ZStack Cloud Security provides the information that ensures the Cloud environment security. This paper introduces the core security features of ZStack Cloud.

IP/MAC/ARP spoofing, which helps the hackers disrupt the network environment and eavesdrop on network secrets, has always been a severe risk that traditional networks face.

ZStack Cloud isolates the abnormal protocol access initiated by the VM instances outward, blocks the MAC/ARP spoofing of VM instances on the host data-link layer, and prevents the IP spoofing of VM instances on the host network layer.

ZStack Cloud allows you to encrypt and store all the clear-text passwords, which protects your privacy and autonomy.

ZStack Cloud provides data protection based on SM algorithms (SM3, HMAC-SM3, and SM4). You can encrypt the logs, commands, images, and other important data, protecting the data integrity and confidentiality.

Make sure that you have uploaded a license of Cryptography Security Compliance, and enabled Platform Cryptography Security Compliance.

ZStack Cloud provides monitoring and alarm services mainly through the monitoring system and message system. The monitoring system monitors the sequential data and events, while the message system pushes the alarm to endpoints.

ZStack Cloud provides monitoring data indicators through the monitoring system, including the system performance, and the resource usage. You can view the resource usage, the system state, and the health of the Cloud from the screen monitoring, dashboard, visual chart, and banner prompt. You can customize alarms and specify endpoints, thus realizing the fine-grained and flexible monitoring, and diagnosing problems in time.

ZStack Cloud provides backup service in a separate module. Focusing on the business, backup service integrates multiple technologies, including scheduled incremental backup, and scheduled full backup. It provides various backup solutions, such as local backup, remote backup, and Public Cloud backup. You can choose a suitable backup method according to your business characteristics.

ZStack Cloud provides Continuous Data Protection (CDP) service in a separate module. This feature provides second-level and fine-grained continuous backup services for important business systems in VM instances, allowing you to restore the VM data to a specific time state and retrieve files without restoring the systems. CDP provides two data recovery policies: Create VM Instance, or Restore to Original VM Instance. You can select a suitable policy according to your business requirements.

ZStack Cloud provides security group control for the VM instances on L3 networks, effectively filtering TCP/UDP/ICMP data packets, and controlling specified VM NIC according to the security rules.

ZStack Cloud allows you to configure firewalls for VPC vRouters. After you create a VPC firewall, the system will automatically configure the ingress rule set for the VPC vRouter. The egress rule set is configured flexibly by yourself. You can configure one rule set for each interface direction of the VPC vRouter, which is used to filter the north-south traffic at its interface, and effectively ensures the VPC vRouter security and the communication security of the VPC network. The firewall works together with the security group, which is working on the VM NIC, and focusing on the east-west communication security of the VPC.

ZStack Cloud supports the feature of VPC vRouter HA group. You can deploy two VPC vRouters in a VPC vRouter HA group. Either of them can act as a primary or secondary VPC vRouter in the group. If the primary VPC vRouter does not work as expected, the other one will automatically replace it as the primary VPC vRouter within seconds, thus ensuring the business stability.

ZStack Cloud allows you to export the Netflow analysis and monitoring of a VPC vRouter. By monitoring and analyzing the ingress and egress traffic of the VPC vRouter NIC with a Netflow, the system can quickly locate the traffic bottleneck of the network, optimize the network topology and bandwidth, prevent malicious attacks, and improve the network security. The supported versions of data flows are V5 and V9.

ZStack Cloud provides port mirroring service. Port mirroring mirrors the ingress and egress traffic of one VM instance NIC, and sends the traffic data to another VM instance, allowing you to analyze the business messages on the VM instance port without affecting the business throughout of the source port. With this feature, an enterprise can monitor and manage its internal network data conveniently, and quickly locate the network breakdowns. You need to configure a dedicated flow network for the port mirroring instead of reusing other networks to ensure high transmission efficiency.

ZStack Cloud allows you to realize the permission management through the Separation of Three Roles. The permissions of the Super Administrator (admin) is decomposed to the system manager, the security manager, and the security auditor. The system manager is responsible for the resource management; the security manager is responsible for the permission management; and the security auditor is responsible for the audit management. Each role is separated from, restricting and restricted by the other two roles.

The Separation of Three Roles decomposes the permissions of the admin, and makes the Cloud managed by three roles together, which effectively decreases the risks brought by the super power of the admin, and further improves the Cloud security.

ZStack Cloud provides the tenant management feature in a separate module. This module supports the organization structure management, the project-based resource access control, the ticket management, and the independent zone management.

ZStack Cloud provides certificate login feature based on SM algorithm (SM2). If you enable this feature, you need to pass the verification with Ukey before you login to the Cloud, thus ensuring your identity authenticity.

To enable this feature, make sure that you have installed the license of Cryptography Security Compliance, and enabled Platform Cryptography Security Compliance.

You can enable certificate login for the admin and the tenants. To enable this feature for tenants, make sure that you have installed a license of Tenant Management.

ZStack Cloud provides a higher-level protection on the basis of the static password authentication: two-factor authentication. After you enable this feature for the Cloud, you need to correctly enter the 6-digit security code provided by the identity authentication APP to login to the Cloud.

Once you pass the two-factor authentication and login to the Cloud successfully, the QR code is no longer displayed in avoidance of malicious logins, thus further improving the system security.

ZStack Cloud provides the AccessKey authentication feature.

ZStack Cloud provides an unified action log management, recording the login history of all accounts and their actions on the resources. The logs display these information: Description, Result, Operator, Login IP, Creation/Completion Time, and Returned Details. Operation log audit can meet various requirements, including security analysis, intrusion detection, resource change tracking, and compliance audit.