overview...hcs online can interconnect with the huawei cloud o&m center through private lines...

HCS Online

Overview

Issue 01

Date 2019-08-21

HUAWEI TECHNOLOGIES CO., LTD.

Copyright © Huawei Technologies Co., Ltd. 2019. All rights reserved.No part of this document may be reproduced or transmitted in any form or by any means without prior writtenconsent of Huawei Technologies Co., Ltd. Trademarks and Permissions

and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd.All other trademarks and trade names mentioned in this document are the property of their respectiveholders. NoticeThe purchased products, services and features are stipulated by the contract made between Huawei and thecustomer. All or part of the products, services and features described in this document may not be within thepurchase scope or the usage scope. Unless otherwise specified in the contract, all statements, information,and recommendations in this document are provided "AS IS" without warranties, guarantees orrepresentations of any kind, either express or implied.

The information in this document is subject to change without notice. Every effort has been made in thepreparation of this document to ensure accuracy of the contents, but all statements, information, andrecommendations in this document do not constitute a warranty of any kind, express or implied.

Issue 01 (2019-08-21) Copyright © Huawei Technologies Co., Ltd. i

Contents

1 HCS Online Overview..................................................................................................................1

2 Why HCS Online...........................................................................................................................3

3 Product Architecture..................................................................................................................... 43.1 System Architecture....................................................................................................................................................... 43.2 Network Architecture..................................................................................................................................................... 53.3 Security Architecture......................................................................................................................................................73.4 O&M Management.........................................................................................................................................................8

4 Product Portfolio..........................................................................................................................11

5 Application Scenarios.................................................................................................................125.1 Pan-government............................................................................................................................................................125.2 Financial Industry......................................................................................................................................................... 13

HCS OnlineOverview Contents

Issue 01 (2019-08-21) Copyright © Huawei Technologies Co., Ltd. ii

1 HCS Online Overview

HUAWEI CLOUD Stack Online (HCS Online) is an extension of HUAWEI CLOUD incustomer data centers. It uses the same architecture, the same cloud services, and the sameAPIs as those of HUAWEI CLOUD to deliver an integrated full-stack on-premises cloudservice platform. HCS Online is deployed in customers' data centers. It provides physicallyisolated resources to ensure security compliance. Its control plane is connected to theHUAWEI CLOUD O&M center through private lines. This enables unified O&M onHUAWEI CLOUD to reduce customers' O&M costs. It is the optimal option for moving corebusinesses of government, finance, and large enterprise customers to the cloud.

Figure 1-1 HCS Online Solution

Consistent Public Cloud Experience

HCS Online provides customers with the consistent service experience with HUAWEICLOUD.l HCS Online uses the same architecture as that of HUAWEI CLOUD and inherits the

mature large-scale commercial architecture of HUAWEI CLOUD. It is stable, reliable,open, and compatible.

l HCS Online provides the same APIs and the same management tools as HUAWEICLOUD, reducing customers' development and adaptation costs.

l HCS Online synchronizes service capabilities with HUAWEI CLOUD. Cloud services inHCS Online are decoupled from each other. This allows users to deploy cloud services asneeded, extend cloud services smoothly, and synchronize cloud service capabilities fromHUAWEI CLOUD quickly.

HCS OnlineOverview 1 HCS Online Overview

Issue 01 (2019-08-21) Copyright © Huawei Technologies Co., Ltd. 1

– Provides complete IaaS services for customers for their exclusive use.– Allows users to deploy services, such as databases, big data, security services,

middleware, and applications as needed.

On-premises Deployment & Unified O&Ml HCS Online is deployed in customers' data centers. Users can exclusively use physically

isolated resources such as computing, storage, network, and cloud services. This enablesspecific performance, service application, and security compliance requirements to bemet.

l HCS Online can be connected to the HUAWEI CLOUD O&M center through privatelines. This simplifies O&M and reduces customers' O&M costs. It is the optimal optionfor moving core businesses of government, finance, and large enterprise customers to thecloud.

