Multi-tenant hybrid deployment method, device, equipment, medium and product

Abstract

The invention discloses a multi-tenant hybrid deployment method and device, equipment, a medium and a product in the technical field of network communication. The method comprises the following steps: configuring a first gateway, a configuration center, a plurality of service modules (such as a first service module configured for a first tenant and a second service module configured for a second tenant), a database corresponding to the first service module and a second gateway corresponding to the second service module in a first network of a service provider (such as a NaaS service provider), the second service module accesses a database corresponding to the second service module configured in a second network of a second tenant through a second gateway, so that when the first gateway receives a request sent by a first user, the first gateway determines the tenant to which the first user belongs according to a user identifier carried by the request; and determining a service module corresponding to the tenant by means of the configuration center, so that the service module corresponding to the tenant executes a task indicated by the request by using a database corresponding to the service module, and multi-tenant service hybrid deployment is realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network communication, and particularly relates to a multi-tenant hybrid deployment method, device, equipment, medium and product. BACKGROUND

[0002] Network as a Service (NaaS) is a cloud-based service mode. NaaS can provide flexible subscription network services to some enterprises (such as tenants of the NaaS) based on network virtualization technology, and allows these enterprises to use network infrastructure (such as hardware, software, management tools, licenses and other facilities) on demand, to provide complete network life cycle services.

[0003] In addition, NaaS is a service built based on a cloud network. The cloud network is a technology for managing network connections, traffic control and resource interconnection through the infrastructure of a cloud service provider, and the cloud network migrates network management platforms, control platforms and the like to the cloud to realize centralized management and automatic configuration of network resources. NaaS is a mode for providing network functions through the cloud, and NaaS enables enterprises to use various network resources through a subscription service mode without investing in or maintaining traditional network hardware.

[0004] In addition, different tenants facing NaaS can have different needs, so that how to meet these needs becomes a technical problem to be solved. SUMMARY

[0005] To solve the above technical problems, the present application provides a multi-tenant hybrid deployment method, device, equipment, medium and product.

[0006] To achieve the above purpose, the technical scheme provided by the present application is as follows:

[0007] The application provides a multi-tenant hybrid deployment method, comprising the following steps: configuring a first gateway, a configuration center and a plurality of service modules in a first network of a service provider, wherein the plurality of service modules comprise a first service module configured for a first tenant and a second service module configured for a second tenant; configuring a database corresponding to the first service module and a second gateway corresponding to the second service module in the first network; the second service module accesses the database corresponding to the second service module configured in a second network of the second tenant through the second gateway; the method comprises the following steps performed by the first gateway: in response to receiving a request sent by a first user, determining a tenant to which the first user belongs according to a user identifier carried by the request, and searching for configuration information corresponding to the tenant to which the first user belongs in the configuration center; determining a service module corresponding to the tenant to which the first user belongs from the plurality of service modules according to the configuration information and the request; and forwarding the request to the service module corresponding to the tenant to which the first user belongs, wherein the service module corresponding to the tenant to which the first user belongs executes a task indicated by the request by using a database corresponding to the service module.

[0008] In a possible implementation, the tenant to which the first user belongs is the first tenant, and the service module corresponding to the tenant to which the first user belongs is the first service module; the service module corresponding to the tenant to which the first user belongs executes the task indicated by the request by using the database corresponding to the service module, comprising: the first service module obtains data matched with the task from the database corresponding to the first service module in the first network; and the first service module executes the task according to the matched data.

[0009] In a possible implementation, the tenant to which the first user belongs is the second tenant, and the service module corresponding to the tenant to which the first user belongs is the second service module; the service module corresponding to the tenant to which the first user belongs executes the task indicated by the request by using the database corresponding to the service module, comprising: the second service module obtains data matched with the task from the database corresponding to the second service module in the second network through the second gateway; and the second service module executes the task according to the matched data.

[0010] In a possible implementation, the method further includes the following steps performed by the first gateway: receiving indication information sent by an administrator user, wherein the first identifier carried in the indication information is the identifier of the service provider, and the second identifier carried in the indication information is the identifier of a managed tenant; searching for configuration information corresponding to the administrator user in the configuration center; in response to the configuration information corresponding to the administrator user indicating that the administrator user has management authority over the managed tenant, searching for configuration information corresponding to the managed tenant in the configuration center; determining a service module corresponding to the managed tenant from the plurality of service modules according to the indication information and the configuration information corresponding to the managed tenant; and forwarding the indication information to the service module corresponding to the managed tenant, and the service module corresponding to the managed tenant performs a task described in the indication information by using a database corresponding to the service module.

[0011] In a possible implementation, the first service module includes part or all of at least one service module corresponding to a general function and at least one service module corresponding to a customized function.

[0012] In a possible implementation, the plurality of service modules include different microservices.

[0013] In a possible implementation, the service provider is a network as a service (NaaS) service provider, and the NaaS service provider performs NaaS service configuration or management operations on the multi-tenant in the first network through the first gateway and the second gateway.

[0014] In a possible implementation, the method satisfies at least one of the following constraints: the first network is a cloud network; the second network is a private network; different service modules in the plurality of service modules provide different services, respectively; different service modules in the plurality of service modules correspond to different interfaces of the first gateway, respectively; the first gateway receives requests sent by different users through a same interface; and the configuration center records configuration information corresponding to a user identifier of at least one user, and the at least one user includes the first tenant and the second tenant.

[0015] The application provides a multi-tenant hybrid deployment device, a first gateway, a configuration center and a plurality of service modules are configured in a first network of a service provider, the plurality of service modules include a first service module configured for a first tenant and a second service module configured for a second tenant, a database corresponding to the first service module and a second gateway corresponding to the second service module are configured in the first network, the second service module accesses the database corresponding to the second service module configured in a second network of the second tenant through the second gateway; the device comprises: a finding unit configured to, in response to receiving a request sent by a first user, determine a tenant to which the first user belongs according to a user identifier carried by the request, and find configuration information corresponding to the tenant to which the first user belongs in the configuration center; a determining unit configured to determine a service module corresponding to the tenant to which the first user belongs from the plurality of service modules according to the configuration information and the request; and a processing unit configured to forward the request to the service module corresponding to the tenant to which the first user belongs, and the service module corresponding to the tenant to which the first user belongs executes a task indicated by the request by using a database corresponding to the service module.

[0016] The application provides an electronic device, characterized in that the device comprises a processor and a memory.

[0017] The memory is configured to store instructions or a computer program.

[0018] The processor is configured to execute the instructions or the computer program in the memory, so that the electronic device performs the multi-tenant hybrid deployment method provided in the application.

[0019] The application provides a computer readable medium, characterized in that the computer readable medium stores instructions or a computer program, when the instructions or the computer program are executed on a device, the device performs the multi-tenant hybrid deployment method provided in the application.

[0020] The application provides a computer program product, comprising a computer program carried on a non-transitory computer readable medium, the computer program comprising program codes for executing the multi-tenant hybrid deployment method provided in the application.

