Method for Providing PaaS Service, Management System, and Cloud Computing Service Architecture

CROSS-REFERENCE TO RELATED APPLICATIONS

0001This application is a continuation application of International Application No. PCT/CN2018/074278, filed on Jan. 26, 2018, which claims priority to Chinese Patent Application No. 201710216079.5, filed on Apr. 1, 2017. The disclosures of the aforementioned applications are hereby incorporated by reference in their entireties.

TECHNICAL FIELD

0002This application relates to the field of cloud computing services, and more specifically, to a method for providing a platform as a service (PaaS) service, a management system, and a cloud computing service architecture.

BACKGROUND

0003In cloud computing services, services provided by a cloud computing service architecture for a user usually include an infrastructure as a service (IaaS) service, a platform as a service (PaaS) service, a software as a service (SaaS) service, and the like.

0004When a user leases both the PaaS service and the IaaS service in the cloud computing service architecture, resource management performed by the IaaS service and resource management performed by the PaaS service conflict with each other in an existing management system. The IaaS service manages an infrastructure resource of the user, for example, at least one of infrastructure resources such as a central processing unit (Central Processing Unit, CPU), a memory, a storage medium, a network, and a router (router), and the infrastructure resource of the user includes an infrastructure resource of a software service provided for running the PaaS service. In addition, the PaaS service is based on the IaaS service, and the PaaS service deploys a common software service on an infrastructure resource provided by the IaaS service. Therefore, both the PaaS service and the IaaS service can manage infrastructure resources together, and consequently a conflict occurs between management performed by the PaaS service and management performed by the IaaS service. For example, the infrastructure resource of the software service provided for running the PaaS service can be deleted on a service page of the IaaS service. For another example, a network policy of the IaaS service may affect internal communication of the PaaS service.

SUMMARY

0005This application provides a method for providing a PaaS service, a management system, and a cloud computing service architecture, so that not only a multi-tenant requirement is met, but also a conflict problem existing between infrastructure resource management performed by an IaaS service and infrastructure resource management performed by a PaaS service can be resolved.

0006According to a first aspect, a method for providing a platform as a service PaaS service is provided. The method includes: receiving, by a PaaS management system, a PaaS operation request sent by a first real tenant, where the PaaS operation request is used to indicate a PaaS operation intended for a PaaS resource; determining, by the PaaS management system, information about a first virtual tenant corresponding to the first real tenant, where there are one-to-one correspondences between real tenants and virtual tenants, and the first real tenant and the first virtual tenant are a pair in the one-to-one correspondences; and controlling, by the PaaS management system based on the PaaS operation request and the information about the first virtual tenant by using the first virtual tenant, an infrastructure as a service IaaS management system to process an IaaS operation corresponding to the PaaS operation.

0007According to the method for providing a PaaS service in the first aspect, one corresponding virtual tenant is introduced for each real tenant in the PaaS management system, so that the PaaS management system manages an infrastructure resource by using the virtual tenant. The first real tenant and the first virtual tenant are a pair in a plurality of one-to-one correspondences. Therefore, the first real tenant is isolated, by using the virtual tenant corresponding to the first real tenant, from another real tenant in management performed by a PaaS service. In this way, management of a plurality of tenants is isolated from each other, and a conflict problem existing between infrastructure resource management performed by an IaaS service and infrastructure resource management performed by a PaaS service can be further resolved.

0008In a possible implementation of the first aspect, the IaaS management system is a management system configured to process an IaaS operation in a cloud computing service architecture; the cloud computing service architecture provides an IaaS service for the first real tenant based on a first infrastructure resource group; only the first real tenant has permission to manage an infrastructure resource in the first infrastructure resource group; the PaaS management system is a management system configured to process a PaaS operation in the cloud computing service architecture; the cloud computing service architecture provides a PaaS service for the first real tenant based on a second infrastructure resource group; and only the first virtual tenant has permission to manage an infrastructure resource in the second infrastructure resource group. In this possible implementation, in the cloud computing service architecture, an infrastructure resource corresponding to an IaaS operation request initiated by a real tenant by using the IaaS management system and an infrastructure resource corresponding to a PaaS operation request initiated by the real tenant by using the PaaS management system are isolated from each other. This can not only resolve a conflict problem existing between management performed by the IaaS service and management performed by the PaaS service but also improve security of a cloud computing service.

0009In a possible implementation of the first aspect, a PaaS instance provided by the cloud computing service architecture for the first real tenant includes a management network adapter, and the method further includes: performing, by the PaaS management system, management communication between infrastructure resources in the second infrastructure resource group by using the management network adapter. In this possible implementation, the PaaS management system performs internal communication of the PaaS service and control communication of a background of the PaaS management system by using the management network adapter.

0010In a possible implementation of the first aspect, the PaaS instance provided by the cloud computing service architecture for the first real tenant includes a data network adapter, and the method further includes: performing, by the PaaS management system, data communication between the PaaS instance and the first infrastructure resource group by using the data network adapter. In this possible implementation, the PaaS management system performs external communication of the PaaS service by using the data network adapter.

0011In a possible implementation of the first aspect, the receiving, by a PaaS management system, a PaaS operation request sent by a first real tenant includes: receiving, by the PaaS management system, a PaaS operation request that instructs to apply for the PaaS instance and that is sent by the first real tenant; and the controlling, by the PaaS management system based on the PaaS operation request and the information about the first virtual tenant by using the first virtual tenant, an infrastructure as a service IaaS management system to process an IaaS operation corresponding to the PaaS operation includes: determining, by the PaaS management system based on the PaaS operation request, that the IaaS operation corresponding to the PaaS operation is creating the PaaS instance and creating the data network adapter; and controlling, by the PaaS management system by using the first virtual tenant, the IaaS management system to create the PaaS instance and create the data network adapter. This possible implementation is applicable to a case in which a real tenant applies for a PaaS instance for the first time.

0012In a possible implementation of the first aspect, the receiving, by a PaaS management system, a PaaS operation request sent by a first real tenant includes: receiving, by the PaaS management system, a PaaS operation request that instructs to change the PaaS instance and that is sent by the first real tenant; and the controlling, by the PaaS management system based on the PaaS operation request and the information about the first virtual tenant by using the first virtual tenant, an infrastructure as a service IaaS management system to process an IaaS operation corresponding to the PaaS operation includes: determining, by the PaaS management system based on the PaaS operation request, that the IaaS operation corresponding to the PaaS operation is changing a parameter of the PaaS instance; and controlling, by the PaaS management system by using the first virtual tenant, the IaaS management system to change the parameter of the PaaS instance. This possible implementation is applicable to a case in which a real tenant changes a PaaS instance.

