By default, the sensitive data classification and grading service of Data Security Center (DSC) runs on a shared cluster. To meet higher security and compliance requirements, you can enable and use the DSC dedicated cluster.
Solution Architecture
This solution creates an endpoint in your business VPC and connects it to a Data Security Center dedicated cluster. ECS instances call Data Security Center APIs to classify and categorize sensitive data. The entire workflow uses private network communication and is built on dedicated clusters for Data Security Center and Alibaba Cloud Model Studio, ensuring data processing is isolated from other tenants.
Implementation Steps
Note: This feature requires dedicated deployment. To purchase or configure this capability, contact your account manager first.
Step 1: Enable the dedicated cluster service
Entry points:
If you have not purchased a DSC instance: Go to the Data Security Center purchase page.
If you have purchased a DSC instance and want to upgrade: On the Data Security Center console Overview page, click Upgrade.
Locate AI Data Security Gateway, enable this feature, and select the QPS for Text Detection and Image Detection as needed. The QPS consumption rules for each detection type are as follows:
Text/File detection: Each sensitive information item consumes 1 QPS (text detection).
Image detection: Each call consumes 1 QPS (image detection). If the image contains sensitive information, each item consumes an additional 1 QPS (text detection).
Image desensitization: Each call consumes 2 QPS (image detection). If the image contains sensitive information, each item consumes an additional 1 QPS (text detection).
Purchase and complete payment.
Step 2: Connect to the DSC network
Create an ECS instance in the business VPC where the data to be classified and categorized is stored. This instance calls DSC APIs to classify and categorize data. For steps to create an ECS instance, see Create an instance.
NoteIn multicloud or on-premises data center scenarios, prioritize establishing network connectivity to the cloud VPC. For details, see Connect an on-premises data center to a cloud VPC through an Express Connect circuit.
Go to the Endpoints - Create Endpoint page and complete the following configurations. Keep unmentioned configuration items at their default settings.
Configuration Item
Description
Region
Select the region where your business VPC is located.
Endpoint Name
Set an easily identifiable name.
Endpoint Type
Select Interface Endpoint.
Endpoint Service
Use Select Available Services and choose AI Data Security Gateway Service from the list.
VPC, Security Group, Zone and vSwitch
Select your business VPC, along with its security group and vSwitch.
After the endpoint is created, log on to the ECS instance and run the
ping <endpoint domain name>command to test connectivity.
Step 3: Verify classification and categorization APIs
A DSC dedicated cluster supports classification and categorization detection for text, files, and images. Additionally, text and images support desensitization. Log on to the ECS instance created in the previous step and run the following commands to test:
Text detection and desensitization
Call address: https://<replace with your endpoint domain name>:8443/sddpApi/textDetection.
Request parameters:
Name | Type | Description |
Text | String | The text to be detected. |
Lang | String | The language of the return value:
|
Return parameters:
Name | Type | Description |
code | Integer | The response status code. |
desensitization | String | The desensitized string. |
requestId | String | The request ID. |
sensitiveData | Array | A list of detected sensitive data. |
sensitiveData.id | Integer | The sensitive data rule ID. |
sensitiveData.desc | String | The description of the sensitive data type, such as "City (the Chinese mainland)". |
sensitiveData.data | Array[String] | A list of detected sensitive data content. |
sensitiveData.sensitiveLevel | Integer | The sensitive level. |
sensitiveData.category | String | The sensitive data classification, such as "Personal geographic location information". |
sensitiveData.count | Integer | The number of sensitive data items hit. |
Request example:
curl -k -X POST \
-d "Text=Welcome to Beijing" \
-d "Lang=zh" \
https://<replace with your endpoint domain name>:8443/sddpApi/textDetectionReturn example:
{
"code": 200,
"desensitization": "Welcome to Beijing",
"requestId": "2026****1003",
"sensitiveData": [
{
"id": 1739,
"desc": "City (the Chinese mainland)",
"data": [
"Beijing"
],
"sensitiveLevel": 0,
"category": "Personal geographic location information",
"count": 1
}
]
}File detection
Call address: https://<replace with your endpoint domain name>:8443/sddpApi/fileDetection.
Request parameters:
Name | Type | Description |
file | file | The file to be detected. |
Lang | String | The language of the return value:
|
Return parameters:
Name | Type | Description |
code | Integer | The response status code. |
requestId | String | The request ID. |
sensitiveData | Array | A list of detected sensitive data. |
sensitiveData.id | Integer | The sensitive data rule ID. |
sensitiveData.desc | String | The description of the sensitive data type, such as "City (the Chinese mainland)". |
sensitiveData.data | Array[String] | A list of detected sensitive data content. |
sensitiveData.sensitiveLevel | Integer | The sensitive level. |
sensitiveData.category | String | The sensitive data classification, such as "Personal geographic location information". |
sensitiveData.count | Integer | The number of sensitive data items hit. |
Request example:
curl -k -X POST \
-F "file=@/home/admin/test.txt" \
-F "Lang=zh" \
https://<replace with your endpoint domain name>:8443/sddpApi/fileDetectionReturn example:
{
"code": 200,
"requestId": "2026***03",
"sensitiveData": [
{
"id": 1739,
"desc": "City (the Chinese mainland)",
"data": [
"Beijing"
],
"sensitiveLevel": 0,
"category": "Personal geographic location information",
"count": 1
}
]
}Image detection
Call address: https://<replace with your endpoint domain name>:8443/sddpApi/imageDetection.
Request parameters:
Name | Type | Description |
file | file | The image to be detected. |
Lang | String | The language of the return value:
|
Return parameters:
Name | Type | Description |
code | Integer | The response status code. |
requestId | String | The request ID. |
sensitiveData | Array | A list of detected sensitive data. |
sensitiveData.id | Integer | The sensitive data rule ID. |
sensitiveData.desc | String | The description of the sensitive data type, such as "City (the Chinese mainland)". |
sensitiveData.data | Array[String] | A list of detected sensitive data content. |
sensitiveData.sensitiveLevel | Integer | The sensitive level. |
sensitiveData.category | String | The sensitive data classification, such as "Personal geographic location information". |
sensitiveData.count | Integer | The number of sensitive data items hit. |
Request example:
curl -k -X POST \
-F "file=@/home/admin/test.jpeg" \
-F "Lang=zh" \
https://<replace with your endpoint domain name>:8443/sddpApi/imageDetectionReturn example:
{
"code": 200,
"requestId": "20260***03",
"sensitiveData": [
{
"id": 1739,
"desc": "City (the Chinese mainland)",
"data": [
"Beijing"
],
"sensitiveLevel": 0,
"category": "Personal geographic location information",
"count": 1
}
]
}Image desensitization
Call address: https://<replace with your endpoint domain name>:8443/sddpApi/imageMask.
Request parameters:
Name | Type | Description |
file | file | The image to be detected. |
MaskRuleIdList | String | A list of desensitization rule IDs, connected by a
|
Return parameters:
Name | Type | Description |
base64 | String | The Base64-encoded image after desensitization. |
code | Integer | The response status code. |
requestId | String | The request ID. |
Request example:
curl -k -X POST \
-F "file=@/home/admin/test.jpeg" \
-F "MaskRuleIdList=3002,3000,1002" \
https://<replace with your endpoint domain name>:8443/sddpApi/imageMaskReturn example:
{
"base64": "/9j/RYQcic*****6cqbVqX",
"code": 200,
"requestId": "2026***4f"
}Quotas and Limits
Input file or text size must not exceed 10 MB.
Input image size must not exceed 5 MB.