[0021] Compared with the related art, the application has at least the following advantages:

[0022] The technical scheme provided in the application comprises the following steps: for a first network of a service provider (such as a NaaS service provider), a first gateway, a configuration center and a plurality of service modules are configured in the first network (such as a cloud network), the plurality of service modules comprise a first service module configured for a first tenant (such as a public tenant) and a second service module configured for a second tenant (such as a private tenant), a database corresponding to the first service module and a second gateway corresponding to the second service module are configured in the first network, the second service module accesses a database corresponding to the second service module configured in a second network (such as a private network) of the second tenant through the second gateway, so that when the first gateway receives a request sent by a first user (such as a tenant with a private deployment requirement or a tenant with a customization requirement or a tenant with a regular requirement), the first gateway determines the tenant to which the first user belongs according to a user identifier carried in the request; the configuration information corresponding to the tenant to which the first user belongs is searched from the configuration center, so that the configuration information can indicate which candidate service modules can be selected when processing the request sent by the tenant to which the first user belongs; the first gateway determines the service module corresponding to the tenant to which the first user belongs and suitable for processing the request from the plurality of service modules according to the configuration information and the request; and the first gateway forwards the request to the service module corresponding to the tenant to which the first user belongs, so that the service module corresponding to the tenant to which the first user belongs can execute the task indicated by the request by using the database corresponding to the service module, thereby realizing multi-tenant service hybrid deployment through the first gateway and the second gateway, and reducing service maintenance cost. BRIEF DESCRIPTION OF DRAWINGS

[0023] In order to more clearly illustrate the technical scheme in the embodiments or the related art, the drawings needed in the embodiments or the related art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments described in the application, and those skilled in the art can also obtain other drawings according to these drawings without any creative effort.

[0024] Figure 1 A multi-tenant requirement implementation scheme provided by the embodiments of the application;

[0025] Figure 2 A flowchart of a multi-tenant hybrid deployment method provided by the embodiments of the application;

[0026] Figure 3 Another multi-tenant requirement implementation scheme provided by the embodiments of the application;

[0027] Figure 4 A different tenant access timing diagram provided by the embodiments of the application;

[0028] Figure 5 A structural schematic diagram of a multi-tenant hybrid deployment device provided for an embodiment of the present application;

[0029] Figure 6 A structural schematic diagram of an electronic device provided for an embodiment of the present application. DETAILED DESCRIPTION

[0030] It is found through research that different tenants oriented by NaaS have different requirements, which are as follows: some tenants have private deployment requirements to meet their data security and privacy; some tenants have functional customization requirements to meet their unique business requirements, thereby ensuring the reliability of service quality.

[0031] It should be noted that in the NaaS scenario, a tenant refers to a customer subject that rents and uses network resources and services through the NaaS platform, and is the core service object of the NaaS service. A tenant is not a single person, but can cover different types of organizations or individuals according to the scenario, and at least has the following characteristics: having independent network resource isolation and service configuration permissions, that is, the network resources, data and configurations of different tenants do not interfere with each other, like using an independent virtual network environment. As can be seen, a tenant can obtain customized network services (such as enterprise branch interconnection, cloud resource access acceleration, security protection, etc.) from a NaaS service provider by paying fees (according to bandwidth, time length, function, etc.), without the need to build or maintain physical network hardware, and has independent management permissions (such as configuring IP addresses, firewall rules, bandwidth adjustment, etc.) for its own virtual network slice.

[0032] It is also found through research that in some scenarios, different deployment schemes (such as the scheme shown in Figure 1 ) can be used for tenants with different requirements, respectively. In order to facilitate understanding, the following three examples are described.

[0033] Example 1, for tenants with private deployment requirements (such as the private tenant 1 or the private tenant 2 shown in Figure 1 ), the overall private deployment of the service (such as the private service 1 or the private service 2 shown in Figure 1 ) is performed by the relevant personnel of NaaS on site, and the middleware (such as the private database 1 or the private database 2 shown in Figure 1 ) relied on by the service is separately deployed and configured. The subsequent iterative upgrade of the service needs on-site operation, so that the service and the middleware are deployed in the private network (such as the private network 1 or the private network 2 shown in Figure 1The private network 1 or the private network 2) is shown, so as to ensure that the service and the middleware thereof are isolated from other networks except the private network, and data security and privacy are achieved. The "on-site" refers to the operation (such as deployment, update, upgrade, etc.) of the relevant personnel to the site where the private network corresponding to the tenant is deployed to ensure that the relevant personnel can complete the operation under the private network.

[0034] Example 2, for tenants with functional customization requirements (such as Figure 1 The public tenant) is shown, and the relevant personnel develop functional customization at the code level of the NaaS according to the unique identifier of the tenant to obtain a code module (such as Figure 1 The customization module 1, the customization module 2, etc.) that meets the requirements. The subsequent iteration of the NaaS needs to continuously compatible with the customization requirements of the tenant.

[0035] Example 3, for ordinary tenants without special requirements (such as tenants without private deployment requirements and without functional customization requirements), the NaaS adopts unified data storage and ensures data isolation between different tenants through code logic, so that the NaaS can normally iterate according to the requirements.

[0036] It is found through research that for the above three examples, in order to meet the differentiated requirements of different tenants, multiple sets of service private deployment and service functional customization development are required, so that at least the following problems ①-② will occur as the NaaS is continuously optimized and the number of tenants continues to increase.

[0037] ① A large number of private deployments increase the NaaS operation and maintenance costs, which are as follows: service private deployment, upgrade, etc. need to be completed by relevant personnel on site, which makes it difficult for the service provider to uniformly control the service upgrade window, makes it difficult to troubleshoot online problems, and prolongs the problem repair cycle, thereby increasing costs and making it difficult to guarantee service quality and stability.

[0038] ② A large number of functional customization requirements increase the complexity of code logic, increase code maintenance costs, and increase code iteration costs, which are as follows: different tenants make functional customization requirements for the NaaS, which cannot be applied to other tenants, so relevant personnel can use hard coding to identify tenants at the code level, so that the code written for the requirement is bound to the unique identifier of the tenant, so that the functions of different tenants can be differentiated; however, as the number of functional customization requirements increases, the complexity of the code logic gradually increases, the cost of the code gradually increases, and the coverage of the code test scenario is also affected, which makes it difficult to guarantee the availability of the NaaS.

[0039] Based on the above research, in order to solve some or all of the above problems, this application provides a multi-tenant hybrid deployment method, which specifically involves: for the first network of a service provider (such as a NaaS service provider), a first gateway, a configuration center, and multiple service modules are configured in the first network (such as a cloud network). These multiple service modules include a first service module configured for a first tenant (such as a public tenant) and a second service module configured for a second tenant (such as a private tenant). A database corresponding to the first service module and a second gateway corresponding to the second service module are configured in the first network. The second service module accesses the database corresponding to the second service module configured in the second tenant's second network (such as a private network) through the second gateway, so that when the first gateway receives a first user (such as a tenant with private deployment needs, a tenant with customization needs, or a tenant with...), the system can be configured to handle the situation. When a request is sent by a tenant (such as a tenant with regular needs), the first gateway first determines the tenant to which the first user belongs based on the user identifier carried in the request. Then, it searches the configuration information corresponding to the tenant to which the first user belongs in the configuration center, so that the configuration information can indicate which candidate service modules can be selected in advance when processing the request sent by the tenant to which the first user belongs. Then, based on the configuration information and the request, the first gateway determines the service module corresponding to the tenant to which the first user belongs from the multiple service modules that is suitable for handling the request. Then, the first gateway forwards the request to the service module corresponding to the tenant to which the first user belongs, so that the service module corresponding to the tenant to which the first user belongs can use its own database to execute the task indicated by the request. In this way, multi-tenant service hybrid deployment can be achieved through the first gateway and the second gateway, thereby reducing service maintenance costs.

[0040] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.

[0041] To better understand the technical solution provided in this application, the multi-tenant hybrid deployment method provided in this application will be explained below with reference to some accompanying drawings. For example... Figure 2 As shown, when in the service provider's first network (such as...) Figure 3 Configure the first gateway, configuration center, and multiple service modules (such as the cloud network shown) in the cloud network. Figure 3The microservices shown are 1, 2, 1, 2, 3, etc., and the multiple service modules include a first service module configured for a first tenant (such as any public tenant) and a second service module configured for a second tenant (such as any private tenant). A database corresponding to the first service module and a second gateway corresponding to the second service module are configured in the first network. When the second service module accesses the database corresponding to the second service module configured in the second network of the second tenant through the second gateway, the multi-tenant hybrid deployment method applied to the first gateway provided in this application embodiment includes the following S1-S3.

[0042] S1: In response to the first gateway receiving a request sent by the first user, the first gateway determines the tenant to which the first user belongs based on the user identifier carried in the request, and searches for the configuration information corresponding to the tenant to which the first user belongs in the configuration center.

[0043] In this system, the service provider can offer services to multiple tenants, such as NaaS (Na as a Service), to meet their service needs. Therefore, in one possible implementation, the service provider can be a NaaS service provider, which uses a first gateway and a second gateway to configure or manage NaaS services for multiple tenants within the first network.

[0044] The first network refers to the network used by the service provider to provide services to the tenant (e.g., the network used by the service provider to provide services to the tenant). Figure 2 (The cloud network shown); and this application does not limit the implementation method of the first network. For example, it can adopt any network capable of providing services using the NaaS model, such as... Figure 3 The cloud network shown is implemented.

[0045] Therefore, in one possible implementation, the first network described above can be a cloud network (such as...). Figure 3 The cloud network shown enables services built on this network (such as NaaS) to be available to tenants with different needs, allowing for unified deployment across these tenants with varying requirements (e.g., ...). Figure 3 (Deployment method shown).

[0046] The first gateway refers to a gateway located in the first network that can directly interact with different users (such as tenants, operation and maintenance personnel, etc.). Therefore, this first gateway can communicate with each user, enabling it to receive requests from users (such as...). Figure 4 The request (as shown in Request 1 or Request 2) can also determine the response to the request (such as...). Figure 4 The responses shown are fed back to the corresponding users, thus mitigating deployment differences between different users through the first gateway.

[0047] Furthermore, this application does not limit the implementation of the first gateway described above. For example, it can be implemented using any gateway that enables different users to communicate with the same network, such as an Application Programming Interface (API) gateway.

[0048] For example, in some scenarios, in order to better reduce the deployment differences among different tenants, the aforementioned first gateway (such as...) Figure 3 The API gateway shown can receive requests from different users through the same interface, so that the first gateway can interact with different users through the same interface.

[0049] The first user refers to a tenant whose needs (such as data processing needs) are met through the first network, enabling the first user to trigger access requests in a certain way (e.g., Figure 4 (See request 1 or request 2 shown). It should be noted that this application does not limit the implementation method of this "certain method". For example, it can be implemented in any way that enables the user-side request to be sent, such as through the terminal device (also known as "client") used by the first user. It can be seen that in one possible implementation, the access request is sent by the first user to the first gateway through the client (such as terminal device) corresponding to the first user.

[0050] Therefore, in one possible implementation, the "request sent by the first user" can specifically be a request sent by the first user through the client (such as a terminal device) corresponding to the first user.

[0051] Furthermore, this application does not limit the implementation method of the first user. For example, in some scenarios (such as when a tenant triggers an access request), the first user can refer to any tenant of the NaaS built on the first network (such as...). Figure 3 (Private tenant 1, private tenant 2, and any public tenant shown).

[0052] For a request sent by the first user, the request can indicate the first user's access needs, such as what kind of task to perform based on what kind of data; and this application does not limit the way the request is sent. For example, the request can be sent by the first user to the first gateway through the client (such as a terminal device) corresponding to the first user.

[0053] Furthermore, for a request sent by the first user, the request must at least carry a user identifier so that the tenant to which the first user belongs can be determined subsequently based on the user identifier. Moreover, this application does not limit the implementation of the user identifier; for example, the user identifier can refer to the identifier of the first user, so that the tenant to which the first user belongs can be determined subsequently by looking up the tenant identifier corresponding to the first user's identifier. In some scenarios, the user identifier includes the identifier of the tenant to which the first user belongs, so that the user identifier can uniquely identify the tenant to which the first user belongs, aiming to indicate which tenant the first user belongs to (e.g., a private tenant or a public tenant). Since the user identifier can uniquely determine the tenant to which the first user belongs, a request carrying the user identifier can accurately indicate from which tenant the request originated.

[0054] Furthermore, this application does not limit the network used when sending the aforementioned request. For example, in some scenarios, the network used by the first user to send the request may include at least the network where the first user is located (such as a private network). Also, in some scenarios, the network used by the first user to send the request may include a third network (such as the Internet or...). Figure 3 (The public network shown). This third network is responsible for connecting the networks of different users with the first network. Furthermore, this application does not limit the implementation of this third network; for example, it can be any network capable of connecting the cloud network with the networks of each tenant, such as... Figure 3 The public network shown is used for implementation.

[0055] Therefore, in one possible implementation, the aforementioned first gateway can receive data from different users through its own network and a third network (such as...) via the same interface. Figure 3 The request was sent from the public network shown.

[0056] The configuration center refers to a device configured in the first network, independent of the first gateway, and dedicated to handling configuration-related matters (such as...). Figure 3 (as shown in the configuration center) so that configuration-related operations can be performed using this configuration center later.

[0057] Furthermore, this application does not limit the implementation method of the above-mentioned configuration center. For example, it can be implemented using any device capable of recording configuration information.

[0058] For example, in some scenarios, the above configuration center can at least meet the following constraints: the configuration center records configuration information corresponding to at least one identifier (such as the identifier of each tenant), and the at least one identifier includes the identifier of each tenant (such as the identifier of the first tenant and the identifier of the second tenant, etc.). In this way, the differences between different tenants (such as the service differences between different tenants) can be recorded by introducing a configuration center, so as to better meet the needs of different users.

[0059] As can be seen, in one possible implementation, the above configuration center may have at least the following characteristics: relevant personnel can use the configuration center to set configurations that meet the needs of each tenant, so that the configuration center can record the relevant content of the service module configured for the tenant (such as the access address of the microservice, the API interface corresponding to the microservice, the request type that the microservice is suitable to handle, etc.), so that the traffic corresponding to the service module can be forwarded through the API gateway in the future, so as to better realize the differentiated needs between different tenants.

[0060] The configuration information corresponding to the tenant to which the first user belongs refers to the configuration information recorded in the configuration center that has been pre-set for the tenant. This configuration information can indicate some configurations that have been pre-set for the first user, such as which service modules the tenant has permission to use, the access address of the service module, which interface in the first gateway the service module corresponds to, and what type of requests the service module is responsible for handling. This configuration information can accurately indicate which constraints need to be met when processing requests initiated from the tenant.

[0061] Furthermore, this application does not limit the implementation method of the configuration information corresponding to the tenant to which the first user belongs. For example, it can indicate some service modules that are pre-configured based on the tenant's needs (such as private deployment needs, functional customization needs, etc.) so that these service modules can meet the needs and then use these service modules to process the access requests initiated by the tenant.

[0062] Furthermore, this application does not limit the method of obtaining the configuration information corresponding to the tenant to which the first user belongs. For example, if the configuration center has pre-recorded the mapping relationship between the identifiers of different tenants and different configuration information, the configuration information corresponding to the identifier of the tenant to which the first user belongs can be found from the mapping relationship and used as the configuration information corresponding to the tenant to which the first user belongs.

[0063] Therefore, in one possible implementation, S1 can specifically be: responding to the first gateway receiving a request sent by the first user (e.g., Figure 4As shown in Request 1 or Request 2, the first gateway first determines the tenant to which the first user belongs based on the user identifier carried in the request; then the first gateway sends the tenant identifier to the configuration center, which queries the configuration information corresponding to the tenant to which the first user belongs based on the tenant identifier (e.g., ...). Figure 4 The configuration information shown is either configuration information 1 or configuration information 2); then, the first gateway receives the configuration information fed back by the configuration center, thus enabling the recording of differences between different users by introducing the configuration center, so as to better meet the needs of different users.

[0064] Based on the above content related to S1, it can be seen that when the first gateway receives the request sent by the first user (such as...), Figure 4 Following request 1 or request 2 shown, the first gateway first generates a query request based on the user identifier carried in the request; then, the first gateway determines the tenant to which the first user belongs based on the user identifier carried in the request; finally, the first gateway uses the configuration center to find the configuration information corresponding to the tenant to which the first user belongs (such as...). Figure 4 The configuration information shown is either configuration information 1 or configuration information 2, and the configuration center feeds back the configuration information to the first gateway so that the first gateway can subsequently perform relevant processing for the request based on the configuration information.

[0065] S2: The first gateway determines the service module corresponding to the tenant to which the first user belongs from multiple service modules based on the configuration information and the request.

[0066] Among them, multiple service modules refer to the modular decomposition of the overall NaaS service (such as microservice decomposition), so that different candidate service modules are responsible for providing different services.

[0067] As can be seen, in one possible implementation, for the multiple modules configured in the first network, different service modules provide different services to split the overall NaaS service built on the first network into multiple lightweight sub-services, reduce the coupling between different sub-services, and improve R&D efficiency and iteration update efficiency.

[0068] Furthermore, this application does not limit the method of splitting the above-mentioned multiple service modules. For example, it can be implemented using any method that can split a whole service into multiple sub-services, such as the microservice splitting method.

[0069] As can be seen, in some scenarios, the above-mentioned multiple service modules include different microservices (such as...). Figure 3The microservices shown are designed to make each service module a microservice, and different service modules provide different microservices. This allows for the modular decomposition of services for the first network using a microservice architecture, thereby combining the microservice architecture with the gateway to address the different needs of different tenants (such as customized functional requirements).

[0070] Furthermore, this application does not limit the implementation methods of the above-mentioned multiple service modules. For example, different modules can be responsible for meeting the different needs of different tenants.

[0071] As can be seen, in one possible implementation, the multiple candidate service modules configured in the first network may include at least one service module corresponding to a general function (such as a service module configured for a public tenant), at least one service module corresponding to a customized function (such as a service module configured for a public tenant), and at least one service module corresponding to a private tenant (such as a service module configured for a private tenant). Each service module corresponding to a private tenant uses the database configured in the private network corresponding to each private tenant to process requests, so as to better meet the different needs of different tenants.

[0072] Specifically, the service module corresponding to at least one of the aforementioned general functions is responsible for providing services to ordinary tenants without special needs, thereby enabling the implementation of some general functions provided by NaaS to tenants. This general function refers to a function applicable to all users, rather than a function customized for a specific user.

[0073] In addition, for any tenant with functional customization needs, in order to meet these needs, a service module that can meet these needs can be separated from NaaS, so that the service module can be dedicated to providing the customized function to the tenant. This enables the deployment of the service module corresponding to the customized function specified by the tenant in the first network.

[0074] Furthermore, for any tenant with a need for private deployment, in order to meet this need, a service module that can meet this need can be separated from NaaS (such as...). Figure 3 The microservice module (such as microservice 1 or microservice 2 shown) is configured to access the database deployed in the tenant's private network through any cross-network communication method, such as a Virtual Private Network (VPN) gateway, so that private services for the tenant can be implemented later with the help of the database and service module.

[0075] Therefore, for any tenant with private deployment needs (hereinafter referred to as "private tenant"), in order to meet its privacy requirements, private management can be implemented at the tenant's data layer. That is, the tenant's database can be deployed on the tenant's corresponding private network (e.g., Figure 3 In the private network 1 or private network 2 shown, the tenant's data layer is isolated from other networks besides this private network to protect the security and privacy of the data recorded in the database; and the service module corresponding to the tenant (such as...) is deployed in the first network. Figure 3 The microservice 1 or microservice 2 shown enables the service module to access the VPN gateway configured for that service module (e.g., Figure 3 The VPN gateway 1 or VPN gateway 2 shown retrieves and uses some data from the database to enable data communication between the private network and NAAS by leveraging the traffic distribution function of the VPN gateway.

[0076] Furthermore, for any tenant that does not have a private deployment requirement (hereinafter referred to as "public tenant"), if the tenant only has some general needs, the service module corresponding to the tenant can be determined based on the service module corresponding to at least one of the general functions mentioned above, so that the service module corresponding to the tenant includes some or all of the service modules corresponding to these general functions; however, if the tenant also has some customized function requirements, the service module corresponding to the tenant can be determined based on the service module corresponding to the at least one general function and the service module corresponding to the customized function that can meet the customized function requirements, so that the service module corresponding to the tenant includes the service module corresponding to the customized function and some or all of the service modules corresponding to these general functions.

[0077] Based on the above-mentioned content of multiple service modules, it can be understood that in one possible implementation, the multiple service modules may include at least a first service module configured for a first tenant (such as any public tenant) and a second service module configured for a second tenant (such as any private tenant).

[0078] For the aforementioned first tenant, the first tenant can refer to any public tenant (such as...). Figure 3 The public tenants shown or Figure 4 The first service module configured for the first tenant can refer to the service module corresponding to the first tenant. Therefore, in one possible implementation, the first service module may include some or all of at least one service module corresponding to a general function and at least one service module corresponding to a customized function, to meet the different needs of different public tenants (such as general needs, customized function needs, etc.). Additionally, the database corresponding to the first service module configured in the first network (such as...)Figure 3 The cloud database shown or Figure 4 The general database shown refers to the database corresponding to the first tenant, so that the first service module can subsequently process requests initiated from the first tenant by accessing the database.

[0079] For the aforementioned second tenant, the second tenant refers to any private tenant (such as...). Figure 3 The private tenant 1 or private tenant 2 shown Figure 4 The private tenant shown), and the second service module configured for the second tenant refers to the service module corresponding to the second tenant (such as...). Figure 3 (As shown in Microservice 1 or Microservice 2). Additionally, the second gateway corresponding to the second service module configured in the first network refers to a gateway configured specifically for the second tenant, dedicated to accessing the network in which the second tenant resides (e.g., Figure 3 VPN Gateway 1 or VPN Gateway 2 shown Figure 4 The VPN gateway shown is used so that the second service module can subsequently access the database corresponding to the second service module configured in the second tenant's second network (such as...) through the second gateway. Figure 3 The private database 1 or private database 2 shown Figure 4 (The private database shown).

[0080] It should be noted that the aforementioned second network refers to the network in which the second tenant itself is located (e.g., Figure 3 The second network can be either private network 1 or private network 2 as shown. Furthermore, this application does not limit the implementation of the second network. For example, to better improve data security, the second network may be isolated from the first network. In some scenarios, the second network may be a private network to better meet the private deployment needs of the second tenant.

[0081] Research has revealed that in some scenarios, API gateways can use different API interfaces to distribute traffic to different service modules. Therefore, in one possible implementation, for the multiple service modules configured in the first network described above, each service module corresponds to a different first gateway (e.g., ...). Figure 3 The API gateway shown has different interfaces so that the first gateway can communicate with different candidate service modules through different interfaces. This allows the first gateway to not only distribute the message stream received by the first gateway to different candidate service modules for processing through different interfaces, but also to receive data fed back by different candidate service modules through different interfaces.

[0082] Furthermore, this application does not limit the implementation of S2 described above. For example, in some scenarios (such as when a tenant triggers an access request), S2 can be: the first gateway searches for a suitable service module from the at least one candidate service modules to handle the request, based on the configuration information corresponding to the tenant to which the first user belongs. It should be noted that this application does not limit the implementation of this search. For example, if the type information carried by the request can indicate the type of the request, then the first gateway searches for a service module corresponding to the type information from the at least one candidate service module, based on the request types recorded in the configuration information, and uses this service module as the service module corresponding to the tenant to which the first user belongs. Wherein, for any service module, the request type corresponding to that service module can indicate which type of request the service module is suitable for handling.

[0083] Based on the above content of S2, after the first gateway finds the configuration information corresponding to the tenant to which the first user belongs based on the request sent by the first user, since the configuration information records the relevant content of each service module that the tenant has permission to use (such as microservice access address, corresponding API interface of microservice, and request type suitable for microservice to handle), the first gateway determines the service module suitable for handling the request from at least one of the above candidate service modules according to the configuration information, so that the processing of the request can be realized by using the found service module.

[0084] S3: The first gateway forwards the request to the service module corresponding to the tenant to which the first user belongs. The service module corresponding to the tenant to which the first user belongs executes the task indicated by the request using its own database.

[0085] It should be noted that this application does not limit the implementation method of "the first gateway forwarding the request to the service module corresponding to the tenant to which the first user belongs". For example, when the first gateway includes an interface (such as an API interface) corresponding to the service module, the first gateway forwards the request to the service module corresponding to the tenant to which the first user belongs through the interface (such as an API interface). Figure 4 The microservices shown enable the first gateway to subsequently receive the processing results of the request (such as those from the service module corresponding to the tenant to which the first user belongs) through this interface. Figure 4 (Analysis results shown).

[0086] For the service module corresponding to the tenant to which the first user belongs, its corresponding database refers to the database used when the service module to which the first user belongs processes a request; moreover, this application does not limit the implementation method of the database. For example, if the first user is a tenant with private deployment requirements (such as...), Figure 4 The private tenant shownFigure 3 If the first user's tenant is private tenant 1 or private tenant 2, then the database corresponding to the service module of that tenant is the database configured in the private network of that tenant (e.g., private tenant 1 or private tenant 2). Figure 4 The private database shown Figure 3 (Private database 1 or private database 2 shown).

[0087] For example, if the first user mentioned above is a tenant who does not have a need for private deployment (such as...) Figure 4 The general tenant shown Figure 3 If the public tenant shown is a first user, then the database corresponding to the service module of the first user's tenant is the database configured in the first network (e.g., public tenant). Figure 4 The general database shown Figure 3 (The cloud database shown).

[0088] Furthermore, this application does not limit the execution process of the task indicated in the above request. For ease of understanding, some examples are provided below.

[0089] Example 1: In some scenarios (such as when an access request is sent by a tenant without a need for private deployment), the execution process of the task indicated by the above request may include: responding to the fact that the database corresponding to the service module of the first user's tenant is deployed in the first network, it can be determined that the database and the service module corresponding to the first user's tenant are located in the same network (e.g., Figure 3 In the cloud network shown, the service module corresponding to the tenant to which the first user belongs first directly queries the database for data that matches the request; then the service module corresponding to the tenant to which the first user belongs executes the task indicated by the request based on the matching data.

[0090] Therefore, in one possible implementation, when the tenant to which the first user belongs is the first tenant, the service module corresponding to the tenant to which the first user belongs is the first service module, and the working principle of the first service module may include: the first service module retrieves data from its own corresponding database in the first network (such as...). Figure 3 The first service module retrieves data matching the task indicated in the above request from the cloud database shown; the first service module executes the task based on the matching data to meet the access needs of some public tenants.

