Security design describes ZCF architecture capabilities in compute and data security, network security, and permission management security. Different security mechanisms are implemented within corresponding capability domains and collectively reduce access risk, operational risk, and runtime risk under a unified framework of access control, permissions, and auditing.

Compute and Data Security encompasses capabilities such as compute resource access control, image access management, resource operation protection, and data encryption across the cloud platform and Container Service, mitigating risks of unauthorized access, misoperations, and data leakage during workload execution.

Cloud Platform Security focuses on VM instance access control, image and snapshot management, resource deletion protection, and data encryption to reduce risks of unauthorized access, misoperations, and data leakage during cloud resource usage.

The feature provides data protection based on national cryptographic algorithms (such as SM3, HMAC-SM3, and SM4). After you enable this feature, important data such as logs, passwords, and images can be encrypted to ensure data confidentiality and integrity.

To use this feature, ensure that you have installed the cryptography security compliance module license and enabled data protection.

SE (Security Element) is an embedded security IP core within the processor. It provides foundational software and application systems with secure, compliant, and standardized cryptographic support. ZStack Cloud can detect SE devices on hosts and allows you to virtualize and attach them to VM instances to deliver security and encryption services.

Note: Currently, only SE devices on Hygon and Loongarch hosts can be detected.

Container Security centers on Pod-level network access control and image access permissions to minimize network exposure and image access risks during containerized workload execution.

Pod security policies define network security policies for east-west traffic within a container cluster (i.e., internal communication between Pods). Fine-grained rules—defined via label selectors—specify which Pods are allowed inbound/outbound traffic and which protocols/ports may be used. By default, policies operate in "whitelist" mode: all traffic not explicitly permitted is denied.

Container Service enforces permission isolation through Projects. Each Project can host multiple local registries; users with read/write permissions on the Project inherit corresponding read/write access to those local registries—enabling them to push and pull images. Local registries support both public and private modes: in public mode, anonymous users may pull images without authentication (but cannot push); in private mode, all unauthenticated access is denied—only authenticated and authorized users may push or pull images.

Network Security covers east-west access control, north-south traffic protection, traffic monitoring, and port mirroring—enabling secure business network communications and supporting network troubleshooting and auditing.

Security groups provide L3 network security control for VM instances, effectively filtering ingress and egress TCP/UDP/ICMP packets for NICs based on specified security rules.

You can configure firewalls for VPC vRouters. After a VPC firewall is created, the system automatically configures an ingress rule set for the VPC vRouter, and you can flexibly configure the egress rule set. Each interface direction on a VPC router can have one rule set applied. By filtering north-south traffic at the VPC vRouter interfaces, the VPC firewall effectively protects the communication security of the entire VPC and the VPC vRouter itself. The VPC firewall provides complementary protection to security groups. These security groups operate at the VM's virtual NICs, with primary focus on securing east-west traffic within the VPC.

The VPC vRouter supports directed NetFlow export for network flow monitoring and analysis. By analyzing the ingress and egress traffic on VPC vRouter NICs through NetFlow, you can quickly locate network-wide bottlenecks, optimize network topology and bandwidth, and mitigate malicious attacks, thereby enhancing overall network security. Currently, the supported versions of output data flows are V5 and V9.

ZStack Cloud supports port mirroring. Port mirroring forwards the ingress and egress traffic of a VM instance NIC to another VM instance. This enables you to capture and analyze packets from the source port without affecting its normal business throughput. Port mirroring facilitates internal network monitoring and management, allowing for rapid troubleshooting of network issues. Port mirroring requires a dedicated traffic network, which cannot be shared with other networks, to ensure transmission efficiency.

In traditional networks, IP/MAC/ARP spoofing has always been a severe challenge. Through IP/MAC/ARP spoofing, attackers can disrupt the network environment and intercept network secrets.

The system isolates abnormal protocol access initiated by VM instances at the host's data link layer and blocks VM instance MAC/ARP spoofing. It also prevents VM instance IP spoofing at the host's network layer.

Permission management security focuses on role-based privilege separation, tenant permissions, certificate-based login, two-factor authentication, AccessKey authentication, and operation auditing—enforcing administrative boundaries, protecting access credentials, and enabling traceability and security auditing for critical operations.

ZStack Cloud supports a Three-Role Separation model, which is an implementation of the Separation of Duties. This model decomposes the super administrator (admin) privileges and assigns them to three distinct roles: the System Administrator, the Security Administrator, and the Security Auditor. The System Administrator is responsible for managing platform resources. The Security Administrator is responsible for managing platform permissions. The Security Auditor is responsible for platform auditing and compliance. These three roles operate independently and provide checks and balances on each other's authority.

By distributing the comprehensive privileges of the super administrator among three separate roles, this model effectively mitigates security risks associated with over-concentrated super-administrator access and significantly enhances the overall security posture of the platform.

Tenant management provides enterprise users with organizational structure management, project-based resource access control, ticket management, independent zone management, and other functions. The tenant management module is offered as an independent feature, which requires a separate license.

The cloud platform provides a certificate login feature based on the Shang Mi 2 (SM2) algorithm. After enabling this feature, you must use a UKey for login authentication to ensure identity authenticity.

To use this feature, ensure that the cryptography security compliance module license is installed and certificate login is enabled.

Certificate login can be enabled for admin users or tenants. To enable certificate login for tenants, ensure that the tenant management module license is installed on the cloud platform.

ZStack Cloud supports two-factor authentication (2FA) as an additional layer of security beyond static passwords. When 2FA is enabled, you must correctly enter a 6-digit dynamic security code from your authenticator app during each login attempt to gain access.

After 2FA is enabled and you successfully log in for the first time, the login QR code is no longer displayed. This helps prevent malicious login attempts and further enhances system security.

ZStack Cloud supports AccessKey authentication.

ZStack Cloud provides unified operation log management, recording user logins and resource operations performed under various accounts. The logs capture details such as operation description, task result, operator, client IP, task creation and completion time, and operation return details. Through operation log auditing, you can meet requirements for security analysis, intrusion detection, resource change tracking, and compliance auditing.

Note: If operation requests are forwarded to ZStack Cloud through a load balancer, you need to correctly configure X-Forwarded-For forwarding on the load balancing device so that ZStack Cloud can obtain the actual client IP.