Hologres security white paper - data encryption, access control, network isolation - Hologres

Hologres provides enterprise-grade security through data encryption, access control, audit logging, and network isolation.

Data security

Hologres has passed an independent third-party audit on the security, availability, and confidentiality principles of the AICPA Trust Services Criteria for Alibaba Cloud. SOC 3 Report.

Alibaba Cloud holds the Payment Card Industry Data Security Standard (PCI DSS) certification — the world's most stringent financial data security standard — confirming compliance with payment system security requirements and the ability to provide secure and reliable solutions to customers. PCI DSS Certification Report.

Storage encryption

Hologres supports data-at-rest encryption using Key Management Service (KMS).

Introduction to KMS

Key Management Service (KMS) is a cloud cryptographic service that provides key management compliant with Chinese national standards, simple encryption and decryption services for your applications, and a dedicated HSM-backed version for storing keys in your own hardware security module cluster. What is KMS?.

KMS provides HSMs that are tested and certified by the State Cryptography Administration (SCA) and have obtained Level 2 certification for GM/T 0028.
KMS provides only Transport Layer Security (TLS)-based secure access channels and uses only secure transport encryption suites. This complies with PCI DSS security specifications.
Keys are generated in the HSM using a secure random number generation algorithm that uses high system entropy as a seed. This prevents attackers from recovering the keys.
Keys are protected by hardware security mechanisms. The plaintext of a key is used for cryptographic operations only within the HSM and never leaves its security boundary.
You can use ActionTrail to fully audit key usage and confirm that keys are used correctly. You can audit KMS API calls that use keys, regardless of whether the calls are from Alibaba Cloud services or user applications.

Hologres capabilities

Hologres supports only Bring-Your-Own-Key (BYOK), a visible and controllable semi-managed encryption method. BYOK is an industry-recognized advanced security technology that lets you securely import offline-generated keys into a KMS-hosted HSM. The HSM prevents key export. You can delete and re-import the key at any time. Encrypt data at rest.

Hologres uses KMS key management and the encryption library provided by the security department to enable storage encryption based on algorithms such as AES-256, AES-128, RC4, and the national standard SM4.
Hologres lets you set a separate encryption rule for each table. This means you can set different KMS keys to encrypt different tables.

Important

Hologres calls the KMS API during reads and writes to retrieve key information, which is cached for 24 hours by default. Data encryption incurs KMS fees. KMS 1.0 billing.
After you enable storage encryption, query and write performance is affected by the encryption and decryption operations. The performance loss is about 20% to 40% and varies based on the query characteristics.

Encryption in transit

You can enable SSL to encrypt network connections at the transport layer, improving communication security and integrity, but this increases the network connection response time. Encryption in transit.

An Alibaba Cloud SSL Certificate is a WebTrust-certified credential that enables HTTPS between your server and visitors, providing identity verification and encrypted transmission. Without SSL, HTTP traffic is vulnerable to eavesdropping, tampering, and phishing. What is an SSL Certificate?.

Data masking

Hologres supports column-level data masking with per-user policies. When enabled, query results automatically mask sensitive data. Supported rules include IP address, email address, and hash masking. Data masking.

System security

Account

You need an Alibaba Cloud account with completed identity verification to purchase and use Hologres. Access the service programmatically with an AccessKey pair.

Hologres supports Resource Access Management (RAM). A root account can create RAM users and grant them scoped access permissions to Hologres instances. All resources belong to the root account.

Authentication

Create an AccessKey pair in the Alibaba Cloud console. The AccessKey ID is public and identifies the user; the AccessKey secret is private and authenticates requests.

Each API request includes a signature generated from the AccessKey secret. Hologres validates the signature server-side — if it matches, the request proceeds; otherwise Hologres returns HTTP 403.

Authorization

Access a Hologres instance with an Alibaba Cloud account (owner only) or a RAM user (requires explicit grants). Hologres supports three authorization mechanisms. Hologres permission models.

Alibaba Cloud account: Hologres verifies that the account owns the instance.
RAM user: Hologres checks whether the root account has granted this RAM user access to the instance.

Hologres provides the following three permission models:

Permission type	Scenario	Description
Standard PostgreSQL authorization model	Fine-grained control — grant specific users access to specific tables (e.g., allow user zinan.tang to read table1).	Use `GRANT/REVOKE` to manage permissions on databases, schemas, tables, and views.
Simple permission model (SPM)	Coarse-grained, database-level permission control.	Pre-packaged database-centric model with fixed user-group roles. Simple to configure and covers most authorization scenarios.
Schema-level permission model (SLPM)	Finer-grained, schema-level permission control with simple configuration.	Pre-packaged schema-centric model with fixed user-group roles. Provides finer granularity than SPM while keeping authorization simple.

RAM authentication
- Hologres supports RAM authentication. A root account creates and manages RAM users and grants them access to specific Hologres instances.
- You can also access Hologres through role-based SSO. A RAM role becomes an instance member with the same permissions as an Alibaba Cloud account member. RAM role authorization mode.

Auditing

ActionTrail

Hologres integrates with ActionTrail to query instance management event logs from the last 90 days through the console, OpenAPI, and developer tools, enabling event monitoring, alerting, and compliance auditing. Audit event logs.

ActionTrail records operations performed via the console, APIs, or service roles. Records are tracked within 10 minutes.
View 90 days of operation records in the console or via API. Records capture who, what, when, source IP, success/failure, and whether the call originated from console or API. Download events or deliver them to Simple Log Service or OSS for behavior analysis and compliance auditing.
ActionTrail delivers records to OSS or Simple Log Service with encryption, access control, and delivery notifications.
Create multiple trails to track different event types and regions separately, delivering to different buckets for role-based audit segregation.

Implementation principle

Hologres Query Log

Hologres records all DDL statements and all DML/DQL statements exceeding 100 ms. Logs are retained for 30 days. View and analyze slow query logs.

Network security

Access isolation

Hologres provides network-level isolation:

The classic network, VPC, and public network of each instance are isolated from each other. You can access an instance only through the corresponding endpoints and virtual IP addresses (VIPs) for each network.
Hologres instances support the configuration of a specific VPC ID to ensure that an instance can be accessed only from the corresponding VPC.

IP whitelist

Hologres enforces multiple access-control layers, including AccessKey-based authentication described above.

IP whitelists add another layer: when enabled, only whitelisted devices can access the instance — requests from non-whitelisted IPs are rejected even with valid credentials. IP whitelist.