Solutions and case studies
This topic describes the active geo-redundancy architecture, its use cases, and case studies of its implementation for the State Taxation Administration and China Unicom's new customer service system.
Active geo-redundancy database solution
Background
As cloud computing grows, more organizations are moving their information systems to the cloud, making it critical to use cloud services to ensure service availability and data quality. To protect information systems from irreversible damage caused by catastrophic events like fires, floods, earthquakes, regional power outages, or sabotage, a disaster recovery system is essential to ensure availability and security.
In 2007, China's State Council Informatization Office, in collaboration with eight key industries including banking, electric power, civil aviation, railway, and securities, released the national standard GB/T20988-2007, "Information System Disaster Recovery Specifications." This standard defines six levels of disaster recovery capability, which enterprises often use as a benchmark or a compliance requirement. However, most traditional disaster recovery solutions, such as same-city disaster recovery, same-city active-active, geo-disaster recovery, or three data centers across two regions, cannot meet the requirements for Levels 5 and 6. They also incur high costs, and their backup units lack robustness.
Active geo-redundancy is a next-generation disaster recovery solution. It ensures continuous high availability for your business while enabling cost optimization and scaling out across regions. This topic focuses on solutions that use major Alibaba Cloud database products in active geo-redundancy scenarios.
Architecture
- Access layer: Business traffic is distributed by the tenant's DNS to the access layer of different units based on weight. At the access layer, the system inspects a traffic-splitting identifier in the request header or cookie and compares it against custom routing rules. If a request is destined for the current unit, it is passed to the service layer. Otherwise, the traffic is forwarded to the peer unit. This forwarding can use upstream forwarding or a 304 redirect, depending on internal network connectivity.
- Service layer: The service layer hosts business application systems, including middleware. If you use Alibaba Cloud middleware such as Cloud Service Bus (CSB) or Message Queue (MQ), or use remote procedure calls (RPC), you can route traffic and correct routing errors at the service layer. In an active geo-redundancy scenario, RPC services fall into three types:
- Unitized services: Fully autonomous services within each unit. This is the primary service type in active geo-redundancy scenarios. These services determine the destination unit for traffic and correct routing errors.
- Centralized services: Services that strongly depend on the central unit. All traffic is routed to the central unit, where these services access the data layer of that unit.
- Regular services: Services that require no modification. They invoke services within their own unit and access the data layer of that unit.
- Data layer: The data layer handles cross-region database deployment and synchronization. It also provides data protection policies to ensure data quality during a failover. Two data synchronization strategies, UNIT and COPY, are available for different upstream service types:
- BidirectionalUNIT type: Each unit has an independent database system. Data Transmission Service (DTS) performs real-time, data synchronization between units to ensure each unit contains a full dataset. All units can handle read and write operations. Custom traffic-splitting policies route read and write traffic and provide write protection for each unit. This synchronization strategy supports unitized services at the service layer and is the core strategy for active geo-redundancy.
- One-wayCOPY type: Each unit has an independent database system. Data Transmission Service (DTS) performs real-time, data synchronization to ensure each unit contains a full dataset. The central unit can handle both read and write operations, while non-central units are read-only. This strategy supports centralized and regular services. Centralized services route requests back to the central unit for execution, while regular services can perform reads within their local unit.
Use cases
- High requirements for disaster recovery: Active geo-redundancy can meet the Level 6 disaster recovery capability defined by the China national standard. It is suitable for businesses with high disaster recovery requirements, traffic-sensitive services, or critical core systems.
- Fine-grained traffic management: Active geo-redundancy supports multiple traffic management policies. It is ideal for businesses with complex traffic management needs, such as routing users to the nearest region or assigning them to a specific data center based on user attributes.
- Rapid business growth: Active geo-redundancy allows you to scale out your business at the unit (data center) level. After you define the service deployment profile for a single unit, you can use it as a template to quickly deploy multiple units, rapidly expanding your capacity.
- Read-heavy workloads: Read-heavy workloads inherently avoid many issues of asynchronous data replication. The cost of migrating such a business to an active geo-redundancy architecture is also relatively low, making it a highly suitable use case.