0013According to a second aspect, a platform as a service PaaS management system is provided. The PaaS management system includes: a receiving module, configured to receive a PaaS operation request sent by a first real tenant, where the PaaS operation request is used to indicate a PaaS operation intended for a PaaS resource; and a processing module, configured to determine information about a first virtual tenant corresponding to the first real tenant, where there are one-to-one correspondences between real tenants and virtual tenants, and the first real tenant and the first virtual tenant are a pair in the one-to-one correspondences; and the processing module is further configured to control, based on the PaaS operation request and the information about the first virtual tenant by using the first virtual tenant, an infrastructure as a service IaaS management system to process an IaaS operation corresponding to the PaaS operation.

0014In a possible implementation of the second aspect, the IaaS management system is a management system configured to process an IaaS operation in a cloud computing service architecture; the cloud computing service architecture provides an IaaS service for the first real tenant based on a first infrastructure resource group; only the first real tenant has permission to manage an infrastructure resource in the first infrastructure resource group; the PaaS management system is a management system configured to process a PaaS operation in the cloud computing service architecture; the cloud computing service architecture provides a PaaS service for the first real tenant based on a second infrastructure resource group; and only the first virtual tenant has permission to manage an infrastructure resource in the second infrastructure resource group.

0015In a possible implementation of the second aspect, a PaaS instance provided by the cloud computing service architecture for the first real tenant includes a management network adapter, and the management network adapter is configured to perform management communication between infrastructure resources in the second infrastructure resource group.

0016In a possible implementation of the second aspect, the PaaS instance provided by the cloud computing service architecture for the first real tenant includes a data network adapter, and the data network adapter is configured to perform data communication between the PaaS instance and the first infrastructure resource group.

0017In a possible implementation of the second aspect, the receiving module is specifically configured to receive a PaaS operation request that instructs to apply for the PaaS instance and that is sent by the first real tenant; and the processing module is specifically configured to: determine, based on the PaaS operation request, that the IaaS operation corresponding to the PaaS operation is creating the PaaS instance and creating the data network adapter; and control, by using the first virtual tenant, the IaaS management system to create the PaaS instance and create the data network adapter.

0018In a possible implementation of the second aspect, the receiving module is specifically configured to receive a PaaS operation request that instructs to change the PaaS instance and that is sent by the first real tenant; and the processing module is specifically configured to: determine, based on the PaaS operation request, that the IaaS operation corresponding to the PaaS operation is changing a parameter of the PaaS instance; and control, by using the first virtual tenant, the IaaS management system to change the parameter of the PaaS instance.

0019According to a third aspect, a cloud computing service architecture is provided. The cloud computing service architecture provides an infrastructure as a service IaaS service and a platform as a service PaaS service for a first real tenant; the cloud computing service architecture includes a first infrastructure resource group and a second infrastructure resource group; the cloud computing service architecture provides the IaaS service for the first real tenant based on the first infrastructure resource group; only the first real tenant has permission to manage an infrastructure resource in the first infrastructure resource group; the cloud computing service architecture provides the PaaS service for the first real tenant based on the second infrastructure resource group; only a first virtual tenant has permission to manage an infrastructure resource in the second infrastructure resource group; and there are one-to-one correspondences between real tenants and virtual tenants, and the first real tenant and the first virtual tenant are a pair in the one-to-one correspondences.

0020In a possible implementation of the third aspect, the second infrastructure resource group includes a PaaS instance; the PaaS instance includes a data network adapter; and the data network adapter is configured to perform data communication between the PaaS instance and the first infrastructure resource group.

0021According to a fourth aspect, a platform as a service PaaS management system is provided. The PaaS management system includes a network interface, a processor, and a memory; the memory is configured to store an instruction; the processor and the network interface are configured to execute the instruction stored in the memory; and when the processor and the network interface execute the instruction stored in the memory, the PaaS management system is configured to perform the method for providing a PaaS service in any one of the first aspect and the implementations of the first aspect.

0022According to a fifth aspect, a computer storage medium is provided. The computer storage medium is configured to store a computer program, and the computer program includes an instruction used to perform the method for providing a PaaS service in any one of the first aspect and the implementations of the first aspect. The computer storage medium includes but is not limited to a read-only memory, a random access memory, a flash memory, a hard disk drive (HDD), or a solid-state drive (SSD).

0023According to a sixth aspect, a computer program product is provided. The computer program product includes a program instruction. When the computer program product is executed by a computing device, the computing device performs the method for providing a PaaS service in any one of the first aspect and the implementations of the first aspect. The computer program product may be a software installation package. When the method for providing a PaaS service in any one of the first aspect and the implementations of the first aspect needs to be used, the computer program product may be downloaded, and may be executed on the computing device.

0024It should be understood that the real tenant in this application is a tenant who leases the PaaS service and who can initiate a PaaS operation request by using the PaaS management system. However, the real tenant does not have permission to manage an infrastructure resource finally corresponding to the PaaS operation request. In other words, the real tenant does not have permission to manage, by using the IaaS management system, the infrastructure resource corresponding to the PaaS operation request. Alternatively, the real tenant may be a tenant who leases the IaaS service and who can initiate an IaaS operation request by using the IaaS management system. The real tenant has permission to manage an infrastructure resource corresponding to the IaaS operation request initiated by the real tenant by using the IaaS management system.

0025It should be understood that the virtual tenant in this application is not a tenant who actually exists, but a tenant that is allocated to the real tenant by the PaaS management system, that is used as a proxy for the real tenant, and that has permission to manage the infrastructure resource corresponding to the PaaS operation request. In other words, the virtual tenant has permission to manage, by using the IaaS management system, the infrastructure resource corresponding to the PaaS operation request. However, the virtual tenant does not have permission to manage the infrastructure resource corresponding to the IaaS operation request initiated by the real tenant by using the IaaS management system.

