WO2023231681A1 - 账号创建方法、物联网多租户系统、设备、程序和介质 - Google Patents

账号创建方法、物联网多租户系统、设备、程序和介质 Download PDF

Info

Publication number
WO2023231681A1
WO2023231681A1 PCT/CN2023/091803 CN2023091803W WO2023231681A1 WO 2023231681 A1 WO2023231681 A1 WO 2023231681A1 CN 2023091803 W CN2023091803 W CN 2023091803W WO 2023231681 A1 WO2023231681 A1 WO 2023231681A1
Authority
WO
WIPO (PCT)
Prior art keywords
account
database
business
identifier
key
Prior art date
Application number
PCT/CN2023/091803
Other languages
English (en)
French (fr)
Inventor
王怀亮
李涛
杜洪军
于洪达
郑海涛
李世野
纪高
李国旗
Original Assignee
京东方科技集团股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 京东方科技集团股份有限公司 filed Critical 京东方科技集团股份有限公司
Publication of WO2023231681A1 publication Critical patent/WO2023231681A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/22—Indexing; Data structures therefor; Storage structures
    • G06F16/2291—User-Defined Types; Storage management thereof
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • G06Q30/06—Buying, selling or leasing transactions
    • G06Q30/0645—Rental transactions; Leasing transactions
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q50/00—Information and communication technology [ICT] specially adapted for implementation of business processes of specific business sectors, e.g. utilities or tourism
    • G06Q50/10—Services
    • G06Q50/16—Real estate
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks

Definitions

  • the present disclosure belongs to the technical field of the Internet of Things, and particularly relates to an account creation method, an Internet of Things multi-tenant system, equipment, programs and media.
  • tenant-related information general formula uses static files to store the configuration data of multiple tenant database databases, the additional configuration information will cause service restart problems.
  • the present disclosure provides an account creation method, an Internet of Things multi-tenant system, equipment, programs and media.
  • Some embodiments of the present disclosure provide an account creation method, which is applied to an Internet of Things multi-tenant platform.
  • the method includes:
  • Receive an account creation request which at least includes: an account identifier and a database instance identifier;
  • an account creation success notification corresponding to the account identifier is output.
  • the account creation request also includes: a business identifier associated with the account identifier;
  • the outputting of a successful account creation notification corresponding to the account identifier includes:
  • the method further includes:
  • the method further includes:
  • the method further includes:
  • connection pool configuration parameters based on the connection pool operating parameters
  • connection pool adjustment notification is used to instruct the business server to perform at least one of the following connection pool configuration parameter methods:
  • the method further includes:
  • the account ID and the database instance ID are associated and stored in a main database, and the main database is used to store tenant information related to the account.
  • the method further includes:
  • the business table is used to record the user information corresponding to the account identifier, and to be queried by the object described by the permission information.
  • the method also includes:
  • a service registration request sent by the account where the service registration request at least includes: a business identifier and an account identifier;
  • the account key and the business key are sent to the business server corresponding to the business identifier to complete the service registration process of the account.
  • the account key and the business key are used to register the account. Identity is verified.
  • Some embodiments of the present disclosure provide an Internet of Things multi-tenant system, which includes: an Internet of Things device, a business server, and a database server;
  • the Internet of Things device is configured to send an account creation request to the database server in response to user input, where the account creation request includes: an account identification, a database instance identification, and a business identification;
  • the database server is configured to create a target tenant database corresponding to the account ID in the database server based on the database instance corresponding to the database instance ID, wherein the database instance is an existing tenant in the database server A database instance corresponding to the database; after the creation of the target tenant database is completed, sending a database creation success notification corresponding to the account ID to the Internet of Things device and the business server;
  • the business server is configured to create a data source corresponding to the account identification according to the database creation success notification, and send the data source identification of the data source to the Internet of Things device;
  • the Internet of Things device is configured to establish a mapping relationship between the data source corresponding to the data source identifier and the account identifier, so as to establish a connection pool between the target tenant database and the data source.
  • the Internet of Things device is also configured to obtain the connection pool operating parameters; adjust the connection pool configuration parameters based on the connection pool operating parameters; and send the connection pool configuration parameters to the business server.
  • the connection pool adjustment notification; the business server performs at least one of the following connection pool configuration parameter methods according to the business server:
  • the Internet of Things device is also configured to generate an account key and a business key corresponding to the account ID; and send the account key and business key to the business corresponding to the business ID.
  • the server completes the service registration process of the account, and the account key and the business key are used to verify the identity of the account;
  • the service server is further configured to associate and store the account key and the service key.
  • the Internet of Things device is further configured to, in response to user input, generate a first account signature based on the account key and the business key; and send a first account signature carrying the account key to the business server. and a service acquisition request signed by the second account;
  • the business server is also configured to query the business key associated with the account key, and generate a second account signature based on the business key and the account key; in the first account signature When the comparison with the second account signature is successful, business service information is sent to the Internet of Things device.
  • the Internet of Things device is further configured to send an account verification request carrying the account identification to the business server in response to the received device information query operation;
  • the business server is also configured to, in response to the account verification request, query the account information corresponding to the account identifier from the database server; after the account information is verified, send the request to the Internet of Things device.
  • the Internet of Things device is further configured to, in response to the authentication pass message, obtain device information from the database server that matches the account authority identified by the account; and display the device information.
  • Some embodiments of the present disclosure provide an account creation device, which is applied to an Internet of Things multi-tenant platform.
  • the device includes:
  • the tenant management module is configured to receive an account creation request, where the account creation request at least includes: an account identifier and a database instance identifier;
  • the data isolation module is configured to create a target tenant database corresponding to the account ID in the database server according to the database instance corresponding to the database instance ID, wherein the database instance is an existing tenant database in the database server.
  • the tenant management module is further configured to output a successful account creation notification corresponding to the account identifier after the creation of the target tenant database is completed.
  • the account creation request also includes: a business identifier associated with the account identifier;
  • the data isolation module is also configured to:
  • the data isolation module is also configured to:
  • the device further includes: a monitoring operation and maintenance module configured as:
  • connection pool configuration parameters based on the connection pool operating parameters
  • connection pool adjustment notification is used to instruct the business server to perform at least one of the following connection pool configuration parameter methods:
  • the tenant management module is also configured to:
  • the account ID and the database instance ID are associated and stored in a main database, and the main database is used to store tenant information related to the account.
  • the data isolation module is also configured to:
  • the business table is used to record the user information corresponding to the account identifier, and to be queried by the object described by the permission information.
  • the device further includes: an application management module configured to:
  • a service registration request sent by the account where the service registration request at least includes: a business identifier and an account identifier;
  • the account key and the business key are sent to the business server corresponding to the business identifier to complete the service registration process of the account.
  • the account key and the business key are used to register the account. Identity is verified.
  • the device also includes:
  • the authentication center module is configured to perform authority verification on tenant information, user information and application information in the Internet of Things multi-tenant platform.
  • Some embodiments of the present disclosure provide a computing processing device, including:
  • a memory having computer readable code stored therein;
  • One or more processors when the computer readable code is executed by the one or more processors, the computing processing device executes the account creation method as described above.
  • Some embodiments of the present disclosure provide a computer program, including computer readable code.
  • the computer readable code When the computer readable code is run on a computing processing device, it causes the computing processing device to execute the account creation method as described above.
  • Some embodiments of the present disclosure provide a non-transitory computer-readable medium in which the account creation method as described above is stored.
  • Figure 1 schematically shows a flow chart of an account creation method provided by some embodiments of the present disclosure
  • Figure 2 schematically shows one of the logical diagrams of another account creation method provided by some embodiments of the present disclosure
  • Figure 3 schematically shows one of the flow diagrams of another account creation method provided by some embodiments of the present disclosure
  • Figure 4 schematically shows the second logical diagram of another account creation method provided by some embodiments of the present disclosure
  • Figure 5 schematically shows the second flow diagram of another account creation method provided by some embodiments of the present disclosure
  • Figure 6 schematically shows the third flowchart of another account creation method provided by some embodiments of the present disclosure.
  • Figure 7 schematically shows the third logical diagram of another account creation method provided by some embodiments of the present disclosure.
  • Figure 8 schematically shows the fourth flowchart of another account creation method provided by some embodiments of the present disclosure.
  • Figure 9 schematically shows the fifth flowchart of another account creation method provided by some embodiments of the present disclosure.
  • Figure 10 schematically shows a logic diagram of a rights management method provided by some embodiments of the present disclosure
  • Figure 11 schematically shows the fourth logical diagram of another account creation method provided by some embodiments of the present disclosure.
  • Figure 12 schematically shows a flow chart of a device information query method provided by some embodiments of the present disclosure
  • Figure 13 schematically shows a logic diagram of a permission authentication method provided by some embodiments of the present disclosure
  • Figure 14 schematically shows a structural diagram of an IoT multi-tenant system provided by some embodiments of the present disclosure
  • Figure 15 schematically shows an architectural diagram of an IoT multi-tenant system provided by some embodiments of the present disclosure
  • Figure 16 schematically shows a structural diagram of an account creation device provided by some embodiments of the present disclosure
  • Figure 17 schematically illustrates a block diagram of a computing processing device for performing methods according to some embodiments of the present disclosure
  • Figure 18 schematically illustrates a storage unit for holding or carrying program code implementing methods according to some embodiments of the present disclosure.
  • Figure 1 schematically shows a flow chart of an account creation method provided by the present disclosure, which is applied to an Internet of Things multi-tenant platform.
  • the method includes:
  • Step 101 Receive an account creation request.
  • the account creation request includes at least: an account identifier and a database instance identifier.
  • the execution subject of this disclosure is an Internet of Things device, which can be an indirect connected device without IP capabilities. It can be included in the SDK (Software Development Kit) by integrating multi-tenant devices on the gateway.
  • the tenant's terminal device can be connected to the gateway as a sub-device and quickly access the IoT platform through the gateway.
  • the gateway completes data forwarding between the terminal device and the platform.
  • IoT devices can also be hardware devices with strong computing and storage capabilities and IP capabilities.
  • Multi-tenant devices can be directly integrated into the device to access the SDK through HTTPS (Hyper Text Transfer Protocol over SecureSocket Layer, Hypertext Transfer Protocol) , MQTTS (Message Queuing Telemetry Transport, Message Queuing Telemetry Transport) or COAP (Constrained Application Protocol) and other transmission protocols can quickly connect to the Internet of Things platform.
  • HTTPS Hyper Text Transfer Protocol over SecureSocket Layer, Hypertext Transfer Protocol
  • MQTTS Message Queuing Telemetry Transport, Message Queuing Telemetry Transport
  • COAP Constrained Application Protocol
  • the database server is a server used to provide tenant data sources for IoT devices. By setting data sources for terminal devices in the database, it is conducive to unified management of tenant user data and provides a way to isolate and share user data according to permissions. foundation, and centralized management of data sources can also ensure the security of user data.
  • the database instance type includes but is not limited to exclusive database type and shared database type.
  • the exclusive database type represents the type of database used by a single tenant alone, and the shared database type represents the database that can be used jointly by multiple tenants.
  • the type can be set according to actual needs and is not limited here.
  • the account ID is a unique ID used to identify a user. It can be composed of an account name and a user ID.
  • the account name can be set by the user, and can be the user's name or nickname.
  • the user ID is a unique ID generated by the system for the tenant. Therefore, the account ID composed of the account name and the user ID can be used by the user to identify the account name, and can also enable the system to identify the user based on the user ID.
  • the system administrator when creating a tenant's account, can log in to the IoT multi-tenant platform through the terminal device used to access the IoT device. After logging in, the system administrator can view the tenant management Query tenant information in the list.
  • the list content can include account ID, Database instance type, list creation time, modification time, query and modification operation controls, etc.
  • Step 102 Create a target tenant database corresponding to the account ID in the database server according to the database instance corresponding to the database instance ID, wherein the database instance is a database corresponding to an existing tenant database in the database server.
  • the database instance is a database corresponding to an existing tenant database in the database server.
  • the database instance is the database configuration parameter required to build the database.
  • the system administrator can query the database instance ID, database instance name and other database instance information of the corresponding database instance by selecting the required database instance ID.
  • the source of the database instance in this disclosure is the existing tenant database that has been built historically in the database server, that is, the database instance corresponding to the existing tenant database. Therefore, there is no need to re-enter the database instance into the database server and restart it. server to configure the database instance for the target tenant database you want to build.
  • the database instance identifiers of different existing tenant databases can be stored on the IoT device for direct query and use by the system administrator, or they can exist on an external storage device connected to the IoT device.
  • the database instance identifiers are included.
