什么是虚拟私有云？

Because virtual private clouds (VPC) are based in the public cloud space, VPCs have all the features expected from the public cloud—security, elasticity, scalability, and cost-planning and control. These are the key features cloud consumers expect from cloud service providers. VPCs, however, have additional security concerns, namely around how the CSP guarantees that a client’s VPC is isolated and protected from other partitions within the public cloud.

Isolating technologies include:

• Subnet Masks — Subnet masks reserve ranges of IP addresses that are off-limits to certain groups. By setting subnet masks, VPCs can have ranges of private addresses reserved for within the network, and completely invisible to the public Internet.
• Virtual Local Area Networks (VLAN) — A virtual local area network is a way to establish a group of computer devices that are logically segmented into VLAN that operates as a single network. Clients can be physically located anywhere.
• Virtual Private Networks (VPN) — Virtual private networks (VPN) are not networks, but refer to the creation of a private connection to a network over the public Internet. VPNs use encryption to establish a secured “tunneled” connection and can be used to securely connect to a virtual private cloud.
• Availability Zones — Availability zones logically and physically isolate partitions of the CSPs infrastructure within regions with their own power, cooling, and connectivity. By avoiding a single point of failure, availability zones help bolster redundancy and fault tolerance within the system.

Virtual private cloud architecture is built upon the same infrastructure other cloud models are. Including the technologies and practices that establish public cloud services, CSPs also use a three-tier architecture, and demilitarized zones to help organize VPC services.

• Three-tier Architecture — As it sounds, three-tier architecture creates three interconnected layers that divide software responsibilities—web or presentation tier, application tier, and database tier. The presentation tier receives web browser requests and returns web pages and data stored within the other two layers. The application tier is what is considered the heart of the application where the business logic lives and works. The database tier houses the databases that store the data that the application tier interacts with and eventually sends that data to the presentation tier to be consumed.
• Demilitarized Zone (DMZ) — Also called perimeter networks, DMZs are subnets established to create a buffer between the LAN, private cloud, or VPC, and the public Internet. DMZs provide access control, threat prevention, and detection of IP spoofing. The DMZ is protected from the Internet by a firewall, and then the enterprise LAN has a firewall that protects it from the DMZ. This configuration allows for resources to be exposed to the public, while also protecting the enterprise systems. If attacks do breach the DMZ, then they are stopped by the second firewall which is usually hardened against attacks.

A public cloud is a shared pool of IT resources delivered to cloud consumers over the Internet by a cloud service provider (CSP). Depending on the level of service, cloud consumers and CSPs enter into a service level agreement (SLA) contract that defines the cloud service and for which parts each party is responsible (e.g. who is responsible for data, infrastructure, application, etc.).

Contrastingly, a private cloud is a cloud deployment model where a single organization owns and administers its own cloud and the underpinning networking infrastructure to support it. This model creates central access to IT resources for departments and staff across multiple locations and potential regions. Private clouds are implemented behind the organization’s firewall which is the major distinguishing factor from other cloud deployