Learn how you can use Alibaba Cloud's Global Acceleration to improve the shopping experience on your e-commerce website for users in China.
For many international businesses with a presence in China, network stability issues are often the biggest concern when their users or employees in China try to access services based in other countries and regions. In the past, resolving these issues required a lot of technical expertise and expensive leased network capacity. Thanks to Alibaba Cloud's network products, this is no longer the case. It is now a relatively simple and straightforward task to get your mission critical applications running smoothly for your Chinese user base! Read on.
Alibaba Cloud has several market-leading network products and services which help to resolve networking issues for customers in and outside of China, including Global Acceleration (GA for short). GA is a network acceleration product that provides a dedicated network connection between two Alibaba Cloud regions. One region is designated as the "service area" and one is the "accelerated area". The "service area" is the region which hosts the service or application your users need access to, while the "accelerated area" is an Alibaba Cloud region closest to your users (say, in China). The accelerated area will usually expose a public IP (a fundamental concept of GA) to users which they can use to access whatever service is hosted in the "service area".
The organization is a typical e-commerce business that sells fashion brands online to their wide customer base in and outside China. Their customers outside China are satisfied with the website access but the users in China don't get a consistent and/or good performance. For users in China, the access is usually slow and unstable, discouraging the shoppers and leading to a considerable fall in sales. To add to the misery, in a week's time, there is a huge global online sales event where they are expecting a substantial increase in website visits.
Hence, the organization needs a quick and definite solution to achieve following:
In some cases, the service your users want to access may not actually be hosted on Alibaba Cloud. In this case, you need to establish a proxy in the Alibaba Cloud "service area" region which can accept requests from the "accelerated area" and forward them on. The following is the typical architecture for a scenario where user access in China is accelerated for a website hosted in Sydney. Global Acceleration (GA) is used to send traffic from China to a proxy server located in Alibaba Cloud's Sydney region, which then forwards user traffic on to the correct address (website).
How does traffic flow in this solution? Let's take a look:
This article provides a brief insight into doing business in China and discusses how you should adapt to the unique networking infrastructure.
In our previous post, we talked about China's consumer behavior and highlighted some of the key attributes that make them stand out from their global counterparts. In this post, we'll be focusing on the networking aspect of things when it comes to hosting your website or running online business in China.
The network infrastructure in China is very unique.
China has several major Internet Service Providers (ISP) providers. The top 4 are: China Unicom, China Telecom, China Mobile, and China Education & Research Network (CERNET). China Tietong and Dr. Peng are also popular but considerably smaller. Connections that need to pass from one ISP to another are required to go through an Internet Exchange Point (IXP). Internet connection speed and reliability can vary based on the ISP and the ISP's peering capabilities.
In China, IXP’s are very limited and can be very congested, data being routed across the country may never reach the targeted users. It’s important to consider this fact in your network design when deploying a website in China. This network peering also creates a challenge for last-mile network performance. A content delivery network (CDN) is a common solution to accelerating last-mile network performance. A CDN is a geographically distributed network of proxy servers and their data centers. The purpose is to provide high availability and high performance by distributing the service spatially relative to end-users.
Alibaba Cloud offers unique high-performance Border Gateway Protocol (BGP) backbone network lines covering all 23 provinces, 5 autonomous regions, and 4 municipalities to guarantee fast, stable access across mainland China. The reason behind this is simple, we need to provide a consistent experience to our own users like Tmall, Taobao, Youku, Alipay and more. Alibaba Cloud connects to all Chinese ISPs through multiple BGP connections (>10 lines) allowing for high availability and eliminating the need for peering.
Alibaba Cloud CDN offers 1500 nodes to supports intelligent popularity calculation and hierarchical caching of frequently requested resources. In general, 95% of requests and traffic to a website goes to a CDN, so if the CDN is unstable, then an event like double 11 Singles Day is unsustainable. However, Alibaba has hosted China’s Single’s Day sales event without fail, meaning that the Alibaba Cloud CDN network it relies for China’s Single’s Day is stable.
China’s cross-border network infrastructure is also different.
Internet traffic from the US to Chinese hosted sites, as well as from China to US hosted sites, creates another challenge. The public Internet speed crossing the Chinese border can be slow. This can cause a poor user experience which may damage brand reputation, create user frustration and could result in the abandonment of certain websites. Alibaba Cloud Enterprise Network (CEN) offers a comprehensive set of virtual networking capabilities that provide customers with multi-region networking on the cloud. Whether operating from on-premise data centers or from another cloud, CEN’s high-speed data relaying is critical for cloud to local Internet Data Center (IDC) communication, or vice versa.
Speed matters. A high-performance website helps you recruit and retain customers and partners. 57% of website visitors will abandon a web page if it takes more than 3 seconds to load.
Alibaba Cloud’s unique backbone network infrastructure, CDN and Cloud Enterprise Network can help you accelerate website performance, enhance user experience and improve employee productivity.
In this article, you can learn how Alibaba Cloud is strategically positioned as your cloud provider in China especially now having partnered with Xebia.
With over 1.4 billion digital customers, China presents an invaluable market opportunity for international expansion. However, several Western companies have seen their experiments in China fail often due to cultural and regulatory factors. Besides social differences and entirely dissimilar internet platforms in China and the West, stringent rules and regulations tend to rather sternly govern business transactions in the country, especially when it comes to e-commerce.
For many companies, the major hurdle concerns software operations in a landscape vastly different from other markets, especially of those in the West. For instance, Google has no access to the Chinese cloud market, while Amazon and Microsoft only have a relatively small market share amounting to a few percentage points. Both companies outsource their data centers to Chinese providers with whom clients cannot communicate even in the case that something goes entirely awry. Because of these issues, foreign companies looking to reach Chinese consumers while also retaining control of their data need to rethink their enterprise architecture.
Fortunately, there are several options, both locally in China and overseas. Alibaba Group, China's largest cloud player, has been operating a cloud services division since 2012 and now has operations spreading across 19 regions worldwide. Tencent, the creator of the social mega platform WeChat, has also rooted itself a cloud computing world for some time now. Others, such as Baidu, still focuses mainly on the Chinese market. Overall, these companies are competitive players, offering cloud services very much comparable to the services from their American equivalents of Google, Amazon, and Microsoft. Then, paired with the low network latency from and to mainland China, the opportunities for expansion into China become apparent.
Xebia is well positioned to help customers break open the Chinese market. Thanks to a close partnership with Alibaba Cloud, Xebia can facilitate quick internet transactions and rigorous data protections while exporting the results of those operations to Europe or the US.
With a 48% market share, Alibaba Cloud can easily provide cloud infrastructure for many large companies from both China and overseas. Alibaba Group hosts all its own products with Alibaba Cloud, including market leaders such as the global ecommerce marketplaces of AliExpress and Tmall, mobile and online payment platform Alipay and ride-sharing service Didi, and Alibaba Cloud's servers are attested to be able to handle very high volumes of daily data traffic with these market-leading services from Alibaba Group. For a dollar value, consider the Double 11 Global shopping festival, held on November 11 annually. With nearly 5,00,000 transactions per second, or $30.8 billion dollars' worth of goods on just one day last year, the several companies at Alibaba Group accounted for nearly half of all transactions last year—more than the US sales figures of Thanksgiving, Black Friday and Cyber Monday combined.
Founded as a business-to-business marketplace in a tiny apartment in Hangzhou in 1999 by Jack Ma and 17 others, the original brand of Alibaba.com quickly scaled into Alibaba Group, the global entity we all know today. But it was Alibaba Group's 2003 entry into the consumer-to-consumer marketplace with Taobao that laid the foundation for Alibaba Cloud. The traffic generated by a platform where anyone could open their own store required enormous data centers, and once the setup was in place, Alibaba was able to extend those services to other companies—as Amazon does.
Within the Alibaba ecosystem, several group companies can help you get a foot on the ground. Cainiao delivers goods even to remote areas, while Alipay supports convenient mobile and online payments on a trusted platform. The advertisement network Alimama helps to bring your brand and promotional videos the online video platform of Youku, the Chinese equivalent of YouTube. Once visibility is established, products can be retailed in a Tmall shopfront, and customers can then be redirected to a physical store via Amap. In short, Alibaba's focus on servicing small and medium-size businesses advances an array of services aligned to every functional area.