  • the database instance table of database instance-related information such as database instance description information and other information can be stored in the main database of the database server, and can be viewed and edited from the main database when the system administrator creates an account through the Internet of Things device.
  • the system administrator can access the multi-tenant management platform through a browser and enter a database instance editing request to add, delete, modify, and check the database instance.
  • the system management manager can edit the database instance by inputting the database instance name, database instance service address, database instance port number, database instance associated account, and account password that need to be edited.
  • the IoT device passes the verification of the account and account password associated with the database instance, it can edit the database instance based on the entered database instance name, database instance service address, and database instance port number. If the entered database instance name does not exist, it can Create a database instance based on the database instance name, database instance service address, and database instance port number. If it exists, edit it directly.
  • the Internet of Things device responds to the system administrator's database instance identification selection operation and sends a database creation request carrying the database instance identification to the connected database server, and the database server queries the corresponding database instance identification. database instance, and create a target tenant database corresponding to the account ID based on the queried database instance.
  • Step 103 After the creation of the target tenant database is completed, output a successful account creation notification corresponding to the account identifier.
  • the database server sends an account creation success notification corresponding to the account identification to the IoT device, and the IoT device displays the account creation notification to inform the system administrator of the account creation
  • the target tenant database corresponding to the ID has been created.
  • the tenant information and account information corresponding to the account ID can be stored in the target tenant database for use.
  • This disclosed embodiment presets multiple different types of database instances for users to create accounts when creating accounts, avoiding the problem of static files storing database configuration data and restarting the device when adding new configurations, and improving the efficiency of account creation. , reducing operation and maintenance costs.
  • step 103 includes:
  • Step 1031 Send an account creation success notification corresponding to the account ID to the business server corresponding to the service ID.
  • the IoT multi-tenant platform notifies other services in real time through event-driven message notification after creating a database for tenants.
  • Step 1032 Receive the data source identifier sent by the business server according to the account creation success notification.
  • the business server after listening to the tenant's account creation notification, the business server automatically creates an independent data source locally for the tenant corresponding to the account, and sends the data source identification to the Internet of Things device.
  • Step 1033 Establish a mapping relationship between the data source corresponding to the data source identifier and the account identifier.
  • the data source is used to provide business service data to the account.
  • the Internet of Things device is adapted to the data source identifier provided by the business server to associate and store the data source corresponding to the data source identifier and the account identifier.
  • Step 1034 Establish a connection pool between the target tenant database and the data source.
  • the Internet of Things device interacts with the database server to establish a connection pool between the target tenant database corresponding to the account identifier and the data source of the business server.
  • Step 1035 Obtain the connection pool operating parameters.
  • Step 1036 Adjust the connection pool configuration parameters based on the connection pool operating parameters.
  • Step 1037 Send a connection pool adjustment notification carrying the connection pool configuration parameters to the service server.
  • the Internet of Things device can monitor the usage of the connection pool through the gateway in real time to obtain the connection pool operating parameters, so as to dynamically adjust the policy based on the preset connection pool. Adjust the configuration parameters of the connection pool. Specifically, the IoT device can calculate the adjusted connection pool configuration parameters through the connection pool dynamic adjustment strategy, and then interact with the business server to adjust the connection number, maximum number of connections, minimum number of connections and other configuration parameters of the connection pool.
  • This disclosed embodiment is based on the Internet of Things technology scenario and adopts a microservice architecture as a whole to support multi-service coordination and dynamic creation of data sources in a distributed deployment environment.
  • the tenant service creates the tenant database, it notifies other services in real time through event-driven message notification.
  • the service creates a data source for the tenant.
  • the data source is initialized, it can immediately provide data query services to the tenant, which improves the flexibility of the multi-tenant IoT system.
  • connection pool adjustment notification is used to instruct the business server to perform at least one of the following connection pool configuration parameter methods:
  • connection pool adjustment notification is used to instruct the business server to perform at least one of the following connection pool configuration parameter methods:
  • Connection pool configuration parameter mode 1 when the number of connections is greater than the maximum number of connections, the number of connections exceeding the maximum number of connections is released;
  • Connection pool configuration parameter mode 2 when the number of idle connections is greater than the maximum number of idle connections, release the number of idle connections exceeding the maximum number of idle connections
  • Connection pool configuration parameter mode 3 when the number of idle connections is less than the minimum number of idle connections, create a number of connections lower than the minimum number of idle connections.
  • the connection data can be adjusted based on the load of the gateway device, that is, when the load is too large, the number of connections in the connection pool can be appropriately reduced, and conversely, when the load is small, the number of connections in the connection pool can be increased.
  • the maximum number of connections QPS / number of business server instance nodes * 80%.
  • the connection pool will create connections to supplement the number of this value, usually 5% of the maximum number of connections.
  • This disclosed embodiment supports multiple servers in the multi-tenant mode of the distributed environment IoT platform to dynamically adjust database connection pool parameters in real time (at the gateway layer, calculate the RPS (Request Per Second) of each tenant based on the identified tenants, which can The number of requests processed (equivalent to QPS) and the average response time, dynamically adjust the tenant connection pool parameters (mainly including the maximum number of connections, the maximum number of idle connections, and the minimum number of idle connections), and the gateway will pass the calculated database connection pool parameters through the message Notify other services, and other services adjust the connection pool parameters in real time according to the received parameters, avoiding resource waste caused by too many connections and resource queuing and competition caused by too few connections.
  • RPS Request Per Second
  • the method further includes: associating and storing the account ID and the database instance ID in a main database, where the main database is used to store account-related tenant information.
  • the master database is a database used to store tenant information in the database server.
  • the tenant information may include the tenant's account information, permission information, configuration information of the tenant database, etc. Therefore, when creating a new account, you need to
  • the received account ID and the database instance ID used in the built tenant database are stored in the main database for subsequent query and editing by the system administrator to facilitate unified editing of multiple tenants in the IoT multi-tenant platform.
  • the database instance ID of the created tenant database can also be used for subsequent account creation, which avoids the problem of restarting the device when adding new configurations when storing database configuration data in static files, improves the efficiency of account creation, and reduces operation and maintenance costs.
  • tenant information can be managed through the process shown in Figure 4;
  • the method further includes:
  • Step 104 Create a business table corresponding to the account ID in the target tenant database.
  • Step 105 Initialize the business information and authority information in the business table, where the business table is used to record the user information corresponding to the account identifier and provide query for the object described by the authority information.
  • the business table is used to store business information about the tenant's service usage corresponding to the account identification and the tenant's permission information.
  • the IoT device can instruct the database server to create a corresponding business table for the tenant in the target tenant database, and initialize the business information and permission information in it for subsequent users.
  • the service information and subsequent set permission information are stored in the business table. And the contents in the business table can only be viewed by tenants with query permissions, thus ensuring data isolation between tenants and ensuring information security.
  • This disclosed embodiment uses ORM (object Relational Mapping, object relational mapping) to dynamically create business tables for tenants after the tenant database is completed, avoiding manual parsing of database metadata and manual generation of table building SQL (Structured Query Language, structured Query language) scripts bring a lot of development work and risk of errors.
  • ORM object Relational Mapping, object relational mapping
  • the method further includes:
  • Step 301 Receive a service registration request sent by the account.
  • the service registration request at least includes: a business identifier and an account identifier.
  • Step 302 Generate an account key and a service key corresponding to the account identifier.
  • Step 303 Send the account key and the service key to the service server corresponding to the service identifier to complete the service registration process of the account.
  • the account key and the service key are used to register the service. Verify the identity of the above account.
  • the IoT platform generates the account key Access Key (AK) and business key Secret Key (SK) for the tenant.
  • the Access Key (AK) is automatically generated, globally unique, and associated with the tenant identification (32-bit UUID + tenant domain). ), cannot be modified;
  • Secret Key (SK) automatically generated, globally unique, cannot be modified. Verify the identity of the sender of a request by using the encryption method of Access Key Id/SecretAccess Key splicing.
  • Access Key Id (AK) is used to identify the user account.
  • Secret Access Key (SK) is the key used by the user to encrypt the authentication string and the cloud vendor to verify the authentication string.
  • the corresponding business key of each business server is Differently, the business key can be provided to the business party for device verification and must be kept confidential.
  • the system will use the same SK corresponding to the AK and the same authentication mechanism to generate an authentication string, and compare it with the authentication string included in the user's request. If the authentication strings are the same, the system considers that the user has the specified operation permissions and performs the relevant operations; if the authentication strings are different, the system ignores the operation and returns an error code.
  • the verification process of the request sent by the business server to the Internet of Things device is as follows:
  • Step 401 In response to user input, the Internet of Things device generates a first account signature based on the account key and the service key.
  • Step 402 The Internet of Things device sends a service acquisition request carrying the account key and the second account signature to the business server.
  • Step 403 The business server queries the business key associated with the account key, and generates a second account signature based on the business key and the account key.
  • Step 404 When the comparison between the first account signature and the second account signature is successful, the business server sends business service information to the Internet of Things device.
  • an Internet of Things device when an Internet of Things device requests IoTAPI (a functional interface used to construct service acquisition requests in an Internet of Things multi-tenant platform), it first constructs a request header, and then initiates requst; the appKey, timestamp timestamp, random number, The signature is added to the request header; where appKey is AK, timestamp is the current time, random is a random number, and signature is appKey+timestamp+random+SK generated using an algorithm; after the business server receives the request, it uses AK/SK for authentication; First, obtain the appKey, timestamp, random, and signature parameters from the request header, then identify the tenant based on the sent appKey, and search the database to obtain the corresponding secret_key;
  • IoTAPI a functional interface used to construct service acquisition requests in an Internet of Things multi-tenant platform
  • IoT uses the same algorithm to calculate the signature (signature) by combining appKey+timestamp+random+SK; compare the signature sent by the user and the signature calculated by the business server. If they are the same, the authentication passes, otherwise it fails.
  • This disclosure generates a business key and an account key for the account so that the external business server can verify the tenant's account, so that the tenant's account will not be directly exposed to the business server, and it can also enable the business server to verify the tenant's account.
  • the account is verified to ensure the security of the tenant account.
  • Step 501 In response to the received device information query operation, the Internet of Things device sends an account verification request carrying the account identifier to the business server.
  • Step 502 In response to the account verification request, the business server queries the account information corresponding to the account identifier from the database server.
  • Step 503 After the business server passes the verification of the account information, it sends an authentication pass message to the Internet of Things device for the account identification.
  • Step 504 In response to the authentication pass message, the Internet of Things device obtains device information matching the account permissions identified by the account from the database server.
  • Step 505 The Internet of Things device displays the device information.
  • the management of tenants by the IoT multi-tenant system is mainly divided into a user management module, a role management module, an authentication center module and an application management module.
  • the user management module can include functions such as list query, tenant addition, deletion, modification, and assigned roles and permission viewing.
  • the role management module can include functions such as role list query, addition, deletion, modification, role assignment permissions, and viewing user roles.
  • the certification center module can provide functions such as querying, adding, modifying, deleting, and viewing roles in the permission list.
  • the application management module can provide functions such as querying, adding, deleting, modifying, and assigning application permissions and viewing application permissions in the application list.
  • the authentication center is responsible for the security work of the Internet of Things platform: it is mainly responsible for authenticating tenants, authenticating users and applications, authenticating user permissions and application permissions.
