Disclosure of Invention
The present invention aims to solve at least to some extent one of the above technical problems.
Therefore, the invention aims to provide a data proprietary SaaS system and a working method thereof, which solve the problems that the upgrading and maintenance are inconvenient after the proprietary deployment of the SaaS software in the prior art, and a user cannot prevent the SaaS software server from returning data to manufacturers.
The technical scheme adopted by the invention is as follows:
the SaaS system with private data comprises a SaaS container platform and a user private unit, wherein the SaaS container platform comprises a SaaS container platform control module, a SaaS container platform access module, a SaaS container platform external service module and a container pool, and the user private unit comprises a file module, a database and a message queue module;
the container pool is respectively in communication connection with the SaaS container platform control module, the SaaS container platform access module, the SaaS container platform external service module, the file module, the database and the message queue module, the external client is in communication connection with the SaaS container platform access module, and the SaaS container platform external service module is in communication connection with an external network server.
Further, the container pool comprises a plurality of SaaS software containers, and the SaaS software containers are respectively in communication connection with the file module, the database and the message queue module.
Further, the external client is in communication connection with the SaaS container platform access module through an API interface, and the SaaS container platform is in communication connection with an external network server through the API interface to the external service module.
Further, the API interface is an internal API interface and is located inside the SaaS container platform.
Further, the SaaS container platform is an independently built platform, wherein the container pool is used for storing SaaS software from a SaaS software manufacturer, and the user private unit is provided by a user and cannot be accessed by the SaaS software manufacturer.
A data private SaaS system working method comprises the following steps:
s1: receiving a user request sent by a client by using a SaaS container platform access module;
s2: user authentication is carried out on the user request by using the SaaS container platform, the user request is input into a container pool after the user authentication is passed, and the user request is input into a corresponding SaaS software container;
s3: performing read-write operation on the private unit of the user by using the SaaS software in the corresponding SaaS software container according to the user request;
s4: and judging whether the SaaS software sends an external service request or not, if so, using the SaaS container platform to send the external service request to an external network server, and ending the current task, otherwise, directly ending the current task.
Further, in step S4, the external service module sends the external service request to the external network server through a preset internal API interface by using the SaaS container platform.
Further, the internal API interface is authenticated by the user of the SaaS container platform.
Further, in step S2, the user request of the trusted SaaS software is directly input into the SaaS software container corresponding to the container pool.
Further, in step S4, the trusted SaaS software directly accesses a preset external API to send an external service request to the extranet server, where the external API is located outside the SaaS container platform and the interface information is on a preset whitelist of the SaaS container platform.
The beneficial effects of the invention are as follows:
the invention provides a data private SaaS system and a working method thereof, which can lead users to enjoy the convenience of deployment-free and maintenance-free, and simultaneously can also privately own data without worrying about the security risk of reading, leakage and even tampering the data by SaaS manufacturers, and concretely comprises the following steps:
1) The data belongs to the privacy of the user: the storage system is purchased by a user, naturally belongs to the privacy of the user, and the SaaS software can be read and written but cannot be directly accessed by a SaaS software manufacturer;
2) The data will not be acquired by SaaS software vendors: the SaaS software can be controlled to run through the network limitation and external service of the SaaS container platform, the data can not be returned to the SaaS software manufacturer, and the SaaS software manufacturer is forbidden to bypass a path for calling the API to acquire the data through user authentication;
3) The relative privatization deployment is more convenient: the user purchases the SaaS software on the SaaS container platform, the platform can be deployed automatically, and when the user selects to upgrade, the SaaS container platform can execute the processes of data backup, data upgrade, saaS software container upgrade and the like, so that the user and the SaaS software manufacturer do not need excessive intervention, and the SaaS software platform is more convenient.
Other advantageous effects of the present invention will be described in detail in the detailed description.
Detailed Description
The invention will be further elucidated with reference to the drawings and to specific embodiments. The present invention is not limited to these examples, although they are described in order to assist understanding of the present invention. Functional details disclosed herein are merely for describing example embodiments of the invention. This invention may, however, be embodied in many alternate forms and should not be construed as limited to the embodiments set forth herein.
It is to be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of example embodiments of the invention. The terms "comprises," "comprising," "includes," and/or "including," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and/or components, and do not preclude the presence or addition of one or more other features, amounts, steps, operations, elements, components, and/or groups thereof.
It should be appreciated that in some alternative embodiments, the functions/acts noted may occur out of the order noted in the figures. For example, two figures shown in succession may in fact be executed substantially concurrently or the figures may sometimes be executed in the reverse order, depending upon the functionality/acts involved.
It should be understood that specific details are provided in the following description to provide a thorough understanding of the example embodiments. However, it will be understood by those of ordinary skill in the art that the example embodiments may be practiced without these specific details. For example, a system may be shown in block diagrams in order to avoid obscuring the examples with unnecessary detail. In other instances, well-known processes, structures, and techniques may be shown without unnecessary detail in order to avoid obscuring the example embodiments.
Example 1
As shown in fig. 1, the embodiment provides a data private SaaS system, which includes a SaaS container platform and a user private unit, wherein the SaaS container platform includes a SaaS container platform control module, a SaaS container platform access module, a SaaS container platform external service module and a container pool, and the user private unit includes a file module, a database and a message queue module;
the container pool is respectively in communication connection with the SaaS container platform control module, the SaaS container platform access module, the SaaS container platform external service module, the file module, the database and the message queue module, the external client is in communication connection with the SaaS container platform access module, and the SaaS container platform external service module is in communication connection with an external network server; the SaaS container platform is an independently built platform, wherein the container pool is used for storing SaaS software from SaaS software manufacturers, the user private unit is provided by a user, and the SaaS software manufacturers cannot access.
