL (Secure Sockets Layer) in the case of an HTTPS connection.

[0080] When the connection request receiving unit 23 receives the connection request transferred from the external load balancer 22 in S185, it transfers the request received from the external access point 21 to the request processing unit 24 (S186).

[0081] When the request processing unit 24 receives the request transferred from the connection request receiving unit 23 in S186, it processes an authentication request with the client based on the combination of the user ID and password included in the request received from the connection request receiving unit 23, and also acquires the subdomain included in the request received from the connection request receiving unit 23 and calls the application management unit 25 (S187). Here, the request received from the connection request receiving unit 23 indicates the subdomain in the HOST field of the HTTP REQUEST header, for example.

[0082] When the application management unit 25 is called by the request processing unit 24 in S187, it calls the tenant-specific application specified in the request from the client from among the tenant-specific applications associated in the management table 29a with the subdomain acquired by the request processing unit 24 and the user ID of the user who has been successfully authenticated by the request processing unit 24 (S188). Therefore, the tenant-specific application specified in the request from the client executes an operation in accordance with the request from the client.

[0083] As described above, if the value obtained by multiplying the number of users registered for a specific tenant-specific application for a specific tenant by the resource consumption unit of this tenant-specific application exceeds the current amount of resources for this tenant-specific application for this tenant (YES in S164), the tenant management system 20 provisions a specific amount of additional resources for this tenant-specific application for this tenant (S165).This makes it possible to automatically provision additional resources when resources are insufficient, thereby improving the likelihood that the tenant-specific application will operate properly.

[0084] When a user inquires about a tenant's server name using an FQDN (S181), the tenant management system 20 calls a tenant-specific application for the tenant identified by the subdomain in this FQDN (S188), thereby making it easier for the user to specify a tenant. [Explanation of symbols]

[0085] 11 Public Cloud 12 Solutions 13 Tenants 14 users 20 Tenant Management System 25 Application Management Department 26 Tenant-specific applications 27 Tenant Management Department 28 Server Resource Management Department 43 web servers

Claims

1. an application management unit that receives requests from users to tenant-specific applications, which are applications prepared for each tenant in a solution built on a public cloud; a server resource management unit that provisions resources of a web server that realizes the tenant-specific application; Equipped with the server resource management unit additionally provisions a specific amount of resources for the specific tenant-specific application for the specific tenant when a value obtained by multiplying the number of users registered for the specific tenant-specific application for the specific tenant by a consumption resource unit indicating the amount of resources expected to be consumed when one user uses the specific tenant-specific application for the specific tenant exceeds the current amount of resources for the specific tenant-specific application for the specific tenant; A tenant management system characterized in that the consumed resource unit is calculated by dividing the sum of the usage rates of each resource type when one user uses the specific tenant-specific application by the number of resource types.

2. a tenant management unit that manages a subdomain as the tenant identification information; 2. The tenant management system according to claim 1, wherein when a user inquires about the server name of the tenant using an FQDN, the application management unit invokes the tenant-specific application for the tenant identified by the subdomain in the FQDN.

Images