Security white paper

Development and production permission isolation

IDaaS CIAM Dedicated Edition provides a development environment, a staging environment, and a production environment. Each environment consists of distinct instances. The cloud resources for each instance, such as ECS, RDS, Redis, and OSS, are physically isolated, with no permissions shared between them.

Authentication and authorization

1. Access control

   1. Management console sign-in control

      The root account activates an IDaaS instance in the RAM console and can then directly access the IDaaS console by clicking the instance.

      To allow other users to access the IDaaS console, use the root account to create multiple RAM users and attach an IDaaS permission policy to them. This allows RAM users to access IDaaS CIAM under specific conditions. You can also configure MFA for different administrators in IDaaS CIAM to further prevent unauthorized access and protect your data and services.

      On the Select Permissions page in the RAM console, switch to the System Policy tab. Search for IDaaS and select AliyunYundunIdaasReadOnlyAccess (grants read-only access to Application Identity Service) or AliyunYundunIdaasFullAccess (grants management access to Application Identity Service).

   2. Application access control

      IDaaS CIAM issues a unique application key for each application and uses a key-based encryption mechanism to secure access. You can further prevent unauthorized access by defining the authorized user scope, setting IP address restrictions, and enabling anomaly detection.

2. API access authorization

   IDaaS CIAM lets you control the scope of APIs that are exposed externally and shared between applications. This enables fine-grained permission control to prevent unauthorized access.

   1. Externally exposed APIs are classified as either application-type or user-type based on their security level.

   2. Application-type APIs have a higher security level. They control which IDaaS APIs an application can access, such as for sign-in, sign-up, and sending verification codes, as well as whether the application has permission to manage account information.

   3. User-type APIs have a lower security level. They primarily cover user actions such as changing a phone number or email address, or deleting an account.

   4. For API sharing between applications, IDaaS CIAM allows you to define custom API scopes and authorize them for specific applications. This prevents unauthorized access between applications.

3. Key rotation

   IDaaS CIAM uses key encryption for security during authentication and authorization. It also provides key rotation to protect against key compromise and enhance the security of user information in tokens.

   Additionally, IDaaS issues an application key for each application and provides key rotation for it. Only systems verified with the application key can access authorized APIs.

Data security

1. Data collection scope

   By default, IDaaS CIAM collects the following personal information:

   • Account

   • Phone number

   • Email address

   • Password

   All information is collected only with explicit user authorization. Any information collected beyond this default scope requires additional explicit authorization.

2. Data transmission security

   All access to IDaaS services, whether over the internet or a private network, uses HTTPS to protect data in transit from interception and tampering.

   

3. Data encryption algorithms

   1. IDaaS encrypts critical user information, such as phone numbers and email addresses, using AES (AES/ECB/PKCS5Padding) for storage.

   2. For passwords, the system stores salted digests (SHA-256 with SALT). This significantly improves password security. Only the user knows their password, and the original password cannot be retrieved even if the database is compromised.

   3. IDaaS issues tokens in JWT format. To ensure the security of user credentials, user information within the token is encrypted with AES. This prevents user information from being retrieved even if a token is stolen. Tokens are signed by using RSA asymmetric keys, ensuring that only IDaaS can verify their authenticity.

4. Sensitive data protection

   IDaaS CIAM provides data identification, data masking, and audit monitoring to help you protect your data.

   With data identification, you can automatically classify the sensitivity level of data based on predefined rules. The system includes built-in categories for account type data, user type data, and account extension type data. The security levels are ranked in descending order: account type > user type > extension type.

   With data masking, you can mask sensitive data using methods such as display masking or hash encryption. The degree of masking varies based on the data's security level.

   With audit monitoring, you can monitor operations performed on account type data by specific users or administrators.

Infrastructure security

The overall architecture of the IDaaS product is designed for high availability.

• The system uses SLB, private network access, and a POP gateway that uses reverse authorization to connect the network.

• All CIAM-related services are deployed on ECS instances that are distributed across different availability zones and support horizontal scaling.

• Redis nodes are distributed across different availability zones. Redis stores only cached data. If data is lost, it is automatically reloaded from the database, so no backup is required.

• RDS primarily stores tenant information, application information, and traffic package information. The database is backed up once a day, and multiple backup copies are retained.

• The primary and secondary database servers are located in different availability zones. If the primary server fails, the secondary server automatically takes over.