Construction of Homogeneous Hybrid CloudHCS Online can interconnect with HUAWEI CLOUD through a VPN or Cloud Directconnection, allowing users to build a consistent hybrid cloud with the unified architecture ofHUAWEI CLOUD. This enables unified authentication, one-click Single Sign-On (SSO),cross-platform switchover, cross-cloud disaster recovery and backup, and layered servicedeployment, for example, layered storage architecture.

HCS OnlineOverview 1 HCS Online Overview


2 Why HCS Online

Exclusive Use and Regulatory Compliance

HCS Online is deployed in customers' data centers. Users can exclusively use physicallyisolated resources such as computing, storage, network, and cloud services. This enablesspecific performance, service application, and security compliance requirements to be met.

Industry-leading Technology

HCS Online synchronizes service capabilities with HUAWEI CLOUD. Cloud services inHCS Online are decoupled from each other. This allows users to deploy cloud services asneeded, extend cloud services smoothly, and synchronize cloud service capabilities fromHUAWEI CLOUD quickly to maintain its leadership in technology.

Collaborative Development

HCS Online provides the same APIs and the same management tools as HUAWEI CLOUD,reducing customers' development and adaptation costs.

Shared Ecosystem

HCS Online inherits the mature large-scale commercial architecture of HUAWEI CLOUDand shares the same ecosystem with HUAWEI CLOUD, offering customers the same serviceexperience in on-premises data centers as on HUAWEI CLOUD.

Hybrid Cloud Capabilities

HCS Online can access HUAWEI CLOUD through a VPN or Cloud Direct connection tomeets customers' requirements for hybrid deployment of businesses, such as comprehensivebusiness cloudification and cross-cloud disaster recovery.

Simplified O&M

HCS Online can interconnect with the HUAWEI CLOUD O&M center through private linesfor unified O&M. This greatly simplifies O&M and reduces customers' O&M costs.

HCS OnlineOverview 2 Why HCS Online


3 Product Architecture

3.1 System Architecture

3.2 Network Architecture

3.3 Security Architecture

3.4 O&M Management

3.1 System ArchitectureThe architecture of HCS Online is as follows:

l Infrastructure: indicates hardware devices and virtualization platforms, includingcomputing, storage, network, and firewall devices. The infrastructure virtualization layerconverts physical resources into virtual resource pools so that various resources can beeasily and dynamically scheduled.

l Cloud service system: indicates IaaS, PaaS, and SaaS services. HCS Online providesmultiple methods of using cloud services, such as the management console, APIs, andSDKs as well as the online help center. Computing, network, and storage resourcesinvolved in using cloud services are applied from the infrastructure virtual resourcepools.

l O&M platform: This platform is designed for the O&M engineers of cloud services forinstallation and upgrade of cloud services and routine monitoring, alarm, log, ticket,security, and cost management of virtualization systems and physical infrastructures.

HCS OnlineOverview 3 Product Architecture


Figure 3-1 HCS Online system architecture

3.2 Network ArchitectureThe network of HCS Online is a flat architecture. It makes the internal switching structuremore simple and clear. For servers and storage devices, the network is divided into the corelayer and access layer.

Figure 3-2 HCS Online network architecture

The networking is divided into five zones based on logical functions:l Internet egress zone: used to connect to the Internet and access network.l Network service zone: provides value-added services, such as traffic statistics, firewall,

load balancing, and VPN.



l Management, computing, and storage zones: used to deploy services. Management,computing, and storage zones have a similar structure. Servers in these three zones aredirectly connected to access switches.

Each zone interconnected with the others through core switches. Core switches are composedof high-performance switches. Subrack switches are used as core switches to form a cluster.Multiple switches are logically virtualized into a switch to implement device redundancy. Inthis case, only one management IP is required for device management. The CSS + iStack +Eth-Trunk mode is used to build a reliable loop-free layer 2 network. The virtual routing andforwarding (VRF) technology is used at the core layer to logically isolate network zones fromservice zones at layer 3.

Internet egress zoneThe Internet egress zone is used to interconnect the data center network with the Internet andthe private line network.

Figure 3-3 Internet egress zone

The Internet egress zone uses routers and Multi-Protocol Label Switching (MPLS) bearernetworks to interconnect with the Internet and Data Communication Network (DCN). TheInternet egress zone uses Border Gateway Protocol (BGP) or static routes to communicatewith external networks. Static routes are used for enterprise access. Dual links are used inactive/standby mode to ensure reliability. Each link connects to a carrier's network to ensurereliability of external connections of the data center.