So How Can I Use Alibaba Cloud to Expand into China?
That answer lies in the technical problem that it can help to solve. If Chinese citizens access websites outside the country, their traffic passes what's often referred to as The Great Firewall of China. This combination of legislative and technical measures including DNS filtering, deep packet inspection, and IP address blacklisting allows the government to effectively take down foreign websites whose content does not adhere to local regulations. Companies that play by the well-documented rules can continue to operate websites in China – though not all do. Google chose not to, which cost them the Chinese market, but Microsoft's Bing conforms with regulations. Yet, though China's online environment has sparked questions of privacy and data security, fears about government spying remain unfounded. With the right measures around encryption and data governance, working with Chinese cloud products certainly doesn't equal giving away your data.
The issue is one of speed. The Great Firewall's technical constraints considerably slow down websites hosted abroad, especially in the US or Europe. In the e-commerce space, this added latency can be disastrous for business. Even a few seconds' extra load time can drastically reduce conversions and sales figures. Consequently, business volumes may remain low and companies may find themselves in the red even years later, leading to business reevaluations or worse, market exit.
Using a Chinese cloud provider makes the difference between success and total market failure. With dedicated fiber networks from mainland China to the rest of the world, they ensure the low-latency delivery of internet traffic unaffected by the firewall. As your first experiment in cloud, you can use Alibaba Cloud's Content Delivery Network (CDN) to cache product detail pages and images in China. These are created locally and hosted in an overseas Alibaba Cloud region such as Frankfurt. When a Chinese consumer accesses the page, its content is fetched from Frankfurt over Alibaba Cloud's unfiltered backbone, a much faster process than having the user access your website over the public internet. The content is then cached in China for subsequent page views.
Sub-second page loads ensure that no sales are lost due to technical slowness – leading to higher conversion rates and greater sales, freeing businesses to focus on core activities such as product market optimization. Worth noting here is that a different system governs online content cached or hosted within China. While not subject to the firewall, a special permit called an ICP license is required to publish online under a domain name. Obtaining such licenses can be difficult, but experienced companies can help to make the process be with considerably less hassle.
This document presents a general solution for foreign companies to publish web-based service in China by proxying traffic to their existing services outside of China through Alibaba Cloud Enterprise Network (CEN), achieving better performance and user experience, reducing complexity and cost, as well as meeting regulatory requirements. Other Alibaba Cloud services used in the solution include VPC, ECS, SLB, DNS and DCDN. The solution has been adopted by several enterprise customers in the US.
Background
Providing reliable online service inside China is crucial to foreign companies entering the China market. Addressing packet loss and latency over unreliable public Internet is a big challenge.
Fulfilling local regulatory requirements is another key requirement. Government regulation in China mandates publishing web-based service with a top-level domain name that either has ICP filing (for non-commercial web services) or ICP license (for commercial web services) approved by Ministry of Industry and Information Technology (MIIT). Obtaining ICP approval for an existing top-level domain name registered outside of China can be very difficult. It's often easier to register a new domain name instead and get ICP approval. But using a different domain name to publishing service would require modification to the existing service to ensure all URLs are consistent with the new domain name, which can be challenging as well.
The general solution presented in this document helps customers to:
Leverage existing service outside of China, either hosted on-premises or in public cloud
Solve network quality issues with Alibaba Cloud CEN and proxy servers
Realize domain name consistency with on-the-fly domain name conversion
Achieve great performance by leveraging Alibaba Cloud CDN and DCDN
ICP and related process are out of the scope of this document. Further information can be found at https://www.alibabacloud.com/help/product/35468.htm
Solution
The solution is illustrated in the following diagram:
The example presented here is a customer who already has service with domain name "example.com" deployed in US East, and has obtained a new domain name "example.cn" with ICP filing/license in place.