  • the authentication center involves the interaction of multiple business servers.
  • Tenant information is transferred between tenants with the help of context.
  • the main functions include: Tenant authentication: Verify the tenant's legitimacy; User authentication: Route to the tenant data source based on the tenant to verify the user's legitimacy; User authentication: Route to the tenant data source based on the tenant. Verify user permissions; application authentication: route to the tenant data source based on the tenant to verify the legitimacy of the application; application authentication: route to the tenant data source based on the tenant to verify application permissions.
  • Step 1 The user requests the gateway by entering the login interface address in the browser;
  • Step 2 the gateway sends the login page to the browser
  • Step 3 The user enters the account password on the login page
  • Step 4 The browser requests the gateway controller based on the user input
  • Step 5 The gateway verifies the request parameters
  • Step 6 The gateway requests the business server to identify the tenant based on the user account
  • Step 7 The business server queries tenant information from the main database server;
  • Step 8 The database server returns tenant information to the business server
  • Step 9 The business server verifies whether the tenant information is legal
  • Step 10 After the business server passes the verification of the tenant information, it requests the database server to obtain user information;
  • Step 11 The database server returns user information to the business server
  • Step 12 The business server verifies whether the user information is legal
  • Step 13 The business server sends the authentication result to the gateway
  • Step 14 The gateway requests the business server to obtain the permission list based on the user's viewing permissions
  • Step 15 The business server queries user permissions from the database server;
  • Step 16 The database server sends the permission list to the business server
  • Step 17 The business server returns user permissions to the gateway
  • Step 18 The gateway generates a user Token (carrying the user ID) based on the user Quan Xiong'an;
  • Step 19 The gateway instructs the browser to jump to the homepage
  • Step 20 The user selects the device information to be viewed in the browser;
  • Step 21 The browser sends a request carrying the user Token to the gateway;
  • Step 22 The gateway verifies whether the user Token is legal
  • Step 23 The gateway generates a tenant identity based on the user Token
  • Step 24 The gateway requests the service server to query device information based on the tenant identification
  • Step 25 The business server requests the database server to query the device information in the device information table
  • Step 26 The database server sends the queried device information to the business server;
  • Step 27 The business server sends the device information to the gateway;
  • Step 28 The gateway instructs the browser to jump to the device details page to display device information.
  • the client requests IoT services through the gateway, and the request is intercepted by the interceptor;
  • the request interceptor will call the authentication & authentication service
  • the authentication and authentication service performs tenant identification and tenant authentication.
  • the authentication is performed by adding the tenant ID to the request context;
  • the authentication and authentication service performs user authentication and user authentication
  • the request interceptor carries the tenant context and forwards the request to the gateway API processor;
  • the gateway API processor carries the tenant context to request the business server
  • the business server requests the business server based on the tenant context
  • the business server calls the functional interface of the multi-tenant data source switcher
  • Multi-tenant data source switcher queries or modifies tenant data.
  • Redis Remote Dictionary Server, Remote Dictionary Service
  • Remote Dictionary Service is an open source log-type Key-Value database written in ANSI C language, supports the network, can be based on memory and can be persisted, and provides APIs in multiple languages.
  • PostgreSQL is a free software object-relational database management system with very complete features.
  • MQTT Message Queuing Telemetry Transport
  • TCP/IP protocol suite is a publish/subscribe messaging protocol designed for remote devices with low hardware performance and poor network conditions.
  • Figure 14 schematically shows a schematic structural diagram of an Internet of Things multi-tenant system provided by the present disclosure.
  • the system includes: an Internet of Things device 100, a business server 200, and a database server 300;
  • the business server 200 is a server used for logical calculation, service data support and other functions provided by the Internet of Things device 100. It can be understood that due to the limited computing power and storage capacity provided by the Internet of Things device 100, external business services can be provided. To reduce the data processing and data storage pressure of the Internet of Things device 100, the business server 200 is connected through the Internet of Things device 100.
  • the Internet of Things device 100 is configured to respond to user input and send an account creation request to the database server 300.
  • the account creation request includes: an account identification, a database instance identification, and a business identification;
  • the database server 300 is configured to create a target tenant database corresponding to the account ID in the database server 300 according to the database instance corresponding to the database instance ID, wherein the database instance is in the database server 300 There is already a database instance corresponding to the tenant database; after the creation of the target tenant database is completed, a database creation success notification corresponding to the account ID is sent to the Internet of Things device 100 and the business server 200;
  • the business server 200 is configured to create a data source corresponding to the account identifier according to the database creation success notification, and send the data source identifier of the data source to the Internet of Things device 100;
  • the Internet of Things device 100 is configured to establish a mapping relationship between the data source corresponding to the data source identifier and the account identifier, so as to establish a connection pool between the target tenant database and the data source.
  • the Internet of Things device 100 is also configured to obtain the connection pool operating parameters; adjust the connection pool configuration parameters based on the connection pool operating parameters; and send the connection pool information carrying the connection pool to the business server 200. Notification of connection pool adjustment of configuration parameters; the business server 200 executes at least one of the following connection pool configuration parameter methods according to the business server 200:
  • the Internet of Things device 100 is also configured to generate an account key and a service key corresponding to the account identifier; and send the account key and service key to the account key corresponding to the service identifier.
  • the business server 200 completes the service registration process of the account, and the account key and the business key are used to verify the identity of the account;
  • the business server 200 is also configured to associate and store the account key and the business key.
  • the Internet of Things device 100 is further configured to respond to user input, generate a first account signature based on the account key and the business key, and send a first account signature carrying the account number to the business server 200 A service acquisition request signed by the key and the second account;
  • the business server 200 is also configured to query the business key associated with the account key, and generate a second account signature based on the business key and the account key; in the first account When the signature and the second account signature are compared successfully, business service information is sent to the Internet of Things device 100 .
  • the Internet of Things device 100 is also configured to respond to the received device information query operation and send an account verification request carrying the account identification to the business server 200;
  • the business server 200 is also configured to, in response to the account verification request, query the account information corresponding to the account identifier from the database server 300; after the account information is verified, send the account information to the object.
  • the Internet of Things device 100 is further configured to, in response to the authentication pass message, obtain device information that matches the account permissions identified by the account from the database server 300; and display the device information.
  • each functional module in the IoT multi-tenant system in some embodiments of the present disclosure are as follows:
  • the operation management module is used for operation management and is responsible for managing and maintaining database instances and creating tenant databases in database instances.
  • Tenant management module used for tenant management, supports the creation and management of tenants in this platform.
  • the certification center module is used to set roles, grant functional permissions to the role, and then assign the role to the user.
  • the user will have the permissions owned by the role.
  • permissions need to be modified they only need to modify the permissions of the role.
  • the application management module is used to create and manage third-party applications and manage application permissions. Applications can only access authorized platform APIs (Application Programming Interface).
  • the data isolation module is used for users to only see the tenant's own data, and the data between tenants is not visible.
  • the authentication center module includes: tenant identification module, used to identify which tenant the user belongs to; authentication module, used to verify the legitimacy of the tenant; user authentication, used to verify the legitimacy of the user; user authentication, used to verify user permissions; Application authentication is used to verify application legitimacy; application authentication is used to verify application permissions.
  • Figure 16 schematically shows a structural diagram of an account creation device 60 provided by the present disclosure, which is applied to IoT devices in an IoT multi-tenant platform, including:
  • the tenant management module 601 is configured to receive an account creation request, where the account creation request at least includes: an account identifier and a database instance identifier;
  • the data isolation module 602 is configured to create a target tenant database corresponding to the account ID in the database server according to the database instance corresponding to the database instance ID, wherein the database instance is an existing tenant in the database server.
  • the tenant management module 601 is also configured to output an account creation success notification corresponding to the account identifier after the creation of the target tenant database is completed.
  • the account creation request also includes: a business identifier associated with the account identifier;
  • the data isolation module 602 is also configured to:
  • the data isolation module 602 is also configured to:
  • the device also includes: a monitoring operation and maintenance module 603, configured as:
  • connection pool configuration parameters based on the connection pool operating parameters
  • connection pool adjustment notification is used to instruct the business server to perform at least one of the following connection pool configuration parameter methods:
  • the tenant management module 601 is also configured to:
  • the account ID and the database instance ID are associated and stored in a main database, and the main database is used to store tenant information related to the account.
  • the data isolation module 602 is also configured to:
  • the business table is used to record the user information corresponding to the account identifier, and to be queried by the object described by the permission information.
  • the device further includes: an application management module 604 configured to:
  • a service registration request sent by the account where the service registration request at least includes: a business identifier and an account identifier;
  • the account key and the business key are sent to the business server corresponding to the business identifier to complete the service registration process of the account.
  • the account key and the business key are used to register the account. Identity is verified.
  • the device also includes:
  • the authentication center module 605 is configured to perform authority verification on tenant information, user information and application information in the IoT multi-tenant platform.
  • This disclosed embodiment presets multiple different types of database instances for use by the database when users create accounts, avoiding the problem of static files storing database configuration data and restarting the device when adding new configurations, and improving the efficiency of account creation. , reducing operation and maintenance costs.
  • the device embodiments described above are only illustrative.
  • the units described as separate components may or may not be physically separated.
  • the components shown as units may or may not be physical units, that is, they may be located in One location, or it can be distributed across multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. Persons of ordinary skill in the art can understand and implement the method without any creative effort.
  • Various component embodiments of the present disclosure may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof.
  • a microprocessor or a digital signal processor (DSP) may be used in practice to implement some or all functions of some or all components in a computing processing device according to embodiments of the present disclosure.
  • DSP digital signal processor
  • the present disclosure may also be implemented as an apparatus or apparatus program (eg, computer program and computer program product) for performing part or all of the methods described herein.
  • Such a program implementing the present disclosure may be stored on a non-transitory computer-readable medium, or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, or provided on a carrier signal, or in any other form.
  • Figure 17 illustrates a computing processing device that may implement methods in accordance with the present disclosure.
  • the computing processing device conventionally includes a processor 710 and a computer program product in the form of memory 720 or non-transitory computer-readable media.
  • Memory 720 may be electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read Only Memory), EPROM, hard disk, or ROM.
  • the memory 720 has a storage space 730 for program code 731 for executing any of the method steps described above.
  • the storage space 730 for program codes may include individual program codes 731 respectively used to implement various steps in the above method. These program codes can be read from or written into one or more computer program products.
  • These computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks. Such computer program products are typically portable or fixed storage units as described with reference to FIG. 18 .
  • the storage unit may have storage segments, storage spaces, etc. arranged similarly to the memory 720 in the computing processing device of FIG. 17 .
  • the program code may, for example, be compressed in a suitable form.
  • the storage unit includes computer readable code 731', ie code that can be read by, for example, a processor such as 710, which code, when executed by a computing processing device, causes the computing processing device to perform the methods described above. various steps.
  • any reference signs placed between parentheses shall not be construed as limiting the claim.
  • the word “comprising” does not exclude the presence of elements or steps not listed in a claim.
  • the word “a” or “an” preceding an element does not exclude the presence of a plurality of such elements.
  • the present disclosure may be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the element claim enumerating several means, several of these means may be embodied by the same item of hardware.
  • the use of the words first, second, third, etc. does not indicate any order. These words can be interpreted as names.

