Data security is the practice of protecting digital information from unauthorized access, use, modification, or loss throughout its lifecycle. Data security in the cloud is vital for your operations and a key indicator of overall cloud security. As network threats evolve and expand globally, data protection becomes crucial. Alibaba Cloud is responsible for ensuring the security of your data. This topic describes how Elastic Compute Service (ECS) ensures data security in terms of data integrity, confidentiality, and availability.
Ensure data integrity
Data integrity means preventing data from being accidentally or maliciously changed during transfer and storage. It uses techniques such as verification to confirm the accuracy and consistency of data.
Elastic Compute Service (ECS) ensures data integrity through several methods. It uses triplicate storage for data reliability and a secure data erasure mechanism for complete data erasure. ECS also provides an end-to-end cyclic redundancy check (CRC) feature to protect data during transfer and storage.
Triplicate storage
Feature description: When you read or write data to a disk, the data is replicated into three copies. These copies are stored on different data nodes in a storage cluster based on a specific policy. This provides data reliability for ECS instances and ensures data stability during read and write operations. For more information, see Triplicate storage for disks.
Configuration method: This feature is enabled for disks by default.
Data erasure mechanism
Feature description: The data erasure mechanism ensures that deleted data in the distributed Elastic Block Storage system is completely erased. The data cannot be accessed or restored by other users, which ensures data integrity.
The data erasure mechanism works as follows:
Cloud disks use sequential append-writes at the underlying layer. This design leverages the high bandwidth and low latency of sequential writes on physical disks. Because of the append-write feature, an operation to delete a logical space on a cloud disk is recorded only as metadata. If you attempt to read from this logical space, the storage system returns all zeros. Similarly, overwriting a logical space does not immediately overwrite the corresponding space on the physical disk. Instead, the storage system modifies the mapping between the logical and physical spaces to perform the overwrite. This ensures that the original data cannot be read. Residual data on the physical disk from delete or overwrite operations is later permanently deleted.
When you release a block device, such as a cloud disk, the storage system immediately destroys its metadata to make the data inaccessible. The physical storage space that the cloud disk occupied is also reclaimed. This physical space is cleared before it is reallocated. All newly created cloud disks return zeros for all read operations before the first write.
Configuration method: This feature is enabled for disks by default.
Cyclic redundancy check
Feature description: Disks support end-to-end cyclic redundancy check (CRC) by default for data transfer and storage.
During data read and write operations, an end-to-end CRC is performed to ensure that disk data remains intact and is not corrupted during transfer.
The storage system periodically performs CRC and redundancy consistency scans on data in the persistent media to ensure that the data is intact and not corrupted.
Configuration method: This feature is enabled for disks by default.
Ensure data confidentiality during data storage, transmission, and computing
Data confidentiality ensures that data can be accessed only by authorized individuals or systems to prevent unauthorized access and disclosure. It is usually achieved through encryption. This makes the data unreadable even if it is intercepted during transfer or accessed illegally while in storage.
ECS provides various security features and solutions to ensure data confidentiality during storage, transmission, and runtime. This is described from three aspects: confidentiality of data storage, confidentiality of network data transmission, and confidentiality of the computing environment for data at runtime.
Confidentiality of data storage
Encrypted cloud disks
Feature description: When you create an ECS instance with its system disk and data disks, or when you create a data disk separately, select the Encrypt option for the disk. After the disk is created, data within the operating system of the ECS instance is automatically encrypted on the host when written to the disk. The data is automatically decrypted when read. This process is transparent to the operating system. You do not need to build or maintain a key management infrastructure. Disk encryption protects data privacy and autonomy, and provides a secure boundary for your business data.
For configuration instructions, see Encrypting a cloud disk.
ImportantFor enterprises with high security and compliance requirements, you may need to enforce encryption for all RAM users under your enterprise account to protect data confidentiality. ECS lets you configure custom policies to restrict RAM users to creating only encrypted disks. For more information, see Restrict RAM users to creating only encrypted disks.
Encrypted snapshots
An encrypted snapshot is a backup of the encrypted data stored on an encrypted disk, which can be a system disk or a data disk. If a disk is encrypted, snapshots created from it automatically inherit the encryption property. The snapshot data remains encrypted during storage and transfer. The data stays encrypted even if the snapshot is copied to another region or used to restore a disk.