The main components of the solution are:
listen HTTPS
bind 0.0.0.0:443
mode tcp
server us-nginx <nginx private IP>This configuration tells HAProxy to listen on port 443 (for HTTPS) in TCP mode, ie. SSL connections to example.cn will not be terminated by HAProxy. Traffic will be proxied to the private IP address of the Nginx server in US East VPC via CEN.
server {
listen 443;
server_name example.cn;
ssl on;
root html;
index index.html;
ssl_certificate cert/example.cn.pem;
ssl_certificate_key cert/example.cn.key;
ssl_session_timeout 5m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
location / {
proxy_pass https://example.com/;
sub_filter_types *;
sub_filter https://example.com https://example.cn;
sub_filter_once off;
proxy_set_header Accept-Encoding "";
}
}This configuration tells Nginx to serve HTTPS requests at port 443, using the SSL certificate for example.cn in file cert/example.cn.pem and its associated private key in file cert/example.cn.key. The proxy_pass line specifies the origin web server being proxied. The sub_filter line takes care of the conversion between "example.cn" and "example.com".
For more details on proxy and sub_filter directives, please refer to:
http://nginx.org/en/docs/http/ngx_http_proxy_module.html
http://nginx.org/en/docs/http/ngx_http_sub_module.html
Are you expanding your business to China? Discover how Alibaba Cloud's platform helps compliance with China's cybersecurity legislation.
Doing business in China is a vital part of many companies' strategy. If your company already has a presence there, you probably know that Alibaba Cloud is the country's most widely used cloud-based server hosting platform, with more than a million paying customers. If you're currently outside China and looking for server capacity within the country, then it certainly makes sense to consider using Alibaba Cloud. But for any company with servers that are based in Mainland China, you need to abide by the rules. Thankfully, Alibaba Cloud's technology and services can help smooth the process.
In June 2017, the Cybersecurity law of the People's Republic of China (the Cybersecurity Law) came into force. For the first time, it sets out clear rules about how companies should handle their users' and customers' information, and the penalties for failing to do so correctly. This new law from China, combined with the GDPR regulations in Europe, could well mark the start of a whole new era of IT regulation and compliance, which will improve safety and security for consumers, businesses and governments.
Organizations which contravene China's Cybersecurity Law face fines of up to RMB 1 million (around USD $150,000) and individuals can also be issued fines too, albeit not as high. Companies also face having income confiscated if such income is deemed to have been illegally obtained. In addition, the violator's website can be shut down or its entire business operation is suspended.
Compliance with the Cybersecurity Law is an important aspect of IT management, and it is now vital that you bear it in mind when designing systems and planning for their locations. Breaching the law, even inadvertently, can cost dearly financially and damage reputation.
We are continually being told about the benefits of moving systems to the cloud rather than hosting them in-house or on-premises. Cloud hosting often works out cheaper in the long run, especially when you take account of factors such as hardware depreciation costs and support staff, as well as capacity planning. There are no hardware depreciation costs because it's not your hardware. So when it needs replacing or upgrading, the cloud company simply gets on with the job and you shouldn't even notice it happening. And if you need some extra CPU power you can pay for it when you need it, and even remove it when you don't.
But what about legal compliance? Can cloud, rather than in-house, improve your ability to comply with the new Cybersecurity Law? Almost certainly, because its built-in features take care of many of the complexities behind the scenes. Which leaves you free to concentrate on key features such as capabilities and features of whatever you need to develop or install on your cloud-based servers.
The Cybersecurity Law sets out some key obligations for companies both foreign and local who are operating in China, so let's run down some of those key obligations and examine how hosting your services on Alibaba Cloud can help to ensure compliance.
Firstly, the Cybersecurity Law states that you need to "adopt technological measures to prevent computer viruses, network attacks, network intrusions and other actions endangering cybersecurity." This is sound advice and common-sense security, of course, whether running in the cloud or not. But Alibaba Cloud makes it easy to implement without you having to research, source, install and maintain products that may not otherwise have been tested against your particular hardware configurations.
Anti-DDoS Basic is included free of charge with all Alibaba Cloud ECS instances. Once enabled, it mitigates DDoS attacks by routing unusually heavy traffic from any single IP address away from the targeted destination before it ever reaches your servers, so your instances carry on running. This all happens automatically and in real-time with no action required on the administrator's part. It's available through the Alibaba Cloud Management Console, prevents against attacks such as SYNflood and ICMPflood, and admins receive regular notifications to keep up to date with incidents and status.