The anti-DDoS device is optional. It is used to protect the data center from DDoS attacks. Theanti-DDoS device is connected to the router in bypass mode. Port mirroring is configured onthe router to send traffic to the anti-DDoS device for analysis. Dynamic routes are configuredbetween routers and the anti-DDoS device to dynamically divert attack traffic. The anti-DDoSdevice injects the normal traffic after cleaning to routers through policy-based routes, androuters divert the normal traffic after cleaning to the data center through policy-based routes,which ensure traffic security in the data center.

The firewall in the Internet egress zone of the data center is optional and deployed seriallyThe series firewalls work in routing mode and can be divided in to Untrust, Trust, DMZ, and



Management zones. Security domains use interzone policies to control interzone trafficaccess. Open Shortest Path First (OSPF) is configured between the firewall and the egressrouter to dynamically learn routing entries advertised by the intranet.

Network Service ZoneNetwork service zone includes VPN devices for remote accesses, business traffic loadbalancers, and security protection device firewalls.

Figure 3-4 Network service zone

Firewalls are used to isolate security domains and control access between security domains.Firewalls support the virtual firewall function to meet high security requirements of tenants.VPN firewalls allow only legitimate VPN traffic access to the VPN, providing encryptedremote access for users to manage and maintain their own data center resources.

Load balancers balance workloads of users' applications. Load balancing devices can bevirtualized into virtual load balancers. Virtual load balancers are logically isolated. Eachtenant can use at least one virtual load balancer. Data configurations for different tenants areindependent.

Multi-tenant IsolationThe IT administrator deploys dedicated infrastructure resources for each tenant. Deployingpublic infrastructure shared by multiple tenants in the data center can optimize resourceutilization. To use resources at a low cost, different tenant resource isolation policies must bedesigned for the data center to ensure end-to-end path isolation and meet securityrequirements.

3.3 Security ArchitectureHCS Online security architecture is designed based on the best practices in the industry andHuawei's expertise and experience. The security architecture is designed to fully meet securityrequirements of customer businesses, such as security, reliability, and data integrity, andprovide full-stack security defense for customers.

l Reliability: Security devices and key components in security systems in the overallsecurity architecture of HCS Online are deployed in dual-node hot standby mode to meetlong-term running requirements of data center services.

l Modularization: The overall architecture of HCS Online is designed based on sixmodules, including physical security, network security, host security, applicationsecurity, virtualization security and customer business security. The security architecture



can be quickly formed based on customer requirements to provide a customized securitysystem.

l Easy to expand: The security architecture of HCS Online is a guiding framework.Customers can expand the security architecture easily based on the guiding frameworkand their security requirements for different stages. This improves the returns ofcustomer investment and meets their specific security requirements.

Figure 3-5 HCS Online security architecture

HCS Online has passed the following security assessment and authentication: CSA STARgold certification, ISO 20000, ISO 22301, ISO 27001, ISO 27018, CC EAL3+, PCI DSS, andlevel-3 security protection of the Ministry of Public Security; China DC alliance trusted cloudservice certification, trusted cloud gold O&M evaluation, level-1 cloud computing servicecapability (Ministry of Industry and Information Technology), and cyber security review ofCyberspace Administration of China.

3.4 O&M Management

Advantages

With the development of cloud computing and virtualization technologies, IT infrastructuremanagement is transforming to self-service management, IT service automation, horizontally-expanded management of servers, storage, and network architecture, and unifiedmanagement. The next-generation data center management requirements are as follows:l Effective control of physical server costsl Lower data center operation costsl Lower management costsl Lower power consumptionl Short service rollout periodl Unified management of physical and virtual resources from different vendors



l Higher utilization of infrastructure devicesl Fault recovery and disaster protection for critical applicationsl Simplified O&M

To meet the management requirements of next-generation data centers, HCS Online has thefollowing advantages in O&M management:l End-to-end self-service managementl Unified operations and maintenance managementl Automatic process orchestration, resource allocation, and application deploymentl Unified management of multiple data centersl Integration service for multiple hardware devices and softwarel Maintenance management for servers, network devices, storage devices, databases, and

middleware

O&M System ArchitectureHCS Online O&M architecture consists of hardware and software. Figure 3-6 shows theO&M architecture.l Hardware: HCS Online is deployed in the customer data center. Hardware replacement

and network maintenance are performed by the customer.l Software: Software O&M is performed by both the customer and the Huawei O&M

team.– Customer O&M: Cloud Eye is mandatory for customer O&M capabilities. It is used

for monitoring databases, OSs, and cloud service resources of the customer. CloudEye is a multi-dimensional resource monitoring platform. Customers can use CloudEye to monitor the utilization of service resources, track the running status of cloudservices, configure alarm rules and notifications, and quickly respond to resourcechanges. Cloud Eye is automatically enabled based on the resources created by thecustomer. Customer can view the running status of resources and set alarm rulesthrough Cloud Eye.Application Operations Management (AOM) is optional for customer O&Mcapabilities. AOM is used for cloud-based business apps and middleware. AOM is aone-stop O&M management platform. Customers can use AOM tocomprehensively monitor and uniformly manage servers, storage devices, networks,web containers, and applications hosted in Docker and Kubernetes. This effectivelyprevents problems and helps O&M personnel locate faults in minutes, reducingO&M costs.

– Huawei O&M: Huawei HCS Online provides remote O&M services for the cloudplatform, including monitoring alarms, deployment changes, troubleshooting,network management, and O&M data analysis. 24/7 monitoring is available forcustomers to ensure stable running of their businesses. This eliminates the need forcustomers to perform infrastructure O&M and enables them to focus on corebusinesses, creating values for customers.



Figure 3-6 HCS Online O&M architecture



4 Product Portfolio

HCS Online continuously provides customers with a wide range of cloud services onHUAWEI CLOUD to meet customers' requirements in different scenarios. In addition, HCSOnline synchronizes service capabilities with HUAWEI CLOUD for continuous iterations andupgrade.l Basic services

HCS Online provides the following basic computing, storage, network, and managementservices: Elastic Cloud Server (ECS), Bare Metal Server (BMS), Auto Scaling (AS),Elastic Volume Service (EVS), Volume Backup Service (VBS), Object Storage Service(OBS), Scalable File Service (SFS), Cloud Server Backup Service (CSBS), VirtualPrivate Cloud (VPC), Elastic Load Balance (ELB), Virtual Private Network (VPN), NATGateway, Domain Name Service (DNS), Identity and Access Management (IAM), CloudTrace Service (CTS), and Cloud Eye

l Database servicesHCS Online provides multiple database engines, including the following: RDS forMySQL, RDS for PostgreSQL, Document Database Service (DDS), and DistributedDatabase Middleware (DDM)

l Big data servicesHCS Online provides various big data services for different scenarios, including thefollowing: MapReduce Service (MRS), Data Warehouse Service (DWS), GraphicsEngine Service (GES), Data Lake Factory (DLF), Cloud Search Service (CSS), andCloud Data Migration (CDM)

l Middleware and application servicesHCS Online provides application middleware for customers. This helps customers todeploy applications in containers and upgrade and reconstruct microservice architecture.Currently, the following services are provided: ServiceStage, SoftWare Repository forContainer (SWR), Cloud Container Engine (CCE), Application Operations Management(AOM), Application Performance Management (APM), Distributed Message Service(DMS), Application Orchestration Service (AOS), and Distributed Cache Service (DCS)

l Security servicesHCS Online provides the following security services to ensure security of customerapplications and data: Security Center, Anti-DDoS, Data Encryption Workshop (DEW),and Database Security Service (DBSS)

HCS OnlineOverview 4 Product Portfolio


5 Application Scenarios

HCS Online can meet the requirements of data-isolated deployment and security compliancefor moving core businesses of finance, pan-government, and large enterprise customers to thecloud. With customers' data secured, HCS Online can quickly synchronize innovative serviceson HUAWEI CLOUD, for example, EI, PaaS, database, and big data services. Specialized andunified O&M are provided by HUAWEI CLOUD for HCS Online customers.