[0091] Example 2: In some scenarios (such as when a tenant with private deployment needs sends an access request), the execution process of the task indicated by the above request may include: responding to the database deployment of the service module corresponding to the first user's tenant on the second network (e.g., Figure 3In the private network 1 or private network 2 shown, it can be determined that the network where the database is located is isolated from the network where the third service module is located. Therefore, the service module corresponding to the tenant to which the first user belongs is connected through the second gateway (e.g., Figure 3 The VPN gateway 1 or VPN gateway 2 shown retrieves data matching the request from the database. The service module corresponding to the tenant to which the first user belongs executes the task indicated by the request based on the matching data. In this way, cross-network communication can be achieved by using the traffic distribution method of the second gateway pre-configured for the service module to which the first user belongs, thereby reducing the management difficulty of the service corresponding to the tenant while satisfying the security of the database.

[0092] As can be seen, in one possible implementation, when the tenant to which the first user belongs is the second tenant, the service module corresponding to the tenant to which the first user belongs is the second service module, and the working principle of the second service module may include: the second service module obtaining data matching the task indicated by the request from its own database in the second network through the second gateway; the second service module executing the task according to the matching data to meet the access needs of each private tenant.

[0093] Based on the above S1 to S3, the multi-tenant hybrid deployment scheme provided in this application is as follows: For the first network of the service provider (such as a NaaS service provider), a first gateway, a configuration center, and multiple service modules are configured in the first network (such as a cloud network). These multiple service modules include a first service module configured for the first tenant (such as a public tenant) and a second service module configured for the second tenant (such as a private tenant). A database corresponding to the first service module and a second gateway corresponding to the second service module are configured in the first network. The second service module accesses the database corresponding to the second service module configured in the second tenant's second network (such as a private network) through the second gateway. This allows the first gateway to receive a first user (such as a tenant with private deployment needs, a tenant with customized needs, or a tenant with general needs). When a tenant sends a request, the first gateway first determines the tenant to which the first user belongs based on the user identifier carried in the request; then it searches the configuration information corresponding to the tenant to which the first user belongs in the configuration center, so that the configuration information can indicate which candidate service modules can be selected in advance when processing the request sent by the tenant to which the first user belongs; then, based on the configuration information and the request, the first gateway determines the service module corresponding to the tenant to which the first user belongs from the multiple service modules that is suitable for processing the request; then, the first gateway forwards the request to the service module corresponding to the tenant to which the first user belongs, so that the service module corresponding to the tenant to which the first user belongs can use its own corresponding database to execute the task indicated by the request. In this way, multi-tenant service hybrid deployment can be achieved through the first gateway and the second gateway, thereby reducing service maintenance costs.

[0094] Research has revealed that for personnel within the First Network (such as administrators and operations personnel), these personnel may need to perform certain operations on the services corresponding to any tenant, such as management operations and operations maintenance operations.

[0095] Based on the above research, in order to better meet the requirements shown in the previous paragraph, the above multi-tenant hybrid deployment method may further include the following steps performed by the first gateway: receiving instruction information sent by an administrator user (such as an operations and maintenance personnel, management personnel, etc.), wherein the instruction information carries a first identifier as the identifier of the service provider and a second identifier as the identifier of the managed tenant (such as the first tenant or the second tenant), so that the instruction information can instruct the service provider's administrator user to perform certain tasks (such as operations and maintenance tasks, etc.) for the managed tenant; and searching for the configuration information corresponding to the administrator user in the configuration center, so that the configuration information can indicate whether the administrator user has... The management permissions of the managed tenant are determined; in response to the configuration information corresponding to the administrator user indicating that the administrator user has management permissions for the managed tenant, the configuration information corresponding to the managed tenant is retrieved from the configuration center so that the configuration information can indicate which service modules are pre-configured for the managed tenant; based on the indication information and the configuration information corresponding to the managed tenant, the service module corresponding to the managed tenant is determined from multiple service modules; the indication information is forwarded to the service module corresponding to the managed tenant, and the service module corresponding to the managed tenant uses its own corresponding database to execute the task described in the indication information, thus realizing the requirement for the service provider to manage any tenant.

[0096] Based on the above-mentioned multi-tenant hybrid deployment method, it can be seen that the technical solution provided in this application has the characteristics shown in (1) to (7) below.

[0097] (1) The technical solution provided in this application is a multi-tenant hybrid deployment solution implemented through an API gateway under a microservice architecture. This solution can flexibly and efficiently complete the service management for multiple tenants, so as to effectively improve resource utilization and reduce service maintenance costs.

[0098] (2) The technical solution provided in this application solves the following two problems: ① Reducing the operation and maintenance costs of private deployment, specifically: maintaining the private deployment of the data layer (such as databases and other middleware) for tenants with private deployment needs, and connecting the private database (such as...) through a VPN gateway. Figure 4 The private database shown Figure 3The network isolation between the private database 1 or private database 2 shown and NAAS allows relevant NAAS personnel (such as operations and maintenance personnel) to independently deploy, upgrade, and perform other operations and maintenance operations on the cloud network for the services (such as microservices) corresponding to the tenant, minimizing on-site operations and reducing operations and maintenance costs. Traffic distribution of access data is completed through the API gateway to ensure the independence of the private service. Secondly, it reduces the maintenance cost of customized functional requirements. Specifically, the NAAS service as a whole is adjusted to a microservice architecture, splitting the service into multiple service modules (such as multiple functional modules), each deployed independently, so that relevant personnel can develop and deploy corresponding service modules for customized functional requirements. Furthermore, a configuration center is introduced to differentiate the configuration of different functions for different tenants. Traffic distribution is performed through the API gateway using the configuration information recorded in the configuration center, addressing the problem of continuously increasing code complexity due to the increasing number of customized functional requirements.

[0099] (3) The technical solution provided in this application realizes the hybrid deployment of multi-tenant services through API gateway and VPN gateway, which includes at least the following: For tenants with private deployment needs, the deployment of the tenant's data layer (such as database middleware) meets the private management requirements, so that the maintenance of the data layer occurs on-site to ensure that the data layer is isolated from other networks except the private network corresponding to the tenant, thereby ensuring data security and privacy; however, the service (such as microservice) corresponding to the tenant in NAAS is deployed independently through computing resources in the cloud network, so that the traffic of the tenant accessing the service is identified by authentication at the API gateway layer and distributed to the data layer through the VPN gateway to ensure data interoperability between the private network and NAAS, so that a more flexible deployment scheme can be realized through the cloud network in the future, avoiding defects caused by on-site operation and maintenance by relevant personnel, and improving deployment and upgrade efficiency.

[0100] (4) The technical solution provided in this application uses an API gateway to redirect access traffic from different tenants to the corresponding service modules of each tenant, thereby meeting the needs of different tenants. In addition, the solution also introduces a configuration center, which sets different configuration information (such as microservice access address, API interface corresponding to the microservice, and request types that the microservice can handle) for different tenants, so that access traffic from different tenants can be forwarded to their corresponding service modules based on the configuration information and the API gateway, thereby achieving deployment differentiation between different tenants.

[0101] (5) The technical solution provided in this application can split all the functions of NAAS into different service modules as the functions of NAAS (such as general functions) continue to increase, so that different service modules can implement different functions respectively. In this way, the coupling between different functions can be reduced by splitting large-scale functions into multiple lightweight sub-services, thereby improving R&D efficiency, maintenance efficiency and iterative update efficiency.

