Glossary

Security group

A security group is a virtual firewall in the cloud. It contains security group rules and cloud resources, such as virtual machines and elastic network interfaces (ENIs). You can add security group rules to allow or deny specific types of network traffic. You can also use security groups to define security domains. This lets you authorize cloud resources in one security group to access resources in another.

For more information, see Security group overview.

Edge cloud node

Edge cloud nodes consist of more than 3,200 edge computing nodes that Alibaba Cloud has deployed worldwide, covering major global hot spots. More than 2,300 of these edge nodes are in mainland China, covering 31 provincial-level regions. More than 900 nodes are outside mainland China, covering over 70 countries. The total bandwidth capacity of the network exceeds 180 Tbps. The edge computing nodes are built on the Apsara kernel architecture and primarily run Edge Node Service (ENS). They act as small, decentralized cloud computing platforms close to end users, providing wide coverage, low latency, and high bandwidth. These features deliver secure, stable, and reliable global content delivery acceleration and edge computing services. This helps resolve issues related to computing power, networking, deployment, and latency in scenarios such as audio and video streaming, gaming, and endpoint virtualization.

For more information, see Edge Node Service.

CDN

A content delivery network (CDN) is a group of servers distributed across different geographic locations to deliver Internet content to users more efficiently. A CDN caches content, such as web pages, images, videos, and other web data, on multiple servers. It then routes each user's request to the nearest server based on their geographic location. This significantly reduces latency, speeds up load times, and improves the overall performance and reliability of a website. This not only improves the user experience but also helps reduce the load on the origin server and increases the website's stability during high traffic.

For more information, see What is Alibaba Cloud CDN?.

DDoS attack

A distributed Denial of Service (DDoS) attack is a common type of network security attack that uses malicious traffic to consume network or device resources, rendering a website or online service unavailable.

For more information, see What is a DDoS attack?.

Region

A region is a geographic area that contains data centers. Regions are typically named after the city where their data centers are located. For example, the China (Beijing) region indicates that the data centers are in Beijing. Alibaba Cloud has multiple regions worldwide. These regions are close to end users to provide lower network latency and a better user experience. A region usually consists of multiple zones. Regions can be further divided into central regions and local regions.

For more information, see Alibaba Cloud Infrastructure.

DNS

The Domain Name System (DNS) is an Internet service. It acts as a distributed database that allows users to access resources on the Internet using easy-to-remember domain names, such as example.com, instead of hard-to-remember IP addresses, such as 192.0.2.1. Its primary function is to map domain names to IP addresses. When a user enters a domain name in a browser or application, the DNS service directs the request to the correct server.

For more information, see What is DNS?.

Access control list

An access control list (ACL) is a common technology used in network security and operating system file permission management. An ACL is a set of rules that specifies which users or system processes are allowed or denied access to specific system resources, such as files, folders, network communication ports, or databases. Properly configured ACLs can significantly improve system and network security.

For more information, see Network ACLs.

Load balancing

Load balancing is a service that distributes traffic across multiple backend servers to increase the throughput capacity of your application system. It can also eliminate single points of failure and improve the availability of your application system.

For more information, see What is Server Load Balancer?.

Express Connect

Express Connect provides a dedicated connection from an ISP to the public cloud. It offers a private, stable, and secure channel to the cloud with ultra-high bandwidth and is a core component of large-scale hybrid cloud architectures. An Express Connect dedicated line avoids the network quality issues of the public Internet and eliminates the risk of data theft during transmission.

For more information, see What is Express Connect?.

Zone

A zone, also known as an Availability Zone (AZ), is a physical area within a single region that has independent power and networking. For example, the China (Beijing) region supports 12 zones, including Beijing Zone A and Beijing Zone B. Instances within the same zone have lower network latency, which results in faster access for users.

Each Alibaba Cloud region consists of multiple zones in different physical locations to ensure fault isolation. This means that if one zone fails, the other zones can continue to operate normally, ensuring high availability. Zones within the same region are interconnected over a low-latency private network. Zones in different regions are completely isolated from each other.

The following figure shows the relationship between regions and zones using Region 1 (with three zones) and Region 2 (with three zones) as examples.

NAT Gateway

A NAT Gateway (Network Address Translation Gateway) is a network service that provides network address translation between the Internet and a private network. It allows multiple devices on an internal network, such as a private cloud or an enterprise intranet, to share a single public IP address to access the Internet. Its primary purpose is to address the scarcity of public IP address resources. It also allows devices on the internal network to securely access external networks and be accessed from them.

For more information, see What is NAT Gateway?.

Global Traffic Manager

Global Traffic Manager (GTM) enables enterprises to provide nearby access for users, balance high-concurrency loads, and perform health checks on application services. Based on health check results, GTM can perform fault isolation or traffic switching. This allows enterprises to flexibly and quickly build active-active and disaster recovery services within the same city or across different regions. GTM is a DNS-level service. It uses DNS to return a specific endpoint to the user, and the client then connects directly to that endpoint. Therefore, GTM itself is not a proxy, gateway, or application access service. It does not process the network traffic between the client and the application service.

