NAS provides server-side and client-side encryption to protect cloud data, and supports backup and recycle bin features to prevent data loss.
Data encryption
NAS provides server-side and client-side encryption to protect cloud data.
Encryption in transit
NAS supports TLS-based encryption in transit. When enabled, all communications between the NAS client and server are encrypted.
For more information about how to enable encryption in transit, see Encryption in transit for NFS file systems or Encryption in transit for SMB file systems.
Server-side encryption
NAS supports the following encryption mechanisms:
-
NAS-managed key encryption
NAS creates and manages encryption keys in KMS. You can view and modify key permissions, but cannot delete or disable the key.
-
Custom key encryption
Use custom keys hosted in KMS to encrypt and decrypt file systems. If a key is disabled or deleted, the encrypted file system becomes inaccessible. Custom keys can be generated in two ways:
-
Use KMS to create: Create CMKs in the KMS console. You can enable, disable, delete, and rotate these keys.
-
Bring your own key (BYOK): Import keys generated by on-premises or cloud services into KMS for use as CMKs. For more information, see Import key material.
-
For more information, see Create a General-purpose NAS file system and Create an Extreme NAS file system.
Data backup
NAS integrates with Cloud Backup for disaster recovery, protection against accidental deletion or tampering, data versioning, compliance, and migration. For more information, see Backup and restoration.
Cloud Backup is a fully-managed online backup service that allows you to back up data to the cloud in a convenient, efficient, and secure manner. You can use Cloud Backup to back up data from Elastic Compute Service (ECS) instances, ECS-hosted databases, ECS files, NAS file systems, Object Storage Service (OSS) buckets, and Tablestore instances. You can also use Cloud Backup to back up data from self-managed data centers that store files, databases, virtual machines (VMs), and large-scale NAS file systems. Cloud Backup allows you to implement disaster recovery and archive data based on the archive policies that you configure for the preceding resources. For more information, see What is Cloud Backup
To protect important data from accidental deletion or tampering, use the NAS recycle bin or snapshot feature to back up and restore files and directories. For more information, see Recycle bin and Snapshots.
Recycle bin
The recycle bin provides low-cost protection against accidental deletion and data loss from software errors or manual misoperations. For more information, see Recycle bin.
Data erasure mechanism
The data erasure mechanism ensures that deleted data cannot be accessed by other users. Deleted data is completely erased through the following process:
-
The data in NAS file systems of different users is completely isolated. The data in each NAS file system is managed, indexed, and verified based on the metadata. Reading data across different NAS file systems is not allowed.
-
If a file is deleted from a NAS file system, the metadata index is updated immediately. This ensures that the corresponding physical space cannot be indexed and the data can no longer be read. When the physical storage space is reallocated, it is cleared and then added to the metadata index. The system returns only zero for requests that attempt to read data from the storage space for the first time.
-
When a NAS file system is released, the storage system immediately destroys the metadata to ensure that the data is no longer accessible. At the same time, the physical storage space that corresponds to the NAS file system is recycled. When the physical storage space is reallocated, data is cleared again and then overwritten by newly written data. Before data is written to the physical storage space, the system returns only zero for all read requests.