Landscapes

  • Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Accounting & Taxation (AREA)
  • Physics & Mathematics (AREA)
  • Economics (AREA)
  • Strategic Management (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Finance (AREA)
  • Tourism & Hospitality (AREA)
  • General Business, Economics & Management (AREA)
  • Marketing (AREA)
  • Development Economics (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Databases & Information Systems (AREA)
  • Human Resources & Organizations (AREA)
  • Primary Health Care (AREA)
  • Computing Systems (AREA)
  • Medical Informatics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

本公开提供的账号创建方法、物联网多租户系统、设备、程序和介质，属于物联网技术领域，应用于物联网多租户平台，所述方法包括：接收账号创建请求，所述账号创建请求至少包括：账号标识、数据库实例标识；根据所述数据库实例标识相对应的数据库实例在数据库服务器中创建所述账号标识相对应的目标租户数据库，其中，所述数据库实例是所述数据库服务器中已有租户数据库相对应的数据库实例；在所述目标租户数据库创建完成后，输出所述账号标识相对应的账号创建成功通知。

Description

账号创建方法、物联网多租户系统、设备、程序和介质
相关申请的交叉引用
本公开要求在2022年5月31日提交中国专利局、申请号为202210607840.9、名称为“账号创建方法、物联网多租户系统、设备、程序和介质”的中国专利申请的优先权，其全部内容通过引用结合在本公开中。
技术领域
本公开属于物联网技术领域，特别涉及一种账号创建方法、物联网多租户系统、设备、程序和介质。
背景技术
近年来随着物联网的飞速发展、物联网软件及硬件开发技术的成熟，以及用户对物联网平台诉求的增长，软件即服务技术逐渐发展成熟，可通过物联网系统为房屋租赁场景下的多个不同租户提供各种物联网服务。
但是由于租户的相关信息通产公式使用静态文件存储多个租户库数据库配置数据时因增加配置信息，将会导致的服务重启问题。
概述
本公开提供的一种账号创建方法、物联网多租户系统、设备、程序和介质。
本公开一些实施例提供一种账号创建方法，应用于物联网多租户平台，所述方法包括：
接收账号创建请求，所述账号创建请求至少包括：账号标识、数据库实例标识；
根据所述数据库实例标识相对应的数据库实例在数据库服务器中创建所述账号标识相对应的目标租户数据库，其中，所述数据库实例是所述数据库服务器中已有租户数据库相对应的数据库实例；
在所述目标租户数据库创建完成后，输出所述账号标识相对应的账号创建成功通知。
可选地，所述账号创建请求还包括：与所述账号标识相关联的业务标识；
所述输出所述账号标识相对应的账号创建成功通知，包括：
向所述业务标识相对应的业务服务端发送所述账号标识相对应的账号创建成功通知；
在所述输出所述账号标识相对应的账号创建成功通知之后，所述方法还包括：
接收所述业务服务端根据所述账号创建成功通知发送的数据源标识；
建立所述数据源标识相对应的数据源与所述账号标识之间的映射关系，所述数据源用于向所述账号提供业务服务数据。
可选地，在所述建立所述数据源标识相对应的数据源与所述账号标识之间的映射关系之后，所述方法还包括：
建立所述目标租户数据库与所述数据源之间的连接池。
可选地，在所述建立所述目标租户数据库与所述数据源之间的连接池之后，所述方法还包括：
获取所述连接池运行参数；
基于所述连接池运行参数调整连接池配置参数；
向所述业务服务端发送携带有所述连接池配置参数的连接池调整通知；
所述连接池调整通知用于指示所述业务服务端执行如下连接池配置参数方式中的至少一种：
在连接数大于最大连接数时，释放超出所述最大连接数的数目的连接；
在空闲连接数大于最大空闲连接数时，释放超出所述最大空闲连接数的数目的空闲连接；
在空闲连接数小于最小空闲连接数时，创建低于所述最小空闲连接数的数目的连接。
可选地，在所述接收账号创建请求之后，所述方法还包括：
将所述账号标识和所述数据库实例标识关联存储至主数据库中，所述主数据库用于存储账号相关的租户信息。
可选地，在所述根据所述数据库实例标识相对应的数据库实例在数据库服务器中创建所述账号标识相对应的目标租户数据库之后，所述方法还包括：
在所述目标租户数据库中创建所述账号标识相对应的业务表；
初始化所述业务表中的业务信息和权限信息；
其中，所述业务表用于记录所述账号标识相对应的用户信息，并供所述权限信息所描述的对象查询。
可选地，所述方法还包括：
接收所述账号发送的服务注册请求，所述服务注册请求至少包括：业务标识、账号标识；
生成所述账号标识相对应的账号密钥和业务密钥；
将所述账号密钥和业务密钥发送至所述业务标识相对应的业务服务端，完成所述账号的服务注册过程，所述账号密钥和所述业务密钥用于对所述账号的身份进行验证。
本公开一些实施例提供一种物联网多租户系统，所述系统包括：物联网设备、业务服务端、数据库服务器；
所述物联网设备，被配置为响应于用户输入，向所述数据库服务器发送账号创建请求，所述账号创建请求包括：账号标识、数据库实例标识、业务标识；
所述数据库服务器，被配置为根据所述数据库实例标识相对应的数据库实例在数据库服务器中创建所述账号标识相对应的目标租户数据库，其中，所述数据库实例是所述数据库服务器中已有租户数据库相对应的数据库实例；在所述目标租户数据库创建完成后，向所述物联网设备和所述业务服务端发送所述账号标识相对应的数据库创建成功通知；
所述业务服务端，被配置为根据所述数据库创建成功通知，创建与所述账号标识相对应的数据源，并向所述物联网设备发送所述数据源的数据源标识；
所物联网设备，被配置为建立所述数据源标识相对应的数据源与所述账号标识之间的映射关系，以建立所述目标租户数据库与所述数据源之间的连接池。
可选地，所述物联网设备，还被配置为获取所述连接池运行参数；基于所述连接池运行参数调整连接池配置参数；向所述业务服务端发送携带有所述连接池配置参数的连接池调整通知；所述业务服务端根据所述业务服务端执行如下连接池配置参数方式中的至少一种：
在连接数大于最大连接数时，释放超出所述最大连接数的数目的连接；
在空闲连接数大于最大空闲连接数时，释放超出所述最大空闲连接数的数目的空闲连接；
在空闲连接数小于最小空闲连接数时，创建低于所述最小空闲连接数的数目的连接。
可选地，所述物联网设备，还被配置为生成所述账号标识相对应的账号密钥和业务密钥；将所述账号密钥和业务密钥发送至所述业务标识相对应的业务服务端，完成所述账号的服务注册过程，所述账号密钥和所述业务密钥用于对所述账号的身份进行验证；
所述业务服务端，还被配置为将所述账号密钥和所述业务密钥进行关联存储。
可选地，所述物联网设备还被配置为响应于用户输入，根据所述账号密钥和所述业务密钥生成第一账号签名；向所述业务服务端发送携带有所述账号密钥和所述第二账号签名的服务获取请求；
所述业务服务端，还被配置为查询与所述账号密钥相关联的业务密钥，并根据所述业务密钥和所述账号密钥生成第二账号签名；在所述第一账号签名和所述第二账号签名比对成功时，向所述物联网设备发送业务服务信息。
可选地，所述物联网设备，还被配置为响应于接收到的设备信息查询操作，向所述业务服务端发送携带有所述账号标识的账号验证请求；
所述业务服务端，还被配置为响应于所述账号验证请求，从所述数据库服务器查询所述账号标识相对应的账号信息；在对所述账号信息验证通过后，向所述物联网设备对所述账号标识的认证通过消息；
所述物联网设备，还被配置为响应于所述认证通过消息，从所述数据库服务器获取与所述账号标识的账号权限相匹配的设备信息；显示所述设备信息。
本公开一些实施例提供一种账号创建装置，应用于物联网多租户平台，所述装置包括：
租户管理模块，被配置为接收账号创建请求，所述账号创建请求至少包括：账号标识、数据库实例标识；
数据隔离模块，被配置为根据所述数据库实例标识相对应的数据库实例在数据库服务器中创建所述账号标识相对应的目标租户数据库，其中，所述数据库实例是所述数据库服务器中已有租户数据库相对应的数据库实例；
所述租户管理模块，还被配置为在所述目标租户数据库创建完成后，输出所述账号标识相对应的账号创建成功通知。
可选地，所述账号创建请求还包括：与所述账号标识相关联的业务标识；
所述数据隔离模块，还被配置为：
向所述业务标识相对应的业务服务端发送所述账号标识相对应的账号创建成功通知；
接收所述业务服务端根据所述账号创建成功通知发送的数据源标识；
建立所述数据源标识相对应的数据源与所述账号标识之间的映射关系，所述数据源用于向所述账号提供业务服务数据。
可选地，所述数据隔离模块，还被配置为：
建立所述目标租户数据库与所述数据源之间的连接池。
可选地，所述装置还包括：监控运维模块，被配置为：
获取所述连接池运行参数；
基于所述连接池运行参数调整连接池配置参数；
向所述业务服务端发送携带有所述连接池配置参数的连接池调整通知；
所述连接池调整通知用于指示所述业务服务端执行如下连接池配置参数方式中的至少一种：
在连接数大于最大连接数时，释放超出所述最大连接数的数目的连接；
在空闲连接数大于最大空闲连接数时，释放超出所述最大空闲连接数的数目的空闲连接；
在空闲连接数小于最小空闲连接数时，创建低于所述最小空闲连接数的数目的连接。
可选地，所述租户管理模块，还被配置为：
将所述账号标识和所述数据库实例标识关联存储至主数据库中，所述主数据库用于存储账号相关的租户信息。
可选地，所述数据隔离模块，还被配置为：
在所述目标租户数据库中创建所述账号标识相对应的业务表；
初始化所述业务表中的业务信息和权限信息；
其中，所述业务表用于记录所述账号标识相对应的用户信息，并供所述权限信息所描述的对象查询。
可选地，所述装置还包括：应用管理模块，被配置为：
接收所述账号发送的服务注册请求，所述服务注册请求至少包括：业务标识、账号标识；
生成所述账号标识相对应的账号密钥和业务密钥；
将所述账号密钥和业务密钥发送至所述业务标识相对应的业务服务端，完成所述账号的服务注册过程，所述账号密钥和所述业务密钥用于对所述账号的身份进行验证。
可选地，所述装置还包括：
认证中心模块，被配置为对所述物联网多租户平台中的租户信息、用户信息和应用信息进行权限验证。
本公开一些实施例提供一种计算处理设备，包括：
存储器，其中存储有计算机可读代码；
一个或多个处理器，当所述计算机可读代码被所述一个或多个处理器执行时，所述计算处理设备执行如上述的账号创建方法。
本公开一些实施例提供一种计算机程序，包括计算机可读代码，当所述计算机可读代码在计算处理设备上运行时，导致所述计算处理设备执行如上述的账号创建方法。
本公开一些实施例提供一种非瞬态计算机可读介质，其中存储了如上述的账号创建方法。
上述说明仅是本公开技术方案的概述，为了能够更清楚了解本公开的技术手段，而可依照说明书的内容予以实施，并且为了让本公开的上述和其它目的、特征和优点能够更明显易懂，以下特举本公开的具体实施方式。
附图简述
为了更清楚地说明本公开实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作一简单地介绍，显而易见地，下面描述中的附图是本公开的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1示意性地示出了本公开一些实施例提供的一种账号创建方法的流程示意图；
图2示意性地示出了本公开一些实施例提供的另一种账号创建方法的逻辑示意图之一；
图3示意性地示出了本公开一些实施例提供的另一种账号创建方法的流程示意图之一；
图4示意性地示出了本公开一些实施例提供的另一种账号创建方法的逻辑示意图之二；
图5示意性地示出了本公开一些实施例提供的另一种账号创建方法的流程示意图之二；
图6示意性地示出了本公开一些实施例提供的另一种账号创建方法的流程示意图之三；
图7示意性地示出了本公开一些实施例提供的另一种账号创建方法的逻辑示意图之三；
图8示意性地示出了本公开一些实施例提供的另一种账号创建方法的流程示意图之四；
图9示意性地示出了本公开一些实施例提供的另一种账号创建方法的流程示意图之五；
图10示意性地示出了本公开一些实施例提供的一种权限管理方法的逻辑示意图；
图11示意性地示出了本公开一些实施例提供的另一种账号创建方法的逻辑示意图之四；
图12示意性地示出了本公开一些实施例提供的一种设备信息查询方法的流程示意图；
图13示意性地示出了本公开一些实施例提供的一种权限认证方法的逻辑示意图；
图14示意性地示出了本公开一些实施例提供的一种物联网多租户系统的结构示意图；
图15示意性地示出了本公开一些实施例提供的一种物联网多租户系统的架构示意图；
图16示意性地示出了本公开一些实施例提供的一种账号创建装置的结构示意图；
图17示意性地示出了用于执行根据本公开一些实施例的方法的计算处理设备的框图；
图18示意性地示出了用于保持或者携带实现根据本公开一些实施例的方法的程序代码的存储单元。
详细描述
为使本公开实施例的目的、技术方案和优点更加清楚，下面将结合本公开实施例中的附图，对本公开实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本公开一部分实施例，而不是全部的实施例。基于本公开中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本公开保护的范围。
图1示意性地示出了本公开提供的一种账号创建方法的流程示意图，应用于物联网多租户平台，所述方法包括：
步骤101，接收账号创建请求，所述账号创建请求至少包括：账号标识、数据库实例标识。
需要说明的是，本公开的执行主体是物联网设备，可以是不具备IP能力的非直连设备，可通过在网关上集成多租户设备计入SDK(Software Development Kit，软件开发工具包)，租户的终端设备可作为子设备连接到网关，并通过网关快速接入到物联网平台，由网关完成终端设备与平台之间的数据转发。当然，物联网设备还可以是运算和存储能力较强且具备IP能力的硬件设备，在设备上直接集成多租户设备接入SDK，通过HTTPS(Hyper Text Transfer Protocol over SecureSocket Layer，超文本传输协议)、MQTTS(Message Queuing Telemetry Transport，消息队列遥测传输)或COAP(Constrained Application Protocol，受限应用协议)等传输协议快速接入物联网平台，此类设备搭载智能系统。