5.1 Pan-government

5.2 Financial Industry

5.1 Pan-governmentSolution to Promoting Internet+Government Affairs People-Benefiting Information PilotProjects (State Council [2016] 23) requires that the governments' governance capabilitiesneed to be improved based on data. Government cloud projects and government big dataprojects for provinces, cities, and counties are used to break information silos, facilitatecollaborative among departments, thereby changing the passive service model to an activeservice model.

In December 2016, the State Council officially released the National InformatizationPlanning for the13th Five-Year Plan (National Development which determined theconstruction objectives of the new smart cities. Through new technologies such as AI, bigdata, and Internet of Things (IoT), urban development and construction methods aretransformed, and local resources are optimized, and urban governance is effectivelyimplemented, to provide high-quality public services, resolve or alleviate various problems,and promote sustainable urban development. The new smart city construction involves thepan-government departments related to precise governance, welfare services, eco-friendlyhousing, and industrial and economic services. These departments may include economic andinformation commission, bureau of land and resources, administration of taxation,development and reform committee, and recruitment bureau at all levels and transportation,taxation, social security, water resources, environmental protection departments as well asheating and natural gas supply organizations.

Highlightsl Proximal deployment and controllability: The cloud platform is deployed in the customer

data center to meet the requirements for data confinement in the province or governmentequipment room. Huawei owns independent intellectual property rights and delivers

HCS OnlineOverview 5 Application Scenarios


hardware and software in a unified manner, which ensures self-control over theresources.

l Security compliance: With internal network zone isolated from the Internet, HCS Onlineprovides full-stack end-to-end security defense covering the infrastructure layer, externalaccess, O&M management, and tenant cloud services to meet security compliancerequirements.

l Full-stack cloud service capability: HCS Online fully inherits the rich cloud servicecapabilities of HUAWEI CLOUD and provides cloud service platforms required byvarious Smart City applications, including IaaS, PaaS, and EI. HCS Online iterates andevolves together with HUAWEI CLOUD.

l Scalable cloud services and smooth expansion: Cloud services are decoupled from eachother. Users can deploy cloud service based on their business needs with minimal upfrontinvestment and expand cloud services as needed in the future.

Customer Benefitsl Provides unified planning, construction, and O&M, reducing investment costs.

l Offers full-stack cloud service capability and various intelligent devices to improvegovernment administrative capabilities, facilitate lives of citizens, and boom businessesof smart cities.

l Meets governments' requirements for local deployment and security compliance.

5.2 Financial IndustryThe "Thirteenth Five-Year Plan (2017) for the Development of Information Technology inChina's Financial Sector" points out that China will provide strong support for largeorganizations to build financial industry cloud platforms independently or jointly. Theseplatforms will be used to provide cloud services for financial institutions at all levels in theindustry, especially the small- and mid-sized ones, to improve the utilization efficiency ofindustry resources.

Multiple banking financial technology companies are established and make contributions tothe information building, business processes, and financial application software developmentusing financial industry clouds. Services from the group internal to financial enterprise, suchas small and medium-sized banks, funds, insurance, securities, trust, and to other non-financial enterprises. Financial technologies, such as cloud, big data, block chain, and AI, arebecoming key factors in the core competitiveness of various industry clouds.

Highlightsl HCS Online has rich cloud service capabilities of HUAWEI CLOUD and supports

security isolation and exclusive use of resources.

l HCS Online can access HUAWEI CLOUD to implement unified O&M, greatly reducingO&M complexity and costs and enabling customers to focus on upper-layer servicereliability.

l The O&M plane, management plane, and tenant plane are isolated from one another, andsecurity is ensured dimensionally from chips to the cloud, meeting China's level 3information security protection requirements.

l An independent portal and an independent IAM authentication system are available.



Customer Benefitsl Security compliance: HCS Online supports full-stack isolation to meet security

compliance requirements for the finance and insurance industries.l Fast innovation: HCS Online offers a wide range of stable IaaS and PaaS services to

facilitate customers' innovations.l Quick delivery: The delivery duration is short, the service version is upgraded quickly,

and the latest capabilities of HUAWEI CLOUD can be synchronized.



overview...hcs online can interconnect with the huawei cloud o&m center through private lines...

Documents