For more information, see What is Global Traffic Manager?.

Global interconnection

Alibaba Cloud service nodes are distributed globally. Through its data centers and partnerships with carriers, Alibaba Cloud provides compliant cross-border capabilities to enable network interconnection between multiple regions worldwide.

Alibaba Cloud's service nodes are distributed globally. Alibaba Cloud partners with carriers to provide compliant cross-border capabilities from its data centers. This enables global, multi-region network interconnection. Within the same Alibaba Cloud region, different zones are interconnected over a low-latency private network. Zones in different regions are completely isolated from each other. The global network infrastructure enables efficient and secure data transmission and resource access between different regions. All regions and zones are connected to global users and local data centers through the Internet to provide public network access. The following figure shows this relationship.

Global Accelerator

Global Accelerator (GA) is a network acceleration service with global coverage. It relies on Alibaba Cloud's high-quality Border Gateway Protocol (BGP) bandwidth and global transmission network to provide nearby access for users worldwide. GA reduces the impact of network issues such as latency, jitter, and packet loss on service quality. It provides a high-availability and high-performance network acceleration service for global users.

Elastic IP Address

A domain name is typically used to access a website. DNS resolves this domain name to a specific public IP address. Physical routers and switches on the network then use this public IP address to locate the server. All servers that provide services over the Internet must have a globally unique public IP address. In Alibaba Cloud, this public IP address is an Elastic IP Address (EIP). An EIP is a public IP address resource that you can purchase and hold independently. It consists of a public IP address and a public bandwidth plan. The primary feature of an EIP is that it can be attached to and detached from cloud products at any time. This creates a loosely coupled relationship with the cloud products.

For more information, see What is an Elastic IP Address?.

VPC

A virtual private cloud (VPC) is a private network on the cloud. It lets you configure and manage a logically isolated network area in the public cloud. In this virtual network area, you can control your virtual network environment, including selecting your own IP address range, creating subnets, and configuring route tables and network gateways. A VPC provides a secure and configurable private network space similar to a traditional data center, but with the elasticity and scalability of cloud computing.

For more information, see What is a VPC?.

VPN

A Virtual Private Network (VPN) creates an encrypted channel over the Internet to allow encrypted data transmission between different devices, ensuring the security and privacy of information. Using a VPN hides the user's real IP address, providing anonymity. VPNs are commonly used for remote work, protecting data transmissions, and privately accessing network resources.

For more information, see What is VPN?.

vSwitch

A vSwitch (virtual switch) is a network switching device used in a virtualization environment. It simulates the functions of a physical switch, allowing communication between virtual machines (VMs) and between VMs and the physical network. A vSwitch is a key component of the virtualization infrastructure and resides on the host system as a core component of the virtual network.

WAF

A Web Application Firewall (WAF) identifies and protects against malicious service traffic to websites or apps. It scrubs and filters traffic, then forwards normal, safe traffic to the server. This prevents malicious intrusions that can cause performance issues and ensures the business and data security of your website.

For more information, see WAF overview.

Security Center

Security Center is a server host security management system that identifies, analyzes, and provides alerts for security threats in real time. It offers security capabilities such as anti-ransomware, vulnerability scanning and remediation, anti-virus, tamper-proofing, and compliance checks. These features help you create an automated, closed-loop security operation for threat detection, response, and tracing. Security Center protects cloud hosts, local servers, and containers, and helps you meet regulatory compliance requirements.

For more information, see What is Security Center?.

Cloud Firewall

Alibaba Cloud Firewall is a cloud-based Software as a Service (SaaS) firewall. It provides unified security isolation and control for your cloud network assets across the Internet Border, VPC border, and internal border. It is the first line of network defense for your business on the cloud.

For more information, see What is Cloud Firewall?.

Cloud Enterprise Network (CEN)

Cloud Enterprise Network (CEN) is a cloud-based global network. It is primarily used to build an integrated private network between VPCs in different regions and between VPCs and on-premises data centers. CEN is built on a high-quality global network infrastructure. Through automatic route distribution and learning, it enables rapid network convergence and full-mesh resource interconnection. This helps enterprises build enterprise-grade private networks.

For more information, see What is Cloud Enterprise Network?.

Smart Access Gateway

Smart Access Gateway (SAG) is a cloud-native SD-WAN solution developed by Alibaba Cloud. It provides one-stop cloud access for various network nodes, such as enterprise data centers, headquarters, branches, outlets, edge nodes, and mobile clients, to create an internal enterprise network.

For more information, see What is Smart Access Gateway?.

Transit router

A transit router connects network instances and forwards traffic between them, whether they are in the same or different regions. A transit router supports various routing features, and you can configure routes to control traffic forwarding between network instances.

For more information, see How transit routers work.