Encrypted images
Image encryption uses encryption algorithms to protect data in an image from unauthorized access and disclosure. Even if an unauthorized person accesses the image data, they cannot read or decrypt it, which secures the data stored in the image. You can create an encrypted image from an ECS instance that has an encrypted system disk or from an encrypted snapshot. You can also copy a non-encrypted image to create an encrypted image.
Confidentiality of network data transmission
ECS provides multiple security features to ensure confidentiality during data transfer. This section describes how to use the security-hardened mode to access instance metadata, use a VPN Gateway for secure access, and use HTTPS to access ECS resources.
Access instance metadata in security-hardened mode
Feature description: In normal mode, you can access the Metadata Service to view instance metadata without any authentication. If the instance metadata contains sensitive information, it can be intercepted or leaked during transfer. If an ECS service has a Server-Side Request Forgery (SSRF) vulnerability, an attacker can use the Metadata Service to obtain Security Token Service (STS) tokens. This creates a risk similar to an AccessKey pair leak. Compared to the normal mode, the security-hardened mode provides better protection against SSRF attacks using token-based authentication to access instance data.
Configuration method: Select the security-hardened mode to access the Metadata Service and obtain metadata. For more information, see Instance metadata.
Use a VPN Gateway for secure access
Feature description: A VPN Gateway establishes encrypted tunnels to securely and reliably connect your on-premises data centers, office networks, and Internet clients to your virtual private clouds (VPCs) in Alibaba Cloud. VPN Gateway provides two connection methods: IPsec-VPN and SSL-VPN. It uses Internet Key Exchange (IKE) and the IPsec protocol to encrypt data in transit and ensure data security.
IPsec-VPN connection: Before a data packet is sent over an IPsec-VPN connection, it is encrypted by the IPsec protocol. IPsec is a suite of protocols used for data encryption and authentication to ensure data integrity.
SSL-VPN connection: Install an SSL client certificate on the client to establish an SSL-VPN connection between the client and the VPN Gateway. Traffic transmitted over the SSL-VPN connection is encrypted using the SSL protocol to provide data encryption, identity authentication, and data integrity.
For more information, see What is VPN Gateway?
Configuration method: This feature is supported by default.
Use HTTPS to access ECS resources
Feature description: HTTPS builds on HTTP using Transport Layer Security (TLS)/SSL to encrypt data in transit. This prevents data from being monitored, intercepted, or tampered with by third parties. ECS supports HTTPS for encrypted transmission and provides 256-bit encryption to meet the requirements for transmitting sensitive information. TLS 1.2 encryption is used when you connect to an instance using a session management connection in the console, log on to an instance using an SSH key pair, or use Cloud Assistant for remote access.
Configuration method: This feature is supported by default.
ImportantAlibaba Cloud provides the
acs:SecureTransportcondition key. After you enable this setting, you can access ECS resources only over HTTPS, which protects the confidentiality of data in transit. You can configure a custom policy to restrict RAM users to accessing ECS resources only over HTTPS. For more information, see Custom policies.
Confidentiality of the computing environment for data at runtime
Feature description: In addition to data storage and transmission, the confidentiality of the computing environment for data at runtime is also critical. Security-enhanced ECS instances use technologies such as hardware encryption, isolation, and user auditing to provide a secure, reliable, and isolated environment. These instances offer different levels of protection to meet various security and performance requirements. Security-enhanced ECS instances include instance types that provide memory encryption by default, trusted computing, and confidential computing. For more information, see Overview of security capabilities.
Configuration methods: For more information, see Trusted computing capabilities, Confidential computing capabilities, and Best practices for security capabilities.
Ensure data availability using backup and recovery solutions
Feature description: Data availability ensures that data remains complete, consistent, and accurate throughout its lifecycle. It is primarily achieved through backup and recovery capabilities. Elastic Compute Service (ECS) provides a rich set of product features for backup and recovery to meet data availability requirements. These include data recovery using snapshot backups, data recovery using image backups, solutions for recovering lost data from data disk partitions, and a multi-zone deployment architecture for disaster recovery.
Configuration method: For more information, see ECS disaster recovery solutions.