A SaaS container platform is built outside a SaaS manufacturer, after a user purchases SaaS software on the SaaS container platform, the SaaS container platform can automatically deploy and configure the SaaS software by using a container technology, as for a database, a cache, a file system and other storage systems used for storing or caching data of the SaaS software, the user can directly purchase on the SaaS container platform, can purchase on a cloud manufacturer, can also purchase the SaaS container platform by himself or can perform private deployment, and the storage systems are configured on the SaaS container platform, so that the SaaS software can normally operate, and the data private scheme of the invention is as follows:
1) The user's storage system is selected or built by the user, and SaaS manufacturer can not directly log in to access the user's storage system, and the invention uses the user private unit to realize the privatization of data such as files, databases, message queues and the like;
the SaaS software manufacturer can only upload the container mirror image of the SaaS software, the deployment position of the container is controlled by the SaaS container platform, the SaaS software manufacturer cannot log in the cloud server of the SaaS container platform, and can not access the database as the container naturally, the database is private to the user, and the user only needs to open the authority of the SaaS container platform, so that the SaaS software container can access the SaaS software to meet the requirement, the authority of the database does not need to be opened for the SaaS software manufacturer, the data privacy of the user can be protected as far as possible, and the SaaS software manufacturer is prevented from logging in the database;
2) The SaaS software can read and write the storage system, but the SaaS software cannot actively access the outside, and cannot actively leak data;
the SaaS software is arranged in a containerized way by the SaaS container platform, so that the containers can be controlled to only access the appointed addresses, such as the appointed database and the file system, and the SaaS software cannot transmit the data back to the manufacturer;
3) The SaaS software performs authentication on the external API, and besides the SaaS software itself, the SaaS container platform also performs identity authentication on a user, so that a SaaS manufacturer cannot steal user data in a manner of directly accessing the SaaS software API; the invention carries out user authentication on the input user request and the API interface;
when a user uses SaaS software, the Web end/client end/App end of the software generally interacts with the SaaS software server through an API, and there may be a vulnerability that a SaaS software vendor obtains data through the API of the SaaS software server, and in order to solve this problem, the SaaS container platform specifies that the API of the SaaS software server needs to be additionally authenticated by the SaaS container platform for user authentication.
Preferably, the container pool comprises a plurality of SaaS software containers, and the SaaS software containers are respectively in communication connection with the file module, the database and the message queue module.
Preferably, the external client is in communication connection with the SaaS container platform access module through an API interface, and the SaaS container platform is in communication connection with an external network server through the API interface to the external service module.
Preferably, the API interface is an internal API interface and is located inside the SaaS container platform.
The working method of the SaaS system with proprietary data, as shown in fig. 2, comprises the following steps:
s1: receiving a user request sent by a client by using a SaaS container platform access module;
s2: user authentication is carried out on the user request by using the SaaS container platform, the user request is input into a container pool after the user authentication is passed, and the user request is input into a corresponding SaaS software container;
s3: performing read-write operation on the private unit of the user by using the SaaS software in the corresponding SaaS software container according to the user request;
s4: judging whether the SaaS software sends an external service request or not, if so, using the SaaS container platform to send the external service request to an external network server by using an external service module, and ending the current task, otherwise, directly ending the current task;
and sending an external service request to an external network server by using the external service module through a preset internal API (application program interface) by using the SaaS container platform, wherein the internal API passes through user authentication of the SaaS container platform.
Preferably, in step S2, the user request of the trusted SaaS software is directly input into the SaaS software container corresponding to the container pool, without performing user authentication on the user request through the SaaS container platform.
Preferably, in step S3, the private user unit further includes a data storage module of a cache type in addition to the file module, the database and the message queue module.
Preferably, in step S4, the trusted SaaS software directly accesses a preset external API interface to send the external service request to the extranet server, without passing through the SaaS container platform to the external service module, where the external API interface is located outside the SaaS container platform and its IP or domain name is on a preset whitelist of the SaaS container platform.
It will be apparent to those skilled in the art that the modules or steps of the invention described above may be implemented in a general purpose computing device, they may be concentrated on a single computing device, or distributed across a network of computing devices, or they may alternatively be implemented in program code executable by computing devices, such that they may be stored in a memory device for execution by the computing devices, or they may be separately fabricated into individual integrated circuit modules, or multiple modules or steps within them may be fabricated into a single integrated circuit module. Thus, the present invention is not limited to any specific combination of hardware and software.
The embodiments described above are merely illustrative and may or may not be physically separate if reference is made to the unit being described as a separate component; if a component is referred to as being a unit, it may or may not be a physical unit, may be located in one place, or may be distributed over multiple network elements. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art will understand and implement the present invention without undue burden.
The above embodiments are only for illustrating the technical solution of the present invention, and are not limiting; although the invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical scheme described in the foregoing embodiments can be modified or some of the technical features thereof can be replaced by equivalents. Such modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.
The invention is not limited to the alternative embodiments described above, but any person may derive other various forms of products in the light of the present invention. The above detailed description should not be construed as limiting the scope of the invention, which is defined in the claims and the description may be used to interpret the claims.