BRIEF DESCRIPTION OF DRAWINGS

0026<figref idref="DRAWINGS">FIG. 1</figref> is a schematic block diagram of a PaaS management system according to an embodiment of this application;

0027<figref idref="DRAWINGS">FIG. 2</figref> is a schematic framework of a multi-tenant component that is applied to a PaaS management system according to an embodiment of this application;

0028<figref idref="DRAWINGS">FIG. 3</figref> is a schematic block diagram of a cloud computing service architecture according to an embodiment of this application;

0029<figref idref="DRAWINGS">FIG. 4</figref> is a schematic flowchart of a method for providing a PaaS service according to an embodiment of this application;

0030<figref idref="DRAWINGS">FIG. 5A</figref> and <figref idref="DRAWINGS">FIG. 5B</figref> are a schematic flowchart of a method for providing a PaaS service according to another embodiment of this application;

0031<figref idref="DRAWINGS">FIG. 6</figref> is a schematic flowchart of a method for providing a PaaS service according to another embodiment of this application; and

0032<figref idref="DRAWINGS">FIG. 7</figref> is a schematic block diagram of a PaaS management system according to another embodiment of this application.

DESCRIPTION OF EMBODIMENTS

0033The following describes the technical solutions in this application with reference to the accompanying drawings.

0034In cloud computing services, services provided by a cloud computing service architecture for a user usually include an Infrastructure as a Service (IaaS) service, a Platform as a Service (PaaS) service, a Software as a Service (SaaS) service, and the like.

0035The IaaS service provides, in a form of a service, the user with permission to use at least one of infrastructure resources such as a CPU, a memory, a storage medium, a network, and a router. The user does not need to care about or manage any specific hardware resource, and the service saves a place and manpower and reduces maintenance costs. In addition, the IaaS service provides pay-as-you-grow convenience and subscribe-and-use convenience for the user, significantly improving flexibility of managing information technology (Information Technology, IT) infrastructure resources by the user.

0036The PaaS service provides the user with an IaaS service-based software platform in a form of a service. The PaaS service invokes a hardware resource by using an Application Programming Interface (API) provided by the IaaS service. The hardware resource integrates with a common software business capability, to provide the user with complete infrastructure resource application services, for example, a database service, a messaging service, and a cache service. With the PaaS service, the user can focus more on a software service on an application software platform, without paying attention to application, expansion, and maintenance of infrastructure resources.

0037The SaaS service is a mode in which a software service is provided by using the Internet. A vendor deploys all software on a server of the vendor. The user may subscribe to a required software service from the vendor based on an actual requirement of the user by using the Internet.

0038A multi-tenancy technology, or referred to as a multi-leasing technology, is a software architecture technology. The multi-tenancy technology explores and implements how to share a same system or program component in a multi-tenant environment while still ensuring data isolation between tenants.

0039The multi-tenancy technology is widely used in the SaaS service and the IaaS service, and becomes a key technology of the SaaS service. In consensus of the industry, the multi-tenancy technology is generally divided into different categories by isolation degree: a hardware virtualization multi-tenancy technology, a database isolation multi-tenancy technology, a database sharing multi-tenancy technology, and the like. With reference to classification of an IT consulting company Gartner (Gartner), more detailed classification may be performed for the multi-tenancy technology. For example, the multi-tenancy technology may be further divided into categories such as a hardware sharing multi-tenancy technology, an operating system (Operating System, OS) sharing multi-tenancy technology, a database sharing multi-tenancy technology, and an everything sharing multi-tenancy technology.

0040In the industry, a hardware sharing method is selected to implement the multi-tenancy technology for most IaaS services for the following reasons: First, a hardware virtualization technology is mature and of moderate difficulty, and second, hardware virtualization accords with an idea of the IaaS service. The SaaS service has an obvious commonality in user requirements because businesses of the SaaS service are highly consistent, in other words, the provided businesses are oriented to a specific field. Most of companies with a profound data sharing capability, for example, Google, select the everything sharing multi-tenancy technology.

0041When the user leases both the PaaS service and the IaaS service in the cloud computing service architecture, resource management performed by the IaaS service and resource management performed by the PaaS service conflict with each other in an existing management system. The IaaS service manages an infrastructure resource of the user, for example, at least one of infrastructure resources such as a CPU, a memory, a storage medium, a network, and a router, and the infrastructure resource of the user includes an infrastructure resource of a software service provided for running the PaaS service. In addition, the PaaS service is based on the IaaS service, and the PaaS service deploys a common software service on an infrastructure resource provided by the IaaS service. Therefore, both the PaaS service and the IaaS service can manage infrastructure resources together, and consequently a conflict occurs between management performed by the PaaS service and management performed by the IaaS service. For example, the infrastructure resource of the software service provided for running the PaaS service can be deleted on a service page of the IaaS service. For another example, a network policy of the IaaS service may affect internal communication of the PaaS service.

0042In addition, to reduce management work of the user, the PaaS service provides the user only with a service address and a port. However, in an existing solution, when a user leases both the PaaS service and the IaaS service, for the user, an infrastructure resource corresponding to the PaaS service is exposed to the user in an IaaS management system. As a result, the user needs to care about resulting problems, for example, port security and a firewall access rule. These resulting tasks are not originally required by the user, and also bring a security risk to the user.

0043To resolve the foregoing problem, this application provides, on the basis of a hardware sharing IaaS, an improved PaaS management system that can meet a multi-tenant requirement. <figref idref="DRAWINGS">FIG. 1</figref> is a schematic block diagram of a PaaS management system <b>100</b> according to an embodiment of this application. The PaaS management system <b>100</b> may include: a receiving module <b>110</b>, configured to receive a PaaS operation request sent by a first real tenant, where the PaaS operation request is used to indicate a PaaS operation intended for a PaaS resource; and a processing module <b>120</b>, configured to determine information about a first virtual tenant corresponding to the first real tenant, where there are one-to-one correspondences between real tenants and virtual tenants, and the first real tenant and the first virtual tenant are a pair in the one-to-one correspondences; and the processing module <b>120</b> is further configured to control, based on the PaaS operation request and the information about the first virtual tenant by using the first virtual tenant, an IaaS management system to process an IaaS operation corresponding to the PaaS operation.

0044A cloud computing service architecture may provide a PaaS service for the first real tenant by using the PaaS management system <b>100</b> in this embodiment of this application. The cloud computing service architecture may provide an IaaS service for the first real tenant by using the IaaS management system.

0045The receiving module <b>110</b> in the PaaS management system <b>100</b> may specifically include a PaaS tenant service component that is configured to interact with a real tenant. The processing module <b>120</b> may specifically include some functions of the PaaS tenant service component, a virtual tenant resource pool component that manages the one-to-one correspondences between real tenants and virtual tenants, and a PaaS tenant proxy component that is used as a proxy for the real tenant to perform an IaaS operation.