Because Anti-DDOS also checks the user agent and referrer fields, it also helps defend against so-called slow attacks, where attackers attempt to steal large amounts of information from a system or to probe its internals, but deliberately stagger their access (sometimes over many weeks) in the hope of avoiding detection.
To help guard against network intrusions, Alibaba Cloud instances can be secured with a Web Application Firewall (WAF) quickly and easily, at minimal cost. Again, this can be implemented through the Management Console and helps protect servers from known attacks. For example, attackers frequently operate by using tools that automatically attempt to access servers and websites via a battery of pre-written exploits that is widely shared among the criminal community. Alibaba Cloud WAF contains signatures for these attacks and can detect them in real-time. It can also spot many other attacker techniques, such as someone trying to submit unauthorized data via a web form or initiating a SQL injection.
To avoid possible false positives, admins can choose to have the WAF operate in reporting mode, so that notifications of suspected violations are given, but no actions are blocked. This enables the administrator to build up a picture of the particular types of threats which servers are facing in order to assist in reducing the attack surface before enabling full blocking mode.
China's Cybersecurity Law now mandates the adoption of measures for recording and tracking the status of network operations, monitoring and recording cyber incidents, and preserving related log files for at least six months. Again, Alibaba Cloud has this covered.
The basic Situational Awareness feature, available as standard, notifies the admin about any abnormal behavior detected in server instances. The server log feature records information about every action that an instance takes, and all incoming requests. These comprehensive logs are invaluable not just for investigating possible incidents of cybercrime - they can also be used to track down the causes of performance problems, generate data from which to bill customers, and assist in the decision on whether a server can be resized to increase performance or reduce cost.
As with all Alibaba Cloud features, detailed advice on managing logs is available from the website or from the company's team of implementation consultants. In the case of a cyber-attack, emergency response support is normally a phone call away, helping to handle issues quickly and within the terms of legal obligations.
The Cybersecurity Law requires that companies engage in data categorization, in order to identify important information (credit card details, salaries, passwords, etc.) that must be backed up and encrypted with more care than other more insignificant data.
Alibaba Cloud includes facilities for backup and encryption to ensure data stays safe. In addition, snapshot features mean that admins can quickly set a reference point before undertaking any maintenance, patching or testing on a server instance, and subsequently revert back to that point if things don't go as planned. Developers can use the Object Storage Service to ensure that data and files (up to 48TB) will be automatically encrypted upon creation or upload, and transparently decrypted when accessed.
Fixing security issues when they are discovered, and even proactively looking for possible issues, is an important part of systems management, and Article 25 of the Cybersecurity Law requires that organizations take measures to do this. Alibaba Cloud can help here. The Server Guard facility provides real-time monitoring of servers and can automatically repair certain vulnerabilities if it finds them. In addition, Alibaba Cloud operates a Vulnerability Reward Program (think Bug Bounty) to encourage security professionals to seek and responsibly disclose potential issues within its infrastructure.
The ability to confirm a user's true identity is becoming increasingly important, and the requirement to be able to do this is covered by Article 24 of the Cybersecurity Law. Alibaba Cloud has a full set of systems in place, including verification by phone, SMS and email, to ensure that the identity of anyone attempting to access an organizations' servers is correctly verified.
Article 47 of the Cybersecurity Law requires that companies are able to quickly detect and act upon information published by users that is prohibited by law. Network operators need to be able to delete such information and prevent it from spreading, while also keeping secure logs and other records. A range of content security products and services, available to operators of servers on Alibaba Cloud's infrastructure, helps implement this by allowing systems and databases to be scanned for possible infringing content. The user organization can then decide what action needs to be taken in order to remain compliant.
Although not without its problems, cloud computing can bring significant advantages for organizations over running their own data centers. For the skeptics, it also works well in a hybrid situation, where perhaps an existing data center maintains its historical functionality but new services, or tentative steps into new markets and territories, are cloud-based from day one.