[0102] (6) The technical solution provided in this application uses the combination of API gateway and configuration center to allocate access traffic of different tenants on demand. This not only meets the different needs of different tenants, but also enables unified management of services corresponding to different tenants, reducing service operation and maintenance costs.

[0103] (7) The technical solution provided in this application achieves the following effects: ① Reduces the operation and maintenance cost of private deployment and improves resource utilization. Specifically, for tenants with private deployment needs, this solution keeps the tenant's data layer in the private network corresponding to the tenant to meet the tenant's data security and privacy protection needs. This solution independently deploys the services (such as microservices) corresponding to the tenant in the cloud network to make full use of the cloud network's good computing expansion capabilities to more flexibly meet the tenant's needs and improve service resource utilization. Since the services corresponding to the tenant are deployed using the cloud network, this can effectively reduce the on-site cost of private deployment, thereby reducing operation and maintenance costs and pressure, and improving product stability. ② Increases the iteration flexibility and expansion capability of services corresponding to tenants with functional customization needs. Specifically, by splitting the microservice architecture, the compatibility issues of NAAS can be effectively reduced, the iteration agility of NAAS can be improved, and the R&D efficiency can be increased, so that NAAS can provide more flexible functional customization services.

[0104] Based on the multi-tenant hybrid deployment method provided in the embodiments of this application, the embodiments of this application also provide a multi-tenant hybrid deployment apparatus, which is described below in conjunction with... Figure 5 Explanation and clarification will be provided. Among them, Figure 5 This is a schematic diagram of a multi-tenant hybrid deployment device provided in an embodiment of this application. It should be noted that for technical details of the multi-tenant hybrid deployment device provided in this embodiment, please refer to the relevant content of the multi-tenant hybrid deployment method described above.

[0105] like Figure 5As shown in the embodiment of this application, the multi-tenant hybrid deployment device 500 configures a first gateway, a configuration center, and multiple service modules in a first network of a service provider. The multiple service modules include a first service module configured for a first tenant and a second service module configured for a second tenant. A database corresponding to the first service module and a second gateway corresponding to the second service module are configured in the first network. The second service module accesses the database corresponding to the second service module configured in the second network of the second tenant through the second gateway. The device 500 includes:

[0106] The lookup unit 501 is used to respond to a request sent by a first user, determine the tenant to which the first user belongs based on the user identifier carried in the request, and look up the configuration information corresponding to the tenant to which the first user belongs in the configuration center.

[0107] The determining unit 502 is used to determine the service module corresponding to the tenant to which the first user belongs from the plurality of service modules based on the configuration information and the request;

[0108] The processing unit 503 is used to forward the request to the service module corresponding to the tenant to which the first user belongs, and the service module corresponding to the tenant to which the first user belongs executes the task indicated by the request using its own database.

[0109] In one possible implementation, the tenant to which the first user belongs is the first tenant, and the service module corresponding to the tenant to which the first user belongs is the first service module; the service module corresponding to the tenant to which the first user belongs executes the task indicated by the request using its own corresponding database, including: the first service module obtaining data matching the task from its own corresponding database in the first network; and the first service module executing the task based on the matching data.

[0110] In one possible implementation, the tenant to which the first user belongs is the second tenant, and the service module corresponding to the tenant to which the first user belongs is the second service module; the service module corresponding to the tenant to which the first user belongs executes the task indicated by the request using its own corresponding database, including: the second service module obtaining data matching the task from its own corresponding database in the second network through the second gateway; and the second service module executing the task based on the matching data.

[0111] In one possible implementation, the device 500 further includes: a management unit, configured to receive instruction information sent by an administrator user, wherein the instruction information carries a first identifier as the identifier of the service provider and a second identifier as the identifier of the managed tenant; search for configuration information corresponding to the administrator user in the configuration center; in response to the configuration information corresponding to the administrator user indicating that the administrator user has management authority over the managed tenant, search for configuration information corresponding to the managed tenant in the configuration center; determine the service module corresponding to the managed tenant from the plurality of service modules based on the instruction information and the configuration information corresponding to the managed tenant; forward the instruction information to the service module corresponding to the managed tenant, wherein the service module corresponding to the managed tenant executes the task described in the instruction information using its own corresponding database.

[0112] In one possible implementation, the first service module includes some or all of the service modules corresponding to at least one general function and at least one service module corresponding to at least one customized function.

[0113] In one possible implementation, the multiple service modules include different microservices.

[0114] In one possible implementation, the service provider is a Network as a Service (NaaS) service provider, which performs NaaS service configuration or management operations on the multi-tenant in the first network through the first gateway and the second gateway.

[0115] In one possible implementation, the device 500 satisfies at least one of the following constraints: the first network is a cloud network; the second network is a private network; different service modules among the plurality of service modules provide different services; different service modules among the plurality of service modules correspond to different interfaces of the first gateway; the first gateway receives requests sent by different users through the same interface; the configuration center records configuration information corresponding to at least one identifier, the at least one identifier including the identifier of the first tenant and the identifier of the second tenant.

[0116] In one possible implementation, the multi-tenant hybrid deployment device 500 is deployed on the first gateway; or, the multi-tenant hybrid deployment device 500 is independent of the first gateway, and the multi-tenant hybrid deployment device 500 is capable of data communication with the first gateway.

[0117] In one possible implementation, the multi-tenant hybrid deployment device 500 may be implemented using software or hardware (such as circuit boards).

[0118] Based on the aforementioned content of the multi-tenant hybrid deployment device 500, it can be understood that the device 500 achieves the following: For the first network of a service provider (such as a NaaS service provider), a first gateway, a configuration center, and multiple service modules are configured in the first network (such as a cloud network). These multiple service modules include a first service module configured for a first tenant (such as a public tenant) and a second service module configured for a second tenant (such as a private tenant). A database corresponding to the first service module and a second gateway corresponding to the second service module are configured in the first network. The second service module accesses the database corresponding to the second service module configured in the second tenant's second network (such as a private network) through the second gateway, so that when the first gateway receives a first user (such as a tenant with private deployment needs, a tenant with customized needs, or a tenant with general needs), the system can be configured to handle the situation. When a request is sent by a tenant (e.g., a user), the first gateway first determines the tenant to which the first user belongs based on the user identifier carried in the request. Then, it searches the configuration information corresponding to the tenant to which the first user belongs in the configuration center, so that the configuration information can indicate which candidate service modules can be selected in advance when processing the request sent by the tenant to which the first user belongs. Then, based on the configuration information and the request, the first gateway determines the service module corresponding to the tenant to which the first user belongs from the multiple service modules that is suitable for processing the request. Then, the first gateway forwards the request to the service module corresponding to the tenant to which the first user belongs, so that the service module corresponding to the tenant to which the first user belongs can use its own database to execute the task indicated by the request. In this way, multi-tenant service hybrid deployment can be achieved through the first gateway and the second gateway, thereby reducing service maintenance costs.