0046The following provides a detailed description with reference to <figref idref="DRAWINGS">FIG. 2</figref>. <figref idref="DRAWINGS">FIG. 2</figref> is a schematic block diagram of an application PaaS management system <b>200</b> according to an embodiment of this application. As shown in <figref idref="DRAWINGS">FIG. 2</figref>, the PaaS management system <b>200</b> is a management system of a cloud computing service architecture at a platform (Platform, P) layer. In other words, the PaaS management system is a management system configured to process a PaaS operation in the cloud computing service architecture. An IaaS management system <b>300</b> is a management system of the cloud computing service architecture at an infrastructure (Infrastructure, I) layer. In other words, the IaaS management system is a management system configured to process an IaaS operation in the cloud computing service architecture. For a tenant, for example, a first real tenant, the cloud computing service architecture provides a PaaS service for the first real tenant by using the PaaS management system <b>200</b>. In addition, the cloud computing service architecture may also provide an IaaS service for the first real tenant by using the IaaS management system <b>300</b>. However, this is not limited in this embodiment of this application.

0047The PaaS management system <b>200</b> shown in <figref idref="DRAWINGS">FIG. 2</figref> includes a PaaS tenant service component <b>210</b>, a virtual tenant resource pool component <b>220</b>, and a PaaS tenant proxy component <b>230</b>.

0048The PaaS tenant service component <b>210</b> is configured to receive a PaaS operation request sent by the first real tenant to the PaaS management system <b>200</b>. The PaaS operation request is used to indicate a PaaS operation intended for a PaaS resource. Herein the PaaS resource is an infrastructure resource and a software resource on the infrastructure resource. Specifically, the PaaS tenant service component <b>210</b> is configured to interact with a real tenant and respond to a PaaS operation request from the real tenant. The PaaS tenant service component <b>210</b> may be an application deployed in a web (web) container of the infrastructure resource, and provide an interface for a cloud computing service page in an HTTP form. The real tenant may send the PaaS operation request to the PaaS tenant service component <b>210</b> by using the cloud computing service page. The PaaS tenant service component <b>210</b> responds to the PaaS operation request and processes a related PaaS operation, for example, applying for a PaaS instance, restarting a PaaS instance, changing a PaaS instance, or deleting a PaaS instance.

0049The PaaS tenant service component <b>210</b> is further configured to interact with the virtual tenant resource pool component <b>220</b> and the PaaS tenant proxy component <b>230</b>, to perform the PaaS operation for the real tenant. The PaaS tenant service component <b>210</b> requests a first virtual tenant corresponding to the first real tenant from the virtual tenant resource pool component <b>220</b>. The PaaS tenant service component <b>210</b> further performs corresponding processing, and separates an IaaS operation corresponding to the PaaS operation indicated by the PaaS operation request, so that the PaaS tenant proxy component <b>230</b> performs the IaaS operation subsequently.

0050It should be understood that, as shown in <figref idref="DRAWINGS">FIG. 2</figref>, the PaaS tenant service component <b>210</b> may perform logic such as necessary authentication and a necessary security check by using an identity and access management (IAM) component.

0051The virtual tenant resource pool component <b>220</b> is configured to manage one-to-one correspondences between real tenants and virtual tenants. The first real tenant and the first virtual tenant are a pair in the one-to-one correspondences. The virtual tenant resource pool component <b>220</b> is further configured to send information about the first virtual tenant to the PaaS tenant service component <b>210</b>.

0052Specifically, the virtual tenant resource pool component <b>220</b> may also be a built-in component, and interacts with the PaaS tenant service component <b>210</b> in a form of a program interface. Both the virtual tenant resource pool component <b>220</b> and the PaaS tenant service component <b>210</b> are deployed in a same application of a same web container. In an embodiment of this application, the cloud computing service architecture may preset a plurality of virtual tenants to form a resource pool that is stored in the virtual tenant resource pool component <b>220</b> for use. For a real tenant who leases both the IaaS service and the PaaS service, when the real tenant applies for a PaaS instance for the first time, the PaaS tenant service component <b>210</b> initiates an invocation of virtual tenant selection to the virtual tenant resource pool component <b>220</b>. In this case, the virtual tenant resource pool component <b>220</b> allocates an unoccupied virtual tenant to the real tenant from an internal resource pool, records a correspondence between the real tenant and the virtual tenant, and returns information about the virtual tenant to the PaaS tenant service component <b>210</b>.

0053After allocating a virtual tenant to each real tenant, the virtual tenant resource pool component <b>220</b> records correspondences between real tenants and virtual tenants one by one. In a subsequent PaaS operation request process (for example, when a real tenant re-applies for, changes, or deletes a PaaS instance), the virtual tenant resource pool component <b>220</b> directly returns information about a corresponding virtual tenant to the PaaS tenant service component <b>210</b>.

0054It should be understood that the real tenant in the embodiments of this application is a tenant who leases the PaaS service and who can initiate a PaaS operation request by using the PaaS management system. However, the real tenant does not have permission to manage an infrastructure resource finally corresponding to the PaaS operation request. In other words, the real tenant does not have permission to manage, by using the IaaS management system, the infrastructure resource corresponding to the PaaS operation request. Alternatively, the real tenant may be a tenant who leases the IaaS service and who can initiate an IaaS operation request by using the IaaS management system. The real tenant has permission to manage an infrastructure resource corresponding to the IaaS operation request initiated by the real tenant by using the IaaS management system. For example, the real tenant is registered by a user in the PaaS management system. The user may set a user name and a password for identity authentication performed by the PaaS management system, so that the user can log in to the PaaS management system to use the PaaS service. The virtual tenant is not a tenant who actually exists, but a tenant that is allocated to the real tenant by the PaaS management system, that is used as a proxy for the real tenant, and that has permission to manage the infrastructure resource corresponding to the PaaS operation request. In other words, the virtual tenant has permission to manage, by using the IaaS management system, the infrastructure resource corresponding to the PaaS operation request. For example, the virtual tenant is an ID or a number allocated by the PaaS management system to a registered real tenant. However, the virtual tenant does not have permission to manage the infrastructure resource corresponding to the IaaS operation request initiated by the real tenant by using the IaaS management system. For the IaaS management system, the real tenant and the virtual tenant are two different tenants, and the IaaS management system isolates management permission of the real tenant from that of the virtual tenant.

0055The PaaS tenant proxy component <b>230</b> is configured to receive the information about the first virtual tenant and related information of the IaaS operation corresponding to the PaaS operation that are sent by the PaaS tenant service component <b>210</b>, work as a proxy for the first real tenant by using the first virtual tenant, and control the IaaS management system <b>300</b> to process the IaaS operation corresponding to the PaaS operation.

0056Specifically, the PaaS tenant proxy component <b>230</b> mainly performs identity proxy work for the real tenant, and controls, with a proxy identity of the real tenant, the IaaS management system <b>300</b> to manage a corresponding infrastructure resource.

0057After selecting or retrieving the first virtual tenant corresponding to the first real tenant, the virtual tenant resource pool component <b>220</b> sends the information about the first virtual tenant to the PaaS tenant service component <b>210</b>. The PaaS tenant service component <b>210</b> sends the information about the first virtual tenant and the related information of the IaaS operation corresponding to the PaaS operation to the PaaS tenant proxy component <b>230</b>. The PaaS tenant proxy component <b>230</b> works as the proxy for the first real tenant by using the first virtual tenant, and controls the IaaS management system <b>300</b> to process the IaaS operation corresponding to the PaaS operation, for example, create a Virtual Machine (VM) (that is, create a PaaS instance), change a VM resource, or delete a VM resource.

0058Optionally, in this embodiment of this application, the PaaS tenant proxy component <b>230</b> may perform authentication on the first virtual tenant by using the IAM component, to obtain an identity authentication token of the first virtual tenant. The PaaS tenant proxy component <b>230</b> works as the proxy for the first real tenant by using the identity authentication token of the first virtual tenant, to initiate a corresponding IaaS operation instruction to the IaaS management system <b>300</b>.

0059It should be understood that, in this embodiment of this application, the cloud computing service architecture provides the IaaS service for the first real tenant based on a first infrastructure resource group; only the first real tenant has permission to manage an infrastructure resource in the first infrastructure resource group; the cloud computing service architecture provides the PaaS service for the first real tenant based on a second infrastructure resource group; and only the first virtual tenant has permission to manage an infrastructure resource in the second infrastructure resource group.

0060According to the PaaS management system in this embodiment of this application, one corresponding virtual tenant is introduced for each real tenant in the PaaS management system, so that the PaaS management system manages an infrastructure resource by using the virtual tenant. The first real tenant and the first virtual tenant are a pair in a plurality of one-to-one correspondences. Therefore, PaaS service management corresponding to the first real tenant and management of another tenant are isolated from each other. In this way, management of a plurality of tenants is isolated from each other, and a conflict problem existing between infrastructure resource management performed by the IaaS service and infrastructure resource management performed by the PaaS service can be further resolved.

0061For the IaaS management system, the real tenant and the virtual tenant are two different tenants, the real tenant has only the permission to manage the infrastructure resource corresponding to the IaaS operation request initiated by the real tenant by using the IaaS management system, the virtual tenant has only the permission to manage the infrastructure resource corresponding to the PaaS operation request initiated by the real tenant by using the PaaS management system, and the IaaS management system isolates the management permission of the real tenant from that of the virtual tenant. In this way, not only the management conflict problem can be resolved, but also security of a cloud computing service can be improved. The PaaS management system introduces one corresponding virtual tenant for each real tenant. This can ensure mutual resource isolation between a plurality of tenants. In conclusion, according to the PaaS management system in this embodiment of the present invention, not only a multi-tenant requirement is met, but also network isolation between infrastructure resources respectively corresponding to the IaaS service and the PaaS service can be performed, thereby resolving the conflict problem existing between infrastructure resource management performed by the IaaS service and infrastructure resource management performed by the PaaS service, and improving the security of the entire cloud computing service.

0062An embodiment of this application further provides a cloud computing service architecture. <figref idref="DRAWINGS">FIG. 3</figref> is a schematic block diagram of a cloud computing service architecture <b>400</b> according to this embodiment of this application. The cloud computing service architecture <b>400</b> provides an infrastructure as a service IaaS service and a platform as a service PaaS service for a first real tenant. The cloud computing service architecture <b>400</b> includes a first infrastructure resource group <b>410</b> and a second infrastructure resource group <b>420</b>. The cloud computing service architecture <b>400</b> provides the IaaS service for the first real tenant based on the first infrastructure resource group <b>410</b>. Only the first real tenant has permission to manage an infrastructure resource in the first infrastructure resource group <b>410</b>. The cloud computing service architecture <b>400</b> provides the PaaS service for the first real tenant based on the second infrastructure resource group <b>420</b>. Only a first virtual tenant has permission to manage an infrastructure resource in the second infrastructure resource group <b>420</b>. There are one-to-one correspondences between real tenants and virtual tenants, and the first real tenant and the first virtual tenant are a pair in the one-to-one correspondences.

0063Specifically, a PaaS management system of the cloud computing service architecture <b>400</b> generates a corresponding virtual tenant for each real tenant who accepts the PaaS service. When the first real tenant applies for a PaaS instance, the PaaS management system manages, by using an identity of the first virtual tenant, the second infrastructure resource group <b>420</b> corresponding to the PaaS instance. For example, an infrastructure resource corresponding to the PaaS instance, such as a VM, a storage medium, a network, or a router, falls within a range of management permission of the first virtual tenant. All operations on the infrastructure resource of the PaaS instance of the first real tenant, that is, all operations on the second infrastructure resource group <b>420</b> managed by the first virtual tenant (for example, releasing the PaaS instance, changing the PaaS instance, restarting the PaaS instance, or increasing a disk) can be performed only by using the identity of the first virtual tenant corresponding to the first real tenant. In addition, this correspondence can be stored only in a background of the PaaS management system. In other words, the cloud computing service architecture <b>400</b> provides the PaaS service for the first real tenant based on the second infrastructure resource group <b>420</b>, and only the first virtual tenant has the permission to manage the infrastructure resource in the second infrastructure resource group <b>420</b>. An infrastructure resource created by the PaaS management system belongs to a virtual tenant, only the virtual tenant has permission to manage the infrastructure resource, and a real tenant cannot manage the infrastructure resource by using an IaaS management system.

0064For a case in which the cloud computing service architecture <b>400</b> further provides the IaaS service for the first real tenant based on the first infrastructure resource group <b>410</b>, only the first real tenant has the permission to manage the infrastructure resource in the first infrastructure resource group <b>410</b>. An infrastructure resource that provides the IaaS service for a real tenant belongs to the real tenant, only the real tenant has permission to manage the infrastructure resource, and a virtual tenant cannot manage the infrastructure resource by using the PaaS management system. Herein the first infrastructure resource group <b>410</b> and the second infrastructure resource group <b>420</b> do not have a same infrastructure resource.

0065It should be understood that, for a real tenant, in some cases, data communication needs to be performed between infrastructure resources respectively corresponding to the IaaS service and the PaaS service that are leased by the real tenant. The second infrastructure resource group <b>420</b> may include a PaaS instance, the PaaS instance includes a data network adapter, and the data network adapter is configured to perform data communication between the PaaS instance and the first infrastructure resource group <b>410</b>.

0066In the cloud computing service architecture in this embodiment of this application, for a real tenant who leases both the IaaS service and the PaaS service, infrastructure resources respectively corresponding to the IaaS service and the PaaS service are classified into two parts: At least one of infrastructure resources such as a VM, a network, a CPU, a memory, a storage medium, and a router in the second infrastructure resource group <b>420</b> corresponding to the PaaS service is managed by a virtual tenant by using the IaaS management system, under control of the real tenant by using the PaaS management system, for example, a PaaS management domain shown in <figref idref="DRAWINGS">FIG. 3</figref>; and at least one of infrastructure resources such as a VM, a network, a CPU, a memory, a storage medium, and a router in the first infrastructure resource group <b>410</b> corresponding to the IaaS service is managed by the real tenant by using the IaaS management system, for example, an IaaS management domain shown in <figref idref="DRAWINGS">FIG. 3</figref>. The real tenant may control application, destruction, and the like of a resource of a PaaS instance by using the PaaS management system. In a network of the real tenant, only a network address and a port of the PaaS instance can be seen, and an infrastructure resource corresponding to the PaaS instance cannot be seen. The infrastructure resource corresponding to the PaaS instance can be managed only by using the virtual tenant.

0067A multi-network-adapter design may be used for the PaaS instance, so that a management network and a data network are independent of each other. Specifically, in a PaaS instance creation process, a plurality of network adapters may be created on a VM, and a management network adapter and a data network adapter are independent of each other, and belong to the management network and the data network, respectively. Communication in the management network is management communication, and includes internal communication of the PaaS service and control communication of the background of the PaaS management system. Communication in the data network is data communication, is external communication of the PaaS service, and is used to transmit data generated or required in a process in which a user uses the PaaS instance. The PaaS instance (that is, a virtual machine) provided by the cloud computing service architecture for the first real tenant includes a management network adapter. The management network adapter is configured to perform management communication between infrastructure resources in the second infrastructure resource group <b>420</b>. The management network adapter performs the internal communication of the PaaS service and the control communication of the background of the PaaS management system, and is independent of data communication of the real tenant. The management network is connected to a virtual network of the virtual tenant and is not interfered by the outside. The PaaS instance (that is, a virtual machine) provided by the cloud computing service architecture for the first real tenant includes a data network adapter. The data network adapter is configured to perform data communication between the PaaS instance and the first infrastructure resource group <b>410</b>. The data network is connected to a virtual network of the real tenant, and can be managed only by the real tenant.

0068It should be understood that the cloud computing service architecture in this embodiment of this application is configured to provide a hardware or software service for a tenant. The cloud computing service architecture includes an infrastructure resource and software deployed on the infrastructure resource. For example, hardware of the cloud computing service architecture may include one or more of infrastructure resources such as a CPU, a memory, a storage medium, a network, and a router. The hardware of the cloud computing service architecture is connected to each other based on a physical device. Software of the cloud computing service architecture may include the PaaS management system, the IaaS management system, application software corresponding to the PaaS service leased by a tenant, and the like that are deployed on the foregoing hardware. The cloud computing service architecture may deploy the software on the hardware by using a virtualization technology. In this embodiment of this application, a specific form of the cloud computing service architecture is not limited.

0069The real tenant has permission to manage the data network adapter of the PaaS instance. Capabilities of the real tenant such as a security group policy may take effect for the data network adapter. In this way, the real tenant may care about only the data network adapter, and does not need to care about another network adapter. This can simplify management work of the real tenant, and can also enhance a network isolation capability of the infrastructure resource corresponding to the PaaS service. In this embodiment of this application, different real tenants are corresponding to different virtual tenants, and networks of different virtual tenants are independent and mutually isolated networks. Therefore, for a plurality of tenants of the PaaS service, resources of the tenants are isolated from each other.

0070<figref idref="DRAWINGS">FIG. 4</figref> is a schematic flowchart of a method <b>500</b> for providing a PaaS service according to an embodiment of this application. The method <b>500</b> is based on a cloud computing service architecture. The cloud computing service architecture provides a PaaS service for a first real tenant by using a PaaS management system. The method <b>500</b> may include the following steps:

0071S<b>510</b>. The PaaS management system receives a PaaS operation request sent by a first real tenant, where the PaaS operation request is used to indicate a PaaS operation intended for a PaaS resource.

0072S<b>520</b>. The PaaS management system determines information about a first virtual tenant corresponding to the first real tenant, where there are one-to-one correspondences between real tenants and virtual tenants, and the first real tenant and the first virtual tenant are a pair in the one-to-one correspondences.

0073S<b>530</b>. The PaaS management system controls, based on the PaaS operation request and the information about the first virtual tenant by using the first virtual tenant, an IaaS management system of the cloud computing service architecture to process an IaaS operation corresponding to the PaaS operation.

0074According to the method for providing a PaaS service in this embodiment of this application, one corresponding virtual tenant is introduced for each real tenant in the PaaS management system, so that the PaaS management system manages an infrastructure resource by using the virtual tenant. The first real tenant and the first virtual tenant are a pair in a plurality of one-to-one correspondences. Therefore, PaaS service management corresponding to the first real tenant and management of another tenant are isolated from each other. In this way, management of a plurality of tenants is isolated from each other, and a conflict problem existing between infrastructure resource management performed by an IaaS service and infrastructure resource management performed by a PaaS service can be further resolved.

0075The following describes the method for providing a PaaS service in this embodiment of this application in detail by using two specific scenarios. <figref idref="DRAWINGS">FIG. 5A</figref> and <figref idref="DRAWINGS">FIG. 5B</figref> are a schematic flowchart of a method <b>600</b> for providing a PaaS service according to an embodiment of this application. That the PaaS management system receives a PaaS operation request sent by a first real tenant in S<b>510</b> may include: receiving, by the PaaS management system, a PaaS operation request that instructs to apply for a PaaS instance and that is sent by the first real tenant. That the PaaS management system controls, based on the PaaS operation request and the information about the first virtual tenant by using the first virtual tenant, an infrastructure as a service IaaS management system to process an IaaS operation corresponding to the PaaS operation in S<b>530</b> may include: determining, by the PaaS management system based on the PaaS operation request, that the IaaS operation corresponding to the PaaS operation is creating the PaaS instance and creating a data network adapter; and controlling, by the PaaS management system by using the first virtual tenant, the IaaS management system to create the PaaS instance and create the data network adapter.

0076<figref idref="DRAWINGS">FIG. 5A</figref> and <figref idref="DRAWINGS">FIG. 5B</figref> are a schematic flowchart of a method for providing a PaaS service according to an embodiment of this application. A scenario shown in <figref idref="DRAWINGS">FIG. 5A</figref> and <figref idref="DRAWINGS">FIG. 5B</figref> is a scenario in which a real tenant applies for a PaaS instance for the first time. As shown in <figref idref="DRAWINGS">FIG. 5A</figref> and <figref idref="DRAWINGS">FIG. 5B</figref>, the scenario in which a real tenant applies for a PaaS instance for the first time may include the following procedure.

0077S<b>605</b>. A real tenant clicks an “Apply for a PaaS instance” button on a cloud computing service page that may also be referred to as a PaaS console (console). The cloud computing service page sends an HTTP message to a PaaS management system, for example, to a PaaS tenant service component <b>210</b>.

0078S<b>610</b>. The PaaS tenant service component <b>210</b> initiates an invocation of virtual tenant selection, namely, “select a virtual tenant( )”, to a virtual tenant resource pool component <b>220</b>.

0079S<b>615</b>. The virtual tenant resource pool component <b>220</b> allocates an unoccupied virtual tenant to the real tenant from an internal resource pool of the virtual tenant resource pool component <b>220</b>, and records a correspondence between the real tenant and the virtual tenant.

0080S<b>620</b>. The virtual tenant resource pool component <b>220</b> returns information about the virtual tenant to the PaaS tenant service component <b>210</b>.

0081S<b>625</b>. After receiving the information about the virtual tenant, the PaaS tenant service component <b>210</b> transfers the information about the virtual tenant to a PaaS tenant proxy component <b>230</b>, and also initiates an invocation of VM creation, namely, “create a VMO”.

0082S<b>630</b>. After receiving the invocation of VM creation, the PaaS tenant proxy component <b>230</b> sends an HTTP message to an IAM component, to obtain an identity authentication token of the virtual tenant.

0083S<b>635</b>. The IAM component returns the identity authentication token of the virtual tenant to the PaaS tenant proxy component <b>230</b>.

0084S<b>640</b>. After obtaining the identity authentication token, the PaaS tenant proxy component <b>230</b> initiates an HTTP message for creating a VM (that is, creating a PaaS instance) to an IaaS management system <b>300</b>.

0085S<b>645</b>. After successfully creating a VM, the IaaS management system <b>300</b> returns an acknowledgement message to the PaaS tenant proxy component <b>230</b>.

0086S<b>650</b>. After the VM is successfully created, the PaaS tenant service component <b>210</b> initiates an HTTP message for creating a data network adapter to the IaaS management system <b>300</b>, to instruct the IaaS management system <b>300</b> to create a data network adapter that is configured to communicate with a first infrastructure resource group.

0087S<b>655</b>. After creating the data network adapter, the IaaS management system <b>300</b> returns an acknowledgement message to the PaaS tenant proxy component <b>230</b>.

0088S<b>660</b>. The PaaS tenant service component <b>210</b> initiates a data network adapter mounting message to the PaaS tenant proxy component <b>230</b>.

0089S<b>665</b>. After receiving the data network adapter mounting message, the PaaS tenant proxy component <b>230</b> initiates an HTTP message that instructs to mount the data network adapter onto the VM to the IaaS management system <b>300</b>.

0090S<b>670</b>. For an operation of mounting the data network adapter onto the VM, the IaaS management system <b>300</b> queries, from the IAM component, whether the virtual tenant is authorized, and when the virtual tenant is authorized, the IaaS management system <b>300</b> can perform the operation of mounting the data network adapter to the VM.

0091Only in this case, the PaaS management system can allow the data network adapter of the real tenant to be mounted onto the virtual tenant, so that a resource of a VM of a PaaS is connected to a network of the real tenant by using the data network adapter of the real tenant.

0092<figref idref="DRAWINGS">FIG. 6</figref> is a schematic flowchart of a method <b>700</b> for providing a PaaS service according to an embodiment of this application. A scenario shown in <figref idref="DRAWINGS">FIG. 6</figref> is a scenario in which a real tenant changes a PaaS instance. That the PaaS management system receives a PaaS operation request sent by a first real tenant in S<b>510</b> may include: receiving, by the PaaS management system, a PaaS operation request that instructs to change a PaaS instance and that is sent by the first real tenant. That the PaaS management system controls, based on the PaaS operation request and the information about the first virtual tenant by using the first virtual tenant, an infrastructure as a service IaaS management system to process an IaaS operation corresponding to the PaaS operation in S<b>530</b> may include: determining, by the PaaS management system based on the PaaS operation request, that the IaaS operation corresponding to the PaaS operation is changing a parameter of the PaaS instance; and controlling, by the PaaS management system by using the first virtual tenant, the IaaS management system to change the parameter of the PaaS instance.

0093As shown in <figref idref="DRAWINGS">FIG. 6</figref>, the scenario in which a real tenant changes a PaaS instance may include the following procedure.

0094S<b>705</b>. A real tenant clicks a “Change a PaaS instance” button on a cloud computing service page. The cloud computing service page sends an HTTP message to a PaaS management system, specifically, to a PaaS tenant service component <b>210</b>.

0095S<b>710</b>. The PaaS tenant service component <b>210</b> initiates an invocation of virtual tenant determining, namely, “determine a virtual tenant( )”, to a virtual tenant resource pool component <b>220</b>.

0096S<b>715</b>. The virtual tenant resource pool component <b>220</b> determines, based on recorded correspondences between real tenants and virtual tenants, a virtual tenant corresponding to the real tenant.

0097S<b>720</b>. The virtual tenant resource pool component <b>220</b> returns information about the virtual tenant to the PaaS tenant service component <b>210</b>.

0098S<b>725</b>. After receiving the information about the virtual tenant, the PaaS tenant service component <b>210</b> transfers the information about the virtual tenant to a PaaS tenant proxy component <b>230</b>, and also initiates an invocation of VM changing, namely, “change a VMO”.

0099S<b>730</b>. After receiving the invocation of VM changing, the PaaS tenant proxy component <b>230</b> sends an HTTP message to an IAM component, to obtain an identity authentication token of the virtual tenant.

0100S<b>735</b>. The PaaS tenant proxy component <b>230</b> obtains the identity authentication token.

0101S<b>740</b>. After obtaining the identity authentication token, the PaaS tenant proxy component <b>230</b> initiates an HTTP message for changing a VM to an IaaS management system <b>300</b>.

0102S<b>745</b>. After receiving the HTTP message for changing a VM, the IaaS management system <b>300</b> changes a parameter of a virtual machine.

0103It should be noted that, in the embodiments of this application, the receiving module <b>110</b> of the PaaS management system may be implemented by a network interface, and the processing module <b>120</b> may be implemented by a processor. As shown in <figref idref="DRAWINGS">FIG. 7</figref>, a PaaS management system <b>800</b> may include a processor <b>810</b>, a network interface <b>820</b>, and a memory <b>830</b>. The memory <b>830</b> may be configured to store an instruction executed by the processor <b>810</b>, and the like. The processor <b>810</b> and the network interface <b>820</b> are configured to execute the instruction stored in the memory <b>830</b>. When the processor <b>810</b> and the network interface <b>820</b> execute the instruction stored in the memory <b>830</b>, the PaaS management system <b>800</b> is configured to perform the method for providing a PaaS service in the embodiments of this application.

0104Components in the PaaS management system <b>800</b> may communicate with each other by using an internal connection channel, to transfer a control signal and/or a data signal.

0105It should be noted that the foregoing method embodiments of this application may be applied to a processor, or implemented by a processor. The processor may be an integrated circuit chip and has a signal processing capability. In an implementation process, steps in the foregoing method embodiments can be implemented by using an integrated logic circuit of hardware in the processor, or by using instructions in a form of software. The processor may be a general-purpose processor, a Digital Signal Processor (DSP), an Application-Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA) or another programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component. The processor may implement or perform the methods, the steps, and logical block diagrams that are disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or the processor may be any conventional processor, or the like. Steps of the methods disclosed with reference to the embodiments of this application may be directly executed and accomplished by a hardware decoding processor, or may be executed and accomplished by using a combination of hardware and software modules in a decoding processor. The software module may be located in a mature storage medium in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, or a register. The storage medium is located in the memory, and the processor reads information in the memory and completes the steps in the foregoing methods in combination with hardware of the processor.

0106It may be understood that the memory in the embodiments of this application may be a volatile memory or a nonvolatile memory, or may include a volatile memory and a nonvolatile memory. The nonvolatile memory may be a Read-Only Memory, (ROM), a Programmable ROM (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (Electrically EPROM, EEPROM), or a flash memory. The volatile memory may be Random Access Memory (RAM), used as an external cache. As examples but not limitative descriptions, many forms of RAMs may be used, for example, a static random access memory (Static RAM, SRAM), a dynamic random access memory (Dynamic RAM, DRAM), a synchronous dynamic random access memory (Synchronous DRAM, SDRAM), a double data rate synchronous dynamic random access memory (Double Data Rate SDRAM, DDR SDRAM), an enhanced synchronous dynamic random access memory (Enhanced SDRAM, ESDRAM), a synchronous link dynamic random access memory (Synchlink DRAM, SLDRAM), and a direct rambus random access memory (Direct Rambus RAM, DR RAM). It should be noted that the memory of the systems and methods described in this specification includes but is not limited to these memories and any memory of another proper type.

0107The network interface is configured to receive a PaaS operation request sent by a first real tenant. The network interface <b>820</b> may be one network interface, or may be a plurality of network interfaces. The network interface may be a wired interface, for example, a Fiber Distributed Data Interface (FDDI) or a Gigabit Ethernet (GE) interface; or the network interface may be a wireless interface. A person of ordinary skill in the art may be aware that, in combination with the examples described in the embodiments disclosed in this specification, units and algorithm steps may be implemented by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are performed by hardware or software depends on particular applications and design constraint conditions of the technical solutions. A person skilled in the art may use different methods to implement the described functions for each particular application, but it should not be considered that the implementation goes beyond the scope of this application.

0108It may be clearly understood by a person skilled in the art that, for the purpose of convenient and brief description, for a detailed working process of the foregoing system, apparatus, and unit, refer to a corresponding process in the foregoing method embodiments, and details are not described herein again.

0109In the several embodiments provided in this application, it should be understood that the disclosed system, apparatus, and method may be implemented in other manners. For example, the described apparatus embodiment is merely an example. For example, the unit division is merely logical function division and may be other division in actual implementation. For example, a plurality of units or components may be combined or integrated into another system, or some features may be ignored or not performed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections may be implemented by using some interfaces. The indirect couplings or communication connections between the apparatuses or units may be implemented in electronic, mechanical, or other forms.

0110The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one position, or may be distributed on a plurality of network units. Some or all of the units may be selected based on actual requirements to achieve the objectives of the solutions of the embodiments.

0111In addition, functional units in the embodiments of this application may be integrated into one processing unit, or each of the units may exist alone physically, or two or more units may be integrated into one unit.

0112When the functions are implemented in a form of a software functional unit and sold or used as an independent product, the functions may be stored in a computer-readable storage medium. Based on such an understanding, the technical solutions of this application essentially, or the part contributing to the prior art, or some of the technical solutions may be implemented in a form of a software product. The software product is stored in a storage medium, and includes several instructions for instructing a computer device (which may be a personal computer, a server, a network device, or the like) to perform all or some of the steps of the methods described in the embodiments of this application.

0113The foregoing descriptions are merely specific implementations of this application, but are not intended to limit the protection scope of this application. Any variation or replacement readily figured out by a person skilled in the art within the technical scope disclosed in this application shall fall within the protection scope of this application. Therefore, the protection scope of this application shall be subject to the protection scope of the claims.