Whichever cloud provider is selected, it is always sensible to use one that is based in the country where the business is transacted to ensure optimal speed, connectivity and support. But it is also vital to ensure that the user organization complies with local regulations, and that means selecting a cloud supplier which can make this as low-cost and hassle-free as possible.
Finally, there may always come a time when you need expert help building the compliance regime. The Cybersecurity Law requires "important data and personal information" collected by critical information infrastructure operators to be stored in Mainland China. Information classed as "sensitive and important" that are collected in Mainland China also needs to be stored there. Operators also need to conduct risk self-assessments and provide evidence of them having been done. Under certain conditions, they may also be inspected by the authorities (Articles 37-39).
ICP (Internet Content Provider) License registration is a key requirement to building a web presence in Mainland China. In this course, produced by Alibaba Cloud, you will gain a clear understanding of the ICP registration process, including the categories of ICP registration, eligibility, as well as a general overview about business incorporation in Mainland China. This webinar is ideally suited for SMEs and large enterprises that wish to establish a website presence in Mainland China on local cloud infrastructure but are unsure where to start and whether they require ICP registration for their particular web project.
In this live-demo we will connect an on-premises network through a VPN-Gateway (https://www.alibabacloud.com/product/vpn-gateway) and IPSec respectively with Alibab Cloud’s Cloud Enterprise Network (https://www.alibabacloud.com/product/cen) with a region in Mainland China with low latency and nearly zero packet loss
The Alibaba Cloud Virtual Private Cloud (VPC) Introduction course is designed to provide you with the fundamental knowledge to plan, configure and administer Alibaba Cloud VPC. In this course we will discuss deployment best practices and use cases of isolated network environment based on Alibaba Cloud VPC including customizing the IP address range, network segment, route table, and gateway.
Through this course, you can understand the functions and usage scenarios of Alibaba Cloud Network products, and be able to use basic service functions. Study Now
OBC SD-WAN (SDWAN) solutions makes a fast and easy way to construct a global private network and accelerates various SaaS applications. Customers are able to enjoy ultra-high speed, high quality data transmission service through the internet , MPLS or VPN. In addition, we leverage the artificial intelligence technology to redefine the WAN by optimizing network traffic and conducting real-time network health check using distributed cloud control system, which increases the visibility of SLA.
For more information about uses of MCA, see Scenarios.
After you purchase MCA instances, you can use these instances with Anti-DDoS Premium Insurance or Unlimited Plan instances to accelerate access to your services for users in mainland China if no attacks are detected. For more information, see Configure Anti-DDoS Premium MCA.
Cloud Connect Network (CCN) is another important component of Smart Access Gateway. It is a device access matrix composed of Alibaba Cloud distributed access gateways. You can add multiple Smart Access Gateway (SAG) devices to a CCN instance and then attach the CCN instance to a Cloud Enterprise Network (CEN) instance to connect the local branches to the Alibaba Cloud.
You must specify an area when buying an SAG device or creating a CCN instance. Each SAG area corresponds to a country, while a CEN area contains one or more Alibaba Cloud regions. The relationships between CCN areas and CEN areas are shown in the following table.
A CCN instance and a CEN instance can directly communicate with each other and no cross-area bandwidth is required if the CCN instance and the CEN instance are in the same area. For example, to connect a local branch in Hangzhou to a VPC in Shanghai, you just need to bind the CCN instance to which the Smart Access Gateway is bound to the CEN instance where the VPC is located.
Provides network acceleration service for your Internet-facing application globally with guaranteed bandwidth and high reliability.
VPN Gateway is an Internet-based service that establishes a connection between a VPC and your on-premise data center.
SmartAG provides an end-to-end cloud deployment solution for connecting hardware and software to Alibaba Cloud.
2,605 posts | 747 followers
FollowAlibaba Clouder - December 7, 2020
Alibaba Cloud Community - May 16, 2022
Alibaba Cloud Community - August 29, 2022
Alibaba Cloud Community - November 23, 2021
Alibaba Clouder - September 26, 2019
Alibaba Clouder - September 20, 2018
2,605 posts | 747 followers
Follow
Networking Overview
Connect your business globally with our stable network anytime anywhere.
Learn MoreMore Posts by Alibaba Clouder