数据库服务器是用于为物联网设备提供租户数据源的服务器，通过在数据库中为终端设备设置数据源，有利于对租户的用户数据进行统一管理，为按照权限对用户数据进行隔离和共享提供了基础，并且数据源集中管理还可以保证用户数据的安全性。
需要说明的是，该数据库实例类型包含但不限于独享数据库类型、共享数据库类型，独享数据库类型是表征单一租户独自使用的数据库的类型，共享数据库类型是表征多个租户可以共同使用的数据库的类型，具体可以根据实际需求设置，此处不做限定。账号标识是用于标识用户的唯一标识，可以是由账号名称和用户标识组成，账号名称可以是用户自行设置的，可以是用户的姓名或者昵称，而用户标识是系统为租户生成的唯一标识，从而通过账号名称和用户标识组成的账号标识即可供用户通过识别账号名称来进行辨别，也可以使得系统根据用户标识识别用户。
在本公开实施例中，在创建租户的账号时，系统管理员可通过其所使用的终端设备登录物联网多租户平台以接入物联网设备，系统管理员在登录后可在通过查看租户管理列表中查询租户信息，列表内容可以包含账号标识、 数据库实例类型、列表创建时间、修改时间以及查询和修改操作控件等。
步骤102，根据所述数据库实例标识相对应的数据库实例在数据库服务器中创建所述账号标识相对应的目标租户数据库，其中，所述数据库实例是所述数据库服务器中已有租户数据库相对应的数据库实例。
需要说明的是，数据库实例是构建数据库所需的数据库配置参数。系统管理员可通过选取所需的数据库实例标识来查询相对应的数据库实例的数据库实例ID、数据库实例名称等数据库实例信息。值得说明的是，本公开中的数据库实例的来源是数据库服务器中历史已构建的已有租户数据库，也就是已有租户数据库相对应的数据库实例，因此无需重新向数据库服务器中输入数据库实例再重启服务器，来为所需构建的目标租户数据库配置数据库实例。
进一步的，不同已有租户数据库的数据库实例标识可以存储在物联网设备上直接系统管理员查询使用，也可以是存在于物联网设备连接的外部存储设备上，可选地，包含有数据库实例标识、数据库实例描述信息等数据库实例相关信息的数据库实例表可以存储在数据库服务器的主数据库中，以系统管理员通过物联网设备创建账号时从主数据库中获取查看和编辑。
参照图2，系统管理员可通过浏览器接入多租户管理平台，输入数据库实例编辑请求来对数据库实例进行增删改查的操作。具体的，系统管理管可通过输入所需编辑的数据库实例名称、数据库实例服务地址、数据库实例端口号、数据库实例关联账号、账号密码来编辑数据库实例。物联网设备在对数据库实例关联账号和账号密码验证通过后，即可依据所输入的数据库实例名称、数据库实例服务地址、数据库实例端口号编辑数据库实例，若所输入的数据库实例名称不存在则可依据数据库实例名称、数据库实例服务地址、数据库实例端口号创建数据库实例，若存在直接进行编辑即可。
在本公开实施例中，物联网设备响应于系统管理员对于数据库实例标识选取操作，向所连接的数据库服务器发送携带有所述数据库实例标识的数据库创建请求，数据库服务器查询该数据库实例标识相对应的数据库实例，以及基于查询到的数据库实例创建该账号标识相对应的目标租户数据库。
步骤103，在所述目标租户数据库创建完成后，输出所述账号标识相对应的账号创建成功通知。
在本公开实施例中，数据库服务器在创建完成目标租户数据库后，向物联网设备发送针对账号标识所对应的账号创建成功通知，物联网设备展示该账号创建通知，以告知系统管理员对于该账号标识相对应的目标租户数据库已创建完成，该账号标识所对应的租户信息和账号信息即可存入目标租户数据库进行使用。
本公开实施例通过预设多种不同类型的数据库实例来供用户创建账号时创建账号的数据库使用，避免了静态文件存储数据库配置数据在新增配置时重启设备的问题，提高了账号创建的效率，降低了运维成本。
可选地，所述账号创建请求还包括：与所述账号标识相关联的业务标识，参照图3，所述步骤103，包括：
步骤1031，向所述业务标识相对应的业务服务端发送所述账号标识相对应的账号创建成功通知。
在本公开实施例中，物联网多租户平台在为租户创建数据库后，通过事件驱动消息通知的方式实时通知其他服务。
步骤1032，接收所述业务服务端根据所述账号创建成功通知发送的数据源标识。
在本公开实施例中，业务服务端在监听到租户的账号创建通知后，自动在本地为该账号对应的租户创建独立的数据源，并将数据源标识发送给物联网设备。
步骤1033，建立所述数据源标识相对应的数据源与所述账号标识之间的映射关系，所述数据源用于向所述账号提供业务服务数据。
在本公开实施例中，物联网设备适应于业务服务端提供的数据源标识将该数据源标识所对应的数据源与账号标识进行关联存储。
步骤1034，建立所述目标租户数据库与所述数据源之间的连接池。
在本公开实施例中，物联网设备通过与数据库服务器交互，以建立账号标识所对应的目标租户数据库与业务服务端的数据源之间的连接池。
步骤1035，获取所述连接池运行参数。
步骤1036，基于所述连接池运行参数调整连接池配置参数。
步骤1037，向所述业务服务端发送携带有所述连接池配置参数的连接池调整通知。
在本公开实施例中，物联网设备在账号标识相对应的独立连接池建立后，可以实时通过网关监控连接池的使用情况来获取连接池运行参数，以基于预先设置的连接池动态调整策略对连接池的配置参数进行调整。具体的，物联网设备可以通过连接池动态调整策略计算出所系调整的连接池配置参数后，通过与业务服务端进行交互来调整连接池的连接数量、最大连接数、最小连接数等配置参数。
本公开实施例基于物联网技术场景，整体采用微服务架构，支持分布式部署环境下多服务协调动态创建数据源，租户服务创建租户数据库后，通过事件驱动消息通知的方式实时通知其他服务，其他服务收到通知后为租户创建数据源，数据源初始化完成后可即刻为租户提供数据查询服务，提高了多租户物联网系统的灵活性。
所述连接池调整通知用于指示所述业务服务端执行如下连接池配置参数方式中的至少一种：
在连接数大于最大连接数时，释放超出所述最大连接数的数目的连接；
在空闲连接数大于最大空闲连接数时，释放超出所述最大空闲连接数的数目的空闲连接；
在空闲连接数小于最小空闲连接数时，创建低于所述最小空闲连接数的数目的连接。
可选地，所述连接池调整通知用于指示所述业务服务端执行如下连接池配置参数方式中的至少一种：
连接池配置参数方式1，在连接数大于最大连接数时，释放超出所述最大连接数的数目的连接；
连接池配置参数方式2，在空闲连接数大于最大空闲连接数时，释放超出所述最大空闲连接数的数目的空闲连接；
连接池配置参数方式3，在空闲连接数小于最小空闲连接数时，创建低于所述最小空闲连接数的数目的连接。
在本公开实施例中，针对方式1，可基于网关设备的负载来对连接数据进行调整，即负载过大时可以适当减少连接池的连接数，反之负载较小时可以增加连接池的连接数，其中最大连接数的计算方式为最大连接数＝QPS/业务服务端实例节点数量*80％。针对方式2，即使没有数据库连接时依然可以保持空闲连接的数量，而不被清除，随时处于待命状态。通常取最大连接数的20％。针对方式3，连接数少于此值时，连接池会创建连接来补充到该值的数量，通常取最大连接数的5％。
本公开实施例支持分布式环境物联网平台多租户模式下多个服务端实时动态调整数据库连接池参数(在网关层，根据识别出的租户计算每个租户的RPS(Request Per Second，每秒能处理的请求数量。等效于QPS)和平均响应时间，动态调整租户连接池参数(主要包括最大连接数、最大空闲连接数、最小空闲连接数)，网关将计算出的数据库连接池参数通过消息通知到其他服务，其他服务根据收到的参数实时调整连接池参数，避免了连接数分配过多导致的资源浪费和连接数分配过少导致的资源排队和竞争。
可选地，在所述步骤101之后，所述方法还包括：将所述账号标识和所述数据库实例标识关联存储至主数据库中，所述主数据库用于存储账号相关的租户信息。
在本公开实施例中，主数据库是数据库服务器中用于存储租户信息的数据库，租户信息可以包含有租户的账号信息、权限信息和租户数据库的配置信息等，因此在创建新的账号时，需要将所接收到的账号标识和所构建租户数据库使用的数据库实例标识存储至主数据库中，以供后续系统管理员查询和编辑，以便于对物联网多租户平台中的多个租户进行统一编辑。并且创建后的租户数据库的数据库实例标识还可供后续创建账号使用，避免了静态文件存储数据库配置数据在新增配置时重启设备的问题，提高了账号创建的效率，降低了运维成本。
可选地，可通过图4所示的流程来对租户信息进行管理；
系统管理员通过用户账号登录认证中心后，即可通过页面操作指令对租户信息进行增删改查操作，并通过数据库操作指令编辑数据库服务器中主数据库存储的租户信息，以及租户数据库存储的业务信息。
可选地，参照图5，在所述步骤103之后，所述方法还包括：
步骤104，在所述目标租户数据库中创建所述账号标识相对应的业务表。
步骤105，初始化所述业务表中的业务信息和权限信息，其中，所述业务表用于记录所述账号标识相对应的用户信息，并供所述权限信息所描述的对象查询。
在本公开实施例中，业务表是用于存储账号标识所对应的租户使用服务情况的业务信息以及租户的权限信息。在账号标识相对应的目标租户数据库创建完成后，物联网设备可指示数据库服务器在目标租户数据库中未该租户创建相对应的业务表，并初始化其中的业务信息和权限信息，以供后续用户在使用业务服务后将服务信息和后续的设置的权限信息存储至该业务表中。并且该业务表中的内容只有具有查询权限的租户才可查看，从而保证了实现了租户之间的数据隔离，保证了信息安全性。
本公开实施例通过ORM(object Relational Mapping，对象关系映射)的方式在租户数据库完成完成后动态为租户创建业务表，避免了手动解析数据库元数据、手动生成建表SQL(Structured Query Language，结构化查询语言)脚本带来的大量开发工作及出错风险。
可选地，参照图6，所述方法还包括：
步骤301，接收所述账号发送的服务注册请求，所述服务注册请求至少包括：业务标识、账号标识。
步骤302，生成所述账号标识相对应的账号密钥和业务密钥。
步骤303，将所述账号密钥和业务密钥发送至所述业务标识相对应的业务服务端，完成所述账号的服务注册过程，所述账号密钥和所述业务密钥用于对所述账号的身份进行验证。
在本公开实施例中，考虑物联网多租户系统存储第三方业务方接入的需求，若第三方业务方所提供的应用需要为租户单独创建账号且租户在使用第三方业务方所提供服务时需求对不同账号进行多次验证，就会导致不必要的资源浪费和大大影响租户获取第三方业务服务的效率，并且考虑第三方业务方与物联网多租户系统之间账号共享对于系统账号安全性也会造成一定影响。
因此参照图7，本公开实施例中的物联网多租户系统在租户的账号创建成功后，若租户需要使用第三方业务方的业务服务，则依据账号发送的服务注册请求中的业务标识和账号标识为账号自动生成与该业务服务端相对应的账号密钥和业务密钥供业务服务端进行账号验证。
具体的，物联网平台为租户生成账号密钥Access Key(AK)、业务密钥Secret Key(SK)，其中，Access Key(AK)是自动生成，全局唯一，关联租户标识(32位UUID+租户domain)，不可修改；Secret Key(SK)：自动生成，全局唯一，不可修改。通过使用Access Key Id/SecretAccess Key拼接的加密的方法来验证某个请求的发送者身份。Access Key Id(AK)用于标示用户账号，Secret Access Key(SK)是用户用于加密认证字符串和云厂商用来验证认证字符串的密钥，每个业务服务端对应的业务密钥均不同，该业务密钥可提供给业务方以供器验证使用，必须保密。业务服务端接收到用户的请求后，系统将使用AK对应的相同的SK和同样的认证机制生成认证字符串，并与用户请求中包含的认证字符串进行比对。如果认证字符串相同，系统认为用户拥有指定的操作权限，并执行相关操作；如果认证字符串不同，系统将忽略该操作并返回错误码。
可选地，参照图8，业务服务端对物联网设备发送请求的验证过程如下：
步骤401，所述物联网设备响应于用户输入，根据所述账号密钥和所述业务密钥生成第一账号签名。
步骤402，所述物联网设备向所述业务服务端发送携带有所述账号密钥和所述第二账号签名的服务获取请求。
步骤403，所述业务服务端查询与所述账号密钥相关联的业务密钥，并根据所述业务密钥和所述账号密钥生成第二账号签名。
步骤404，所述业务服务端在所述第一账号签名和所述第二账号签名比对成功时，向所述物联网设备发送业务服务信息。
在本公开实施例中，物联网设备请求IoTAPI(物联网多租户平台中用于构建服务获取请求的功能接口)时先构建请求头，再发起requst；将appKey、时间戳timestamp、随机数random、signature加入打请求头中；其中appKey为AK，timestamp为当前时间，random为随机数字，signature为appKey+timestamp+random+SK使用算法生成；业务服务端收到请求后，使用AK/SK进行认证；首先从请求头获取appKey、timestamp、random、signature参数，然后根据发送的appKey识别租户，查找数据库得到对应的secret_key；
IoT使用同样的算法将appKey+timestamp+random+SK一起计算签名(signature)；对比用户发送的签名和业务服务端计算的签名，相同则认证通过，否则失败。
本公开通过给为账号生成业务密钥和账号密钥以供外部的业务服务端对租户的账号进行验证，使得租户的账号不会直接暴露给业务服务端，也可以使得业务服务端可以对租户的账号进行验证，保证了租户账号的安全性。
可选地，参照图9，物联网设备查询设备信息的过程如下：
步骤501，所述物联网设备响应于接收到的设备信息查询操作，向所述业务服务端发送携带有所述账号标识的账号验证请求。
步骤502，所述业务服务端响应于所述账号验证请求，从所述数据库服务器查询所述账号标识相对应的账号信息。
步骤503，所述业务服务端在对所述账号信息验证通过后，向所述物联网设备对所述账号标识的认证通过消息。
步骤504，所述物联网设备响应于所述认证通过消息，从所述数据库服务器获取与所述账号标识的账号权限相匹配的设备信息。
步骤505，所述物联网设备显示所述设备信息。