Benefits
- Business as disaster recovery: In traditional geo-disaster recovery or a three data centers across two regions setup, the remote disaster recovery center is typically idle. If a regional disaster occurs, this remote center's availability is not guaranteed, resulting in a low failover success rate. In an active geo-redundancy architecture, all data centers are active and continuously handle business traffic. This ensures the entire system remains robust at all times. Each data center functions as both a business system and a disaster recovery system.
- Business continuity0: In an active geo-redundancy architecture, all data centers normally handle business traffic. If a failure occurs, you can fail over in minutes simply by redirecting incoming traffic. As you add more data centers to the architecture, the proportion of traffic to redirect during a failure decreases. Traffic handled by unaffected data centers is by the failover.
- Support for rapid business growth: As a business grows rapidly, it can be constrained by the finite resources of a single region, leading to performance bottlenecks at the data layer. With any disaster recovery architecture other than active geo-redundancy, all write operations must occur at the primary production center. Active geo-redundancy creates a closed loop for business traffic, allowing every data center to handle both read and write operations. This enables you to scale out and expand quickly across regions.
- Effective traffic isolation: Active geo-redundancy provides an inherent top-down traffic isolation capability. This allows you to completely isolate business traffic at the data center level. You can flexibly adjust the traffic load for each data center. Within a minimally isolated data center (for example, one handling only 1% of traffic), you can perform controlled technical evolutions with manageable risk, such as infrastructure upgrades or testing new technologies.
- Effective cost control: To handle a single regional disaster, both a three data centers across two regions setup and a traditional geo-disaster recovery setup require the backup center to have enough resources to handle 100% of the traffic. This, combined with the production center, results in 200% cost redundancy. Active geo-redundancy distributes the load across multiple data centers in different cities, effectively amortizing the costs and achieving a cost redundancy of less than 200%.
Case study: State Taxation Administration
Background
The individual income tax system is a major national project for China's financial and tax informatization. It centralizes sensitive information for 780 million individuals and tax declaration data for 360 million active filers, making it a critical national information asset and a massive government cloud platform. This context created demanding requirements for disaster recovery while also raising concerns about the costs associated with building such a system at a massive scale. The organization chose the active geo-redundancy solution to meet its disaster recovery needs while addressing challenges related to cost and rapid growth.
Architecture
- ApsaraDB RDS for MySQL and PolarDB-X handle transaction processing (TP) workloads, while AnalyticDB for MySQL handles analytical processing (AP) workloads.
- Multi-site High Availability (MSHA) provides traffic management and failover capabilities for the active geo-redundancy setup.
- Data Transmission Service (DTS) handles real-time data synchronization across regions and within the cloud.
- Data Management (DMS) manages routine operations, maintenance, and data changes.
- Database Backup Service (DBS) backs up data to a third-party platform.
- Implemented multiple traffic-splitting strategies for different business modules. For the e-tax bureau's online services, traffic is routed based on individual file numbers, while for offline list queries, traffic is routed based on region.
- Achieved Level 6 disaster recovery capability, enabling failover in seconds with zero data loss.
- Multi-site High Availability (MSHA) manages traffic and performs failovers.
- The customer deployed two units, each handling 50% of the business traffic to ensure full resource utilization.
- Leveraged flexible traffic allocation policies in the control plane to enable canary releases for major service launches.
Case study: China Unicom's new customer service system
Background
The new China Unicom customer service system handles all of the company's customer service operations nationwide. The system demands extremely high continuous high availability and marks the starting point for China Unicom's evolution toward site-wide high availability. Its workloads are primarily focused on transaction processing.
Architecture
- ApsaraDB RDS for MySQL and PolarDB-X store business data and connect to the active geo-redundancy control system.
- Data Transmission Service (DTS) provides real-time cross-region data synchronization and status reporting.
- Multi-site High Availability (MSHA) provides traffic management and failover capabilities.
- Seven business centers in the new customer service system, including the access center, outbound call center, and business support center, use region-based traffic splitting for active geo-redundancy.
- The customer successfully conducted multiple disaster recovery drills, switching traffic across several provinces. Failovers completed in seconds with zero data loss.
- The customer deployed two units, both of which actively handle business traffic, ensuring full resource utilization.