[0119] In addition, this application also provides an electronic device, the device including a processor and a memory: the memory is used to store instructions or computer programs; the processor is used to execute the instructions or computer programs in the memory, so that the electronic device performs any implementation of the multi-tenant hybrid deployment method provided in this application.

[0120] See Figure 6 This diagram illustrates a structural schematic of an electronic device 600 suitable for implementing embodiments of the present disclosure. The terminal devices in the embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 6 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0121] like Figure 6As shown, electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 602 or a program loaded from storage device 608 into random access memory (RAM) 603. RAM 603 also stores various programs and data required for the operation of electronic device 600. Processing device 601, ROM 602, and RAM 603 are interconnected via bus 604. Input / output (I / O) interface 605 is also connected to bus 604.

[0122] Typically, the following devices can be connected to I / O interface 605: input devices 606 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 607 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 608 including, for example, magnetic tapes, hard disks, etc.; and communication devices 609. Communication device 609 allows electronic device 600 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 6 An electronic device 600 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0123] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, it performs the functions defined in the methods of embodiments of this disclosure.

[0124] The electronic device provided in this embodiment belongs to the same inventive concept as the method provided in the above embodiments. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0125] This application also provides a computer-readable medium storing instructions or computer programs that, when executed on a device, cause the device to perform any implementation of the multi-tenant hybrid deployment method provided in this application.

[0126] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0127] In some implementations, clients and servers can communicate using any currently known or future-developed network protocol such as HTTP (Hypertext Transfer Protocol) and can interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and end-to-end networks (e.g., ad hoc end-to-end networks), as well as any currently known or future-developed networks.

[0128] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0129] The aforementioned computer-readable medium carries one or more programs, which, when executed by the electronic device, enable the electronic device to perform the aforementioned methods.

[0130] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including but not limited to object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0131] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0132] The units described in the embodiments of this disclosure can be implemented in software or hardware. The names of the units / modules do not necessarily limit the specific unit itself.

[0133] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), System-on-Chip (SoCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0134] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0135] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems or apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and relevant parts can be referred to the method section.

[0136] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0137] It should also be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0138] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0139] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A multi-tenant hybrid deployment method, characterized in that, In the first network of the service provider, a first gateway, a configuration center and multiple service modules are configured. The multiple service modules include a first service module configured for a first tenant and a second service module configured for a second tenant. In the first network, a database corresponding to the first service module and a second gateway corresponding to the second service module are configured. The second service module accesses the database corresponding to the second service module configured in the second network of the second tenant through the second gateway. The method includes the following steps performed by the first gateway: In response to receiving a request from a first user, the system determines the tenant to which the first user belongs based on the user identifier carried in the request, and retrieves the configuration information corresponding to the tenant to which the first user belongs from the configuration center. Based on the configuration information and the request, determine the service module corresponding to the tenant to which the first user belongs from the plurality of service modules; The request is forwarded to the service module corresponding to the tenant to which the first user belongs, and the service module corresponding to the tenant to which the first user belongs executes the task indicated by the request using its own database.

2. The method according to claim 1, characterized in that, The tenant to which the first user belongs is the first tenant, and the service module corresponding to the tenant to which the first user belongs is the first service module; The service module corresponding to the tenant to which the first user belongs executes the task indicated by the request using its own database, including: The first service module retrieves data matching the task from its own corresponding database in the first network; The first service module executes the task based on the matched data.

3. The method according to claim 1, characterized in that, The tenant to which the first user belongs is the second tenant, and the service module corresponding to the tenant to which the first user belongs is the second service module. The service module corresponding to the tenant to which the first user belongs executes the task indicated by the request using its own database, including: The second service module retrieves data matching the task from its own corresponding database in the second network through the second gateway; The second service module executes the task based on the matched data.

4. The method according to claim 1, characterized in that, The method further includes the following steps performed by the first gateway: Receive instruction information sent by the administrator user, wherein the first identifier carried by the instruction information is the identifier of the service provider, and the second identifier carried by the instruction information is the identifier of the managed tenant; Retrieve the configuration information corresponding to the administrator user from the configuration center; In response to the configuration information corresponding to the administrator user indicating that the administrator user has management authority over the managed tenant, the configuration information corresponding to the managed tenant is retrieved from the configuration center; Based on the instruction information and the configuration information corresponding to the managed tenant, the service module corresponding to the managed tenant is determined from the plurality of service modules; The instruction information is forwarded to the service module corresponding to the managed tenant, and the service module corresponding to the managed tenant uses its own database to execute the task described in the instruction information.

5. The method according to claim 1, characterized in that, The first service module includes some or all of the service modules corresponding to at least one general function and at least one service module corresponding to at least one customized function.

6. The method according to claim 1, characterized in that, The multiple service modules include different microservices.

7. The method according to claim 1, characterized in that, The service provider is a Network as a Service (NaaS) service provider, which performs NaaS service configuration or management operations on the multi-tenant in the first network through the first gateway and the second gateway.

8. The method according to any one of claims 1-7, characterized in that, The method satisfies at least one of the following constraints: The first network is a cloud network; The second network is a private network; Each of the multiple service modules provides different services; The different service modules in the plurality of service modules correspond to different interfaces of the first gateway; The first gateway receives requests from different users through the same interface; The configuration center records configuration information corresponding to at least one identifier, and the at least one identifier includes the identifier of the first tenant and the identifier of the second tenant.

9. A multi-tenant hybrid deployment device, characterized in that, In the first network of the service provider, a first gateway, a configuration center and multiple service modules are configured. The multiple service modules include a first service module configured for a first tenant and a second service module configured for a second tenant. In the first network, a database corresponding to the first service module and a second gateway corresponding to the second service module are configured. The second service module accesses the database corresponding to the second service module configured in the second network of the second tenant through the second gateway. The device includes: The lookup unit is used to respond to a request sent by a first user, determine the tenant to which the first user belongs based on the user identifier carried in the request, and look up the configuration information corresponding to the tenant to which the first user belongs in the configuration center. The determining unit is configured to determine, from the plurality of service modules, the service module corresponding to the tenant to which the first user belongs, based on the configuration information and the request; The processing unit is used to forward the request to the service module corresponding to the tenant to which the first user belongs, and the service module corresponding to the tenant to which the first user belongs executes the task indicated by the request using its own database.

10. An electronic device, characterized in that, The device includes: a processor and a memory; The memory is used to store instructions or computer programs; The processor is configured to execute the instructions or computer program in the memory to cause the electronic device to perform the method according to any one of claims 1-8.

11. A computer-readable medium, characterized in that, The computer-readable medium stores instructions or computer programs that, when executed on the device, cause the device to perform the method according to any one of claims 1-8.

12. A computer program product, characterized in that, It includes a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the method of any one of claims 1-8.

Images