在本公开实施例中，参照图10，物联网多租户系统对于租户的管理主要分为用户管理模块、角色管理模块、认证中心模块和应用管理模块。对于用户管理模块可包含列表查询，租户添加、删除、修改以及分配角色和权限查看等功能，对于角色管理可包含角色列表查询、添加、删除、修改以及角色分配权限和查看用户角色等功能，对于认证中心模块可提供权限列表查询、添加、修改、删除和查看角色等功能，对于应用管理模块可提供应用列表查询、添加、删除、修改以及应用权限分配和应用权限查看等功能。
可选地，参照图11，认证中心负责物联网平台的安全工作：主要负责认证租户，认证用户及应用，认证用户权限及应用权限，认证中心涉及到多个业务服务端的交互，业务服务端之间借助上下文传递租户信息，其中主要功能包括：租户认证：校验租户合法性；用户认证：根据租户路由到租户数据源，校验用户合法性；用户鉴权：根据租户路由到租户数据源，验证用户权限；应用认证：根据租户路由到租户数据源，校验应用合法性；应用鉴权：根据租户路由到租户数据源，验证应用权限。
进一步的，参照图12，用户可通过如下步骤实现对于设备信息的查看：
步骤1，用户通过在浏览器输入登录界面地址请求网关；
步骤2，网关将登录页面发送给浏览器；
步骤3，用户在登录页面中输入账号密码；
步骤4，浏览器依据用户输入的请求网关的控制器；
步骤5，网关对于请求参数进行验证；
步骤6，网关依据用户账号请求业务服务端识别租户；
步骤7，业务服务端从主数据库服务器查询租户信息；
步骤8，数据库服务器向业务服务端返回租户信息；
步骤9，业务服务端验证租户信息是否合法；
步骤10，业务服务端对租户信息验证通过后，向数据库服务器请求获取用户信息；
步骤11，数据库服务器向业务服务端返回用户信息；
步骤12，业务服务端验证用户信息是否合法；
步骤13，业务服务端向网关发送认证结果；
步骤14，网关依据用户查看权限请求业务服务端获取权限列表；
步骤15，业务服务端从数据库服务器查询用户权限；
步骤16，数据库服务器向业务服务端发送权限列表；
步骤17，业务服务端向网关返回用户权限；
步骤18，网关依据用户全雄安生成用户Token(携带有用户标识)；
步骤19，网关指示浏览器跳转至首页；
步骤20，用户在浏览器选取所需查看的设备信息；
步骤21，浏览器向网关发送携带有用户Token的请求；
步骤22，网关验证用户Token是否合法；
步骤23，网关根据用户Token生成租户标识；
步骤24，网关依据租户标识请求业务服务端查询设备信息；
步骤25，业务服务端请求数据库服务器在设备信息表中查询设备信息；
步骤26，数据库服务器将查询到的设备信息发送给业务服务端；
步骤27，业务服务端将设备信息发送给网关；
步骤28，网关指示浏览器跳转至设备详情页面以显示设备信息。
参照图13，修改租户数据的主要工作流程如下：
S1、客户端通过网关请求IoT服务，请求被拦截器拦截；
S2、请求拦截器将调用认证&鉴权服务；
S3、认证鉴权服务执行租户识别、租户认证，认证通过将租户标识加入 请求上下文；
S4、认证鉴权服务执行用户认证、用户鉴权；
S5、认证&鉴权限成功后，请求拦截器携带租户上下文转发请求至网关API处理器；
S6、网关API处理器携带租户上下文请求业务服务端；
S7、业务服务端根据租户上下文，请求业务服务端；
S8、业务服务端调用多租户数据源切换器的功能接口；
S9、多租户数据源切换器查询或修改租户数据。
其中，Redis(Remote Dictionary Server，远程字典服务)是一个开源的使用ANSI C语言编写、支持网络、可基于内存亦可持久化的日志型、Key-Value数据库，并提供多种语言的API。PostgreSQL是一种特性非常齐全的自由软件的对象-关系型数据库管理系统。MQTT(Message Queuing Telemetry Transport，消息队列遥测传输)是ISO标准(ISO/IEC PRF 20922)下基于发布/订阅范式的消息协议。它工作在TCP/IP协议族上，是为硬件性能低下的远程设备以及网络状况糟糕的情况下而设计的发布/订阅型消息协议。
图14示意性地示出了本公开提供的一种物联网多租户系统的结构示意图，所述系统包括：物联网设备100、业务服务端200、数据库服务器300；
业务服务端200是用于和物联网设备100提供的逻辑计算、服务数据支持等功能的服务器，可以理解由于物联网设备100的所能提供的算力和存储能力有限，因此可通过外接业务服务端200的方式来减轻物联网设备100的数据处理和数据存储压力，当然通过物联网设备100连接业务服务端200。
所述物联网设备100，被配置为响应于用户输入，向所述数据库服务器300发送账号创建请求，所述账号创建请求包括：账号标识、数据库实例标识、业务标识；
所述数据库服务器300，被配置为根据所述数据库实例标识相对应的数据库实例在数据库服务器300中创建所述账号标识相对应的目标租户数据库，其中，所述数据库实例是所述数据库服务器300中已有租户数据库相对应的数据库实例；在所述目标租户数据库创建完成后，向所述物联网设备100和所述业务服务端200发送所述账号标识相对应的数据库创建成功通知；
所述业务服务端200，被配置为根据所述数据库创建成功通知，创建与所述账号标识相对应的数据源，并向所述物联网设备100发送所述数据源的数据源标识；
所物联网设备100，被配置为建立所述数据源标识相对应的数据源与所述账号标识之间的映射关系，以建立所述目标租户数据库与所述数据源之间的连接池。
可选地，所述物联网设备100，还被配置为获取所述连接池运行参数；基于所述连接池运行参数调整连接池配置参数；向所述业务服务端200发送携带有所述连接池配置参数的连接池调整通知；所述业务服务端200根据所述业务服务端200执行如下连接池配置参数方式中的至少一种：
在连接数大于最大连接数时，释放超出所述最大连接数的数目的连接；
在空闲连接数大于最大空闲连接数时，释放超出所述最大空闲连接数的数目的空闲连接；
在空闲连接数小于最小空闲连接数时，创建低于所述最小空闲连接数的数目的连接。
可选地，所述物联网设备100，还被配置为生成所述账号标识相对应的账号密钥和业务密钥；将所述账号密钥和业务密钥发送至所述业务标识相对应的业务服务端200，完成所述账号的服务注册过程，所述账号密钥和所述业务密钥用于对所述账号的身份进行验证；
所述业务服务端200，还被配置为将所述账号密钥和所述业务密钥进行关联存储。
可选地，所述物联网设备100还被配置为响应于用户输入，根据所述账号密钥和所述业务密钥生成第一账号签名；向所述业务服务端200发送携带有所述账号密钥和所述第二账号签名的服务获取请求；
所述业务服务端200，还被配置为查询与所述账号密钥相关联的业务密钥，并根据所述业务密钥和所述账号密钥生成第二账号签名；在所述第一账号签名和所述第二账号签名比对成功时，向所述物联网设备100发送业务服务信息。
可选地，所述物联网设备100，还被配置为响应于接收到的设备信息查询操作，向所述业务服务端200发送携带有所述账号标识的账号验证请求；
所述业务服务端200，还被配置为响应于所述账号验证请求，从所述数据库服务器300查询所述账号标识相对应的账号信息；在对所述账号信息验证通过后，向所述物联网设备100对所述账号标识的认证通过消息；
所述物联网设备100，还被配置为响应于所述认证通过消息，从所述数据库服务器300获取与所述账号标识的账号权限相匹配的设备信息；显示所述设备信息。
参照图15，本公开一些实施例中的物联网多租户系统中的各功能模块的作用如下：
运营管理模块，用于运营管理负责管理和维护数据库实例，在数据库实例中创建租户数据库。
租户管理模块，用于租户管理可支持在本平台中创建和管理租户。
认证中心模块，用于设置角色，对角色赋予功能权限，然后再将角色赋予到用户上，用户就有了该角色所拥有的权限，需要进行权限修改时，只需修改角色的权限就可。
应用管理模块，用于创建和管理第三方应用，管理应用权限，应用只可访问已授权的平台API(Application Programming Interface，应用程序接口)。
数据隔离模块，用于用户只能看到租户自有数据，租户之间数据不可见。
认证中心模块，包括：租户识别模块，用于识别用户属于哪一个租户认证模块，用于校验租户合法性；用户认证，用于校验用户合法性；用户鉴权，用于验证用户权限；应用认证，用于校验应用合法性；应用鉴权，用于验证应用权限。
图16示意性地示出了本公开提供的一种账号创建装置60的结构示意图，应用于物联网多租户平台中的物联网设备，包括：
租户管理模块601，被配置为接收账号创建请求，所述账号创建请求至少包括：账号标识、数据库实例标识；
数据隔离模块602，被配置为根据所述数据库实例标识相对应的数据库实例在数据库服务器中创建所述账号标识相对应的目标租户数据库，其中，所述数据库实例是所述数据库服务器中已有租户数据库相对应的数据库实例；
所述租户管理模块601，还被配置为在所述目标租户数据库创建完成后，输出所述账号标识相对应的账号创建成功通知。
可选地，所述账号创建请求还包括：与所述账号标识相关联的业务标识；
所述数据隔离模块602，还被配置为：
向所述业务标识相对应的业务服务端发送所述账号标识相对应的账号创建成功通知；
接收所述业务服务端根据所述账号创建成功通知发送的数据源标识；
建立所述数据源标识相对应的数据源与所述账号标识之间的映射关系，所述数据源用于向所述账号提供业务服务数据。
可选地，所述数据隔离模块602，还被配置为：
建立所述目标租户数据库与所述数据源之间的连接池。
可选地，所述装置还包括：监控运维模块603，被配置为：
获取所述连接池运行参数；
基于所述连接池运行参数调整连接池配置参数；
向所述业务服务端发送携带有所述连接池配置参数的连接池调整通知；
所述连接池调整通知用于指示所述业务服务端执行如下连接池配置参数方式中的至少一种：
在连接数大于最大连接数时，释放超出所述最大连接数的数目的连接；
在空闲连接数大于最大空闲连接数时，释放超出所述最大空闲连接数的数目的空闲连接；
在空闲连接数小于最小空闲连接数时，创建低于所述最小空闲连接数的数目的连接。
可选地，所述租户管理模块601，还被配置为：
将所述账号标识和所述数据库实例标识关联存储至主数据库中，所述主数据库用于存储账号相关的租户信息。
可选地，所述数据隔离模块602，还被配置为：
在所述目标租户数据库中创建所述账号标识相对应的业务表；
初始化所述业务表中的业务信息和权限信息；
其中，所述业务表用于记录所述账号标识相对应的用户信息，并供所述权限信息所描述的对象查询。
可选地，所述装置还包括：应用管理模块604，被配置为：
接收所述账号发送的服务注册请求，所述服务注册请求至少包括：业务标识、账号标识；
生成所述账号标识相对应的账号密钥和业务密钥；
将所述账号密钥和业务密钥发送至所述业务标识相对应的业务服务端，完成所述账号的服务注册过程，所述账号密钥和所述业务密钥用于对所述账号的身份进行验证。
可选地，所述装置还包括：
认证中心模块605，被配置为对所述物联网多租户平台中的租户信息、用户信息和应用信息进行权限验证。
本公开实施例通过预设多种不同类型的数据库实例来供用户创建账号时创建账号的数据库使用，避免了静态文件存储数据库配置数据在新增配置时重启设备的问题，提高了账号创建的效率，降低了运维成本。
以上所描述的设备实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。本领域普通技术人员在不付出创造性的劳动的情况下，即可以理解并实施。
本公开的各个部件实施例可以以硬件实现，或者以在一个或者多个处理器上运行的软件模块实现，或者以它们的组合实现。本领域的技术人员应当理解，可以在实践中使用微处理器或者数字信号处理器(DSP)来实现根据本公开实施例的计算处理设备中的一些或者全部部件的一些或者全部功能。本公开还可以实现为用于执行这里所描述的方法的一部分或者全部的设备或者装置程序(例如，计算机程序和计算机程序产品)。这样的实现本公开的程序可以存储在非瞬态计算机可读介质上，或者可以具有一个或者多个信号的形式。这样的信号可以从因特网网站上下载得到，或者在载体信号上提供，或者以任何其他形式提供。
例如，图17示出了可以实现根据本公开的方法的计算处理设备。该计算处理设备传统上包括处理器710和以存储器720形式的计算机程序产品或者非瞬态计算机可读介质。存储器720可以是诸如闪存、EEPROM(电可擦除可编程只读存储器)、EPROM、硬盘或者ROM之类的电子存储器。存储器720具有用于执行上述方法中的任何方法步骤的程序代码731的存储空间730。例如，用于程序代码的存储空间730可以包括分别用于实现上面的方法中的各种步骤的各个程序代码731。这些程序代码可以从一个或者多个计算机程序产品中读出或者写入到这一个或者多个计算机程序产品中。这些计算机程序产品包括诸如硬盘，紧致盘(CD)、存储卡或者软盘之类的程序代码载体。这样的计算机程序产品通常为如参考图18所述的便携式或者固定存储单元。该存储单元可以具有与图17的计算处理设备中的存储器720类似布置的存储段、存储空间等。程序代码可以例如以适当形式进行压缩。通常，存储单元包括计算机可读代码731’，即可以由例如诸如710之类的处理器读取的代码，这些代码当由计算处理设备运行时，导致该计算处理设备执行上面所描述的方法中的各个步骤。
应该理解的是，虽然附图的流程图中的各个步骤按照箭头的指示依次显示，但是这些步骤并不是必然按照箭头指示的顺序依次执行。除非本文中有明确的说明，这些步骤的执行并没有严格的顺序限制，其可以以其他的顺序执行。而且，附图的流程图中的至少一部分步骤可以包括多个子步骤或者多个阶段，这些子步骤或者阶段并不必然是在同一时刻执行完成，而是可以在不同的时刻执行，其执行顺序也不必然是依次进行，而是可以与其他步骤或者其他步骤的子步骤或者阶段的至少一部分轮流或者交替地执行。
本文中所称的“一个实施例”、“实施例”或者“一个或者多个实施例”意味着，结合实施例描述的特定特征、结构或者特性包括在本公开的至少一个实施例中。此外，请注意，这里“在一个实施例中”的词语例子不一定全指同一个实施例。
在此处所提供的说明书中，说明了大量具体细节。然而，能够理解，本公开的实施例可以在没有这些具体细节的情况下被实践。在一些实例中，并未详细示出公知的方法、结构和技术，以便不模糊对本说明书的理解。
在权利要求中，不应将位于括号之间的任何参考符号构造成对权利要求的限制。单词“包含”不排除存在未列在权利要求中的元件或步骤。位于元件之前的单词“一”或“一个”不排除存在多个这样的元件。本公开可以借助于包括有若干不同元件的硬件以及借助于适当编程的计算机来实现。在列举了若干装置的单元权利要求中，这些装置中的若干个可以是通过同一个硬件项来具体体现。单词第一、第二、以及第三等的使用不表示任何顺序。可将这些单词解释为名称。
最后应说明的是：以上实施例仅用以说明本公开的技术方案，而非对其限制；尽管参照前述实施例对本公开进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本公开各实施例技术方案的精神和范围。

