Alibaba Cloud security
Cloud computing and big data have raised concerns about data security and privacy. More countries are improving data protection laws like the EU’s General Data Protection Regulation (GDPR) and China’s Personal Information Protection Law as people become more concerned about data security and privacy. So, firms must be more careful and compliant with user data processing and storage.
In light of this, private database technology has been developed. Secure databases can resolve data security problems from beginning to end in a variety of application scenarios, resulting in quick development and industry recognition. Intel Trust Domain Extensions (Intel TDX) and Alibaba Cloud security defences, along with the Alibaba Cloud ApsaraDB Confidential Database, can effectively defend against security threats from both inside and outside the cloud platform, helping to prevent user data leakage.
Secure Computing with Intel Xeon Scalable Processors
Dependable Security Engines for Hardware-Based TEE
Intel has created and provided two cutting-edge hardware-based security engines, Intel Software Guard Extensions (Intel SGX), an application-level isolation technology, and Intel TDX, a virtualization-level isolation technology, to help safeguard data in use and enable secret computing. Moreover, for a more complete private computing solution, Intel TDX may readily expand support to heterogeneous Trusted Execution Environment (TEE) utilisation. The 5th generation Intel Xeon Scalable processors can offer comprehensive private computing capabilities thanks to these two integrated security mechanisms. With these features, CSPs can provide IaaS, PaaS, and SaaS applications in a hardware-based TEE without having to change their current applications.
Intel TDX Enables the Confidential Database ApsaraDB
Confidential database technology is used by Alibaba Cloud ApsaraDB to safeguard sensitive user data while maintaining transparent query, transaction, and other operational processes. On the other hand, tiered protection mechanisms like TLS (Transport Layer Security), TDE (Transparent Data Encryption), and RLS (Row Level Security) are used by traditional databases for data that is processed through all stages.
Confidential Database
This version of the database builds on the Confidential Database (Basic Edition) by utilising TEE technologies such as Intel SGX and Intel TDX to guarantee that all of the database’s services are executed in a trusted environment and are shielded from outside security threats. The guest operating system and the database system components are the only things that fall inside the trust barrier.
Client-side encryption and ciphertext storage on untrusted servers are possible with secret databases (Level 3 and Level 4). They nevertheless support all database queries, transactions, analytics, and other tasks in spite of this. Confidential computing is used to keep administrators (like DBAs) and other unauthorised individuals from viewing unencrypted data, resulting in a condition where the data is accessible but not visible in the database.
Alibaba Cloud has formally released the ApsaraDB Confidential Database Basic Edition of PolarDB MySQL and RDS MySQL for Level 3 security. Based on the aforementioned Basic Edition, Alibaba Cloud and Intel collaborated to create the Alibaba Cloud ApsaraDB Confidential Database Hardware Enhanced Edition with Intel TDX, giving consumers a higher level of security (Level 4).
Advantages of ApsaraDB Confidential Database with Intel TDX
Secrecy of Computing Isolation
As previously indicated, Intel TDX uses Intel Multi-Key Total Memory Encryption (Intel MK-TME) and Intel Virtual Machine Extension (Intel VMX) to create a new virtual guest environment called “TD.” This TD can be separated from instances, other TDs, and the underlying system software. The TDX Module uses Secure Arbitration Mode (SEAM), an advanced security privilege mode, to enforce these security features.
Outstanding Performance for in-flight Memory Encryption
Intel TDX uses an integrated memory encryption engine in the integrated memory controller (IMC) of CPU processors to allow customers to encrypt sensitive data while in flight. The extra overhead associated with conventional confidential databases is removed using this method. When handling user-sensitive data in a cloud database, the database operation engine can be executed on an Intel TDX-based TEE, which provides exceptional performance over conventional data protection techniques while maintaining data confidentiality.
Simple to Utilise for Hyperscale Deployment
The “lift-and-shift” method makes it easier to move intricate database systems to private computing. Furthermore, Intel TDX offers comprehensive cloud operating features for hyperscale deployment, including uninterrupted live migration and TCB updates. All of these lower the expenses associated with maintaining and operating private databases while enhancing accessibility.
Even in the event that database accounts are compromised, important user data will always be returned encrypted thanks to Intel TDX, preventing data leaks. Additionally, Intel TDX fortifies the encryption defence for databases’ runtime memory. The Confidential Database Hardware Enhanced Edition of Alibaba Cloud ApsaraDB family provides an end-to-end secure key distribution mechanism, protecting against numerous security threats from the platform infrastructure layer when combined with Intel TDX and Remote Attestation.
Moreover, TPC-C testing show that ApsaraDB Confidential Databases perform similarly to plaintext data and enable extensive SQL query capabilities. They are also compatible with regular databases. They provide apps with transparent and seamless client access without the need for code modifications, and they work with ecosystem tools like DTS and DMS to make application migration simple.
With these benefits, Alibaba Cloud ApsaraDB Confidential Database can better meet the security requirements of the following scenarios and offer more robust protection for data in use:
Maintenance Security
The confidential database can shield database service and operation staff from accessing business-sensitive data while maintaining the regular operation of the database in frequent scenarios where the data owner is the application service provider.
Data Security Compliance
A confidential database can provide data management and analysis capabilities while preventing application service providers from accessing the private plaintext data in situations where the end users themselves are the owners of certain types of data (e.g., health and financial data). Additionally, in these kinds of situations, application service providers may find it easier to comply with regulations for the handling of sensitive data while using the confidential database.
Safe and dependable multi-party data sharing
In situations involving joint analysis of several sources of data, the private database can assist in guaranteeing that the information of each party is not viewed or obtained by other parties participating in the cooperative computation of multi-party data.
Cloud tenants with highly demanding security requirements for cloud databases can adopt the ApsaraDB Confidential Database family to achieve extremely strict data protection, thanks to the advantages of Intel TDX and Alibaba Cloud ApsaraDB Confidential Database technology.
An Overview of Function
Data is encrypted in the Alibaba Cloud ApsaraDB Confidential Database for the duration of its existence. Data stays encrypted until it is received by authorised parties after it leaves a trustworthy environment. The data is decrypted only at this point, for example, within trustworthy client-side business systems. Direct database connections can only read encrypted data; plaintext cannot be accessed.
The Alibaba Cloud RDS MySQL, PolarDB MySQL, RDS PG, and ApsaraDB Confidential Database are all compatible with it. It has little effect on performance and stability and supports all of the syntax of MySQL.
The application’s end users have access to desensitised or unencrypted data and maintain complete control of the data. On the other hand, insider threat risk is significantly reduced because developers and operators of databases and applications can only work with encrypted data.
The database enables the creation of personalised sensitive data rules, facilitating the encryption of vital data according to particular requirements, including identity card numbers, addresses, and user phone numbers. Alibaba Cloud’s RAM system can control the process of establishing encryption rules. This guards against illegal rule changes and the possible export of plaintext data by ensuring that DBAs and developers follow the principle of least privilege. Users can query the database using a MySQL client after configuring the encryption rules, guaranteeing that non-sensitive data is displayed in plaintext and sensitive data is always provided as ciphertext.