Claims (14)

  1. 一种账号创建方法，其特征在于，应用于物联网多租户平台，所述方法包括：
    接收账号创建请求，所述账号创建请求至少包括：账号标识、数据库实例标识；
    根据所述数据库实例标识相对应的数据库实例在数据库服务器中创建所述账号标识相对应的目标租户数据库，其中，所述数据库实例是所述数据库服务器中已有租户数据库相对应的数据库实例；
    在所述目标租户数据库创建完成后，输出所述账号标识相对应的账号创建成功通知。
  2. 根据权利要求1所述的方法，其特征在于，所述账号创建请求还包括：与所述账号标识相关联的业务标识；
    所述输出所述账号标识相对应的账号创建成功通知，包括：
    向所述业务标识相对应的业务服务端发送所述账号标识相对应的账号创建成功通知；
    在所述输出所述账号标识相对应的账号创建成功通知之后，所述方法还包括：
    接收所述业务服务端根据所述账号创建成功通知发送的数据源标识；
    建立所述数据源标识相对应的数据源与所述账号标识之间的映射关系，所述数据源用于向所述账号提供业务服务数据。
  3. 根据权利要求2所述的方法，其特征在于，在所述建立所述数据源标识相对应的数据源与所述账号标识之间的映射关系之后，所述方法还包括：
    建立所述目标租户数据库与所述数据源之间的连接池。
  4. 根据权利要求3所述的方法，其特征在于，在所述建立所述目标租户数据库与所述数据源之间的连接池之后，所述方法还包括：
    获取所述连接池运行参数；
    基于所述连接池运行参数调整连接池配置参数；
    向所述业务服务端发送携带有所述连接池配置参数的连接池调整通知；
    所述连接池调整通知用于指示所述业务服务端执行如下连接池配置参数方式中的至少一种：
    在连接数大于最大连接数时，释放超出所述最大连接数的数目的连接；
    在空闲连接数大于最大空闲连接数时，释放超出所述最大空闲连接数的数目的空闲连接；
    在空闲连接数小于最小空闲连接数时，创建低于所述最小空闲连接数的数目的连接。
  5. 根据权利要求1所述的方法，其特征在于，在所述接收账号创建请求之后，所述方法还包括：
    将所述账号标识和所述数据库实例标识关联存储至主数据库中，所述主数据库用于存储账号相关的租户信息。
  6. 根据权利要求1所述的方法，其特征在于，在所述根据所述数据库实例标识相对应的数据库实例在数据库服务器中创建所述账号标识相对应的目标租户数据库之后，所述方法还包括：
    在所述目标租户数据库中创建所述账号标识相对应的业务表；
    初始化所述业务表中的业务信息和权限信息；
    其中，所述业务表用于记录所述账号标识相对应的用户信息，并供所述权限信息所描述的对象查询。
  7. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    接收所述账号发送的服务注册请求，所述服务注册请求至少包括：业务标识、账号标识；
    生成所述账号标识相对应的账号密钥和业务密钥；
    将所述账号密钥和业务密钥发送至所述业务标识相对应的业务服务端，完成所述账号的服务注册过程，所述账号密钥和所述业务密钥用于对所述账号的身份进行验证。
  8. 一种物联网多租户系统，其特征在于，所述系统包括：物联网设备、业务服务端、数据库服务器；
    所述物联网设备，被配置为响应于用户输入，向所述数据库服务器发送账号创建请求，所述账号创建请求包括：账号标识、数据库实例标识、业务标识；
    所述数据库服务器，被配置为根据所述数据库实例标识相对应的数据库实例在数据库服务器中创建所述账号标识相对应的目标租户数据库，其中，所述数据库实例是所述数据库服务器中已有租户数据库相对应的数据库实例；在所述目标租户数据库创建完成后，向所述物联网设备和所述业务服务端发送所述账号标识相对应的数据库创建成功通知；
    所述业务服务端，被配置为根据所述数据库创建成功通知，创建与所述账号标识相对应的数据源，并向所述物联网设备发送所述数据源的数据源标识；
    所物联网设备，被配置为建立所述数据源标识相对应的数据源与所述账号标识之间的映射关系，以建立所述目标租户数据库与所述数据源之间的连接池。
  9. 根据权利要求8所述的系统，其特征在于，所述物联网设备，还被配置为生成所述账号标识相对应的账号密钥和业务密钥；将所述账号密钥和业务密钥发送至所述业务标识相对应的业务服务端，完成所述账号的服务注册过程，所述账号密钥和所述业务密钥用于对所述账号的身份进行验证；
    所述业务服务端，还被配置为将所述账号密钥和所述业务密钥进行关联存储。
  10. 根据权利要求9所述的系统，其特征在于，所述物联网设备还被配置为响应于用户输入，根据所述账号密钥和所述业务密钥生成第一账号签名；向所述业务服务端发送携带有所述账号密钥和所述第二账号签名的服务获取请求；
    所述业务服务端，还被配置为查询与所述账号密钥相关联的业务密钥，并根据所述业务密钥和所述账号密钥生成第二账号签名；在所述第一账号签名和所述第二账号签名比对成功时，向所述物联网设备发送业务服务信息。
  11. 根据权利要求8所述的系统，其特征在于，所述物联网设备，还被配置为响应于接收到的设备信息查询操作，向所述业务服务端发送携带有所述账号标识的账号验证请求；
    所述业务服务端，还被配置为响应于所述账号验证请求，从所述数据库服务器查询所述账号标识相对应的账号信息；在对所述账号信息验证通过后，向所述物联网设备对所述账号标识的认证通过消息；
    所述物联网设备，还被配置为响应于所述认证通过消息，从所述数据库服务器获取与所述账号标识的账号权限相匹配的设备信息；显示所述设备信息。
  12. 一种计算处理设备，其特征在于，包括：
    存储器，其中存储有计算机可读代码；
    一个或多个处理器，当所述计算机可读代码被所述一个或多个处理器执行时，所述计算处理设备执行如权利要求1-7中任一项所述的账号创建方法。
  13. 一种计算机程序，其特征在于，包括计算机可读代码，当所述计算机可读代码在计算处理设备上运行时，导致所述计算处理设备执行如权利要求1-7中任一项所述的账号创建方法。
  14. 一种非瞬态计算机可读介质，其特征在于，其中存储了如权利要求1-7中任一项所述的账号创建方法的计算机程序。
PCT/CN2023/091803 2022-05-31 2023-04-28 账号创建方法、物联网多租户系统、设备、程序和介质 WO2023231681A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210607840.9A CN114969045A (zh) 2022-05-31 2022-05-31 账号创建方法、物联网多租户系统、设备、程序和介质
CN202210607840.9 2022-05-31

Publications (1)

Publication Number Publication Date
WO2023231681A1 true WO2023231681A1 (zh) 2023-12-07

Family

ID=82957609

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/091803 WO2023231681A1 (zh) 2022-05-31 2023-04-28 账号创建方法、物联网多租户系统、设备、程序和介质

Country Status (2)

Country Link
CN (1) CN114969045A (zh)
WO (1) WO2023231681A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114969045A (zh) * 2022-05-31 2022-08-30 京东方科技集团股份有限公司 账号创建方法、物联网多租户系统、设备、程序和介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106529331A (zh) * 2016-10-31 2017-03-22 用友网络科技股份有限公司 一种应用于PaaS平台的多租户数据隔离方案
CN110163002A (zh) * 2019-05-29 2019-08-23 上海有谱网络科技有限公司 一种SaaS软件租户数据隔离的方法
CN112100262A (zh) * 2020-09-16 2020-12-18 南京智数云信息科技有限公司 多租户SaaS平台快速搭建及动态扩容的方法及系统
CN114417300A (zh) * 2022-01-11 2022-04-29 浪潮云信息技术股份公司 多租户用户访问控制系统及方法
CN114969045A (zh) * 2022-05-31 2022-08-30 京东方科技集团股份有限公司 账号创建方法、物联网多租户系统、设备、程序和介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106529331A (zh) * 2016-10-31 2017-03-22 用友网络科技股份有限公司 一种应用于PaaS平台的多租户数据隔离方案
CN110163002A (zh) * 2019-05-29 2019-08-23 上海有谱网络科技有限公司 一种SaaS软件租户数据隔离的方法
CN112100262A (zh) * 2020-09-16 2020-12-18 南京智数云信息科技有限公司 多租户SaaS平台快速搭建及动态扩容的方法及系统
CN114417300A (zh) * 2022-01-11 2022-04-29 浪潮云信息技术股份公司 多租户用户访问控制系统及方法
CN114969045A (zh) * 2022-05-31 2022-08-30 京东方科技集团股份有限公司 账号创建方法、物联网多租户系统、设备、程序和介质

Also Published As

Publication number Publication date
CN114969045A (zh) 2022-08-30

Similar Documents

Publication Publication Date Title
US10091127B2 (en) Enrolling a mobile device with an enterprise mobile device management environment
CN108293045B (zh) 本地和远程系统之间的单点登录身份管理
US9942224B2 (en) Management and authentication in hosted directory service
WO2020207233A1 (zh) 一种区块链的权限控制方法及装置
US10623272B2 (en) Authenticating connections and program identity in a messaging system
US9960912B2 (en) Key management for a rack server system
WO2019184164A1 (zh) 自动部署Kubernetes从节点的方法、装置、终端设备及可读存储介质
WO2018014868A1 (zh) 混合云的用户管理方法和装置
US20150121491A1 (en) System and method of authenticating user account login request messages
WO2021197432A1 (zh) 一种数据库集群的路由方法和装置
US20120185930A1 (en) Domains based security for clusters
US20170041504A1 (en) Service providing system, information processing apparatus, program, and method for generating service usage information
CN105187372A (zh) 一种基于移动应用入口的数据处理方法、装置和系统
CN108289074B (zh) 用户账号登录方法及装置
US20230079672A1 (en) Cross-chain data transmission method and apparatus, computer device, storage medium, and computer program product
WO2021043062A1 (zh) 一种跨网络唤醒的方法以及相关设备
WO2023231681A1 (zh) 账号创建方法、物联网多租户系统、设备、程序和介质
US11949681B2 (en) Authentication and authorization for cloud file system
WO2020046440A1 (en) Binding a public cloud user account and a personal cloud user account for a hybrid cloud environment
CN110691089B (zh) 一种应用于云服务的认证方法、计算机设备及存储介质
US10785056B1 (en) Sharing a subnet of a logically isolated network between client accounts of a provider network
CN111221655B (zh) 管理OpenStack平台的资源的方法及装置
WO2024045646A1 (zh) 管理集群访问权限的方法、装置和系统
WO2021081705A1 (zh) 支付平台管理方法、设备、支付平台以及计算机存储介质
US11032321B2 (en) Secure performance monitoring of remote application servers

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23814867

Country of ref document: EP

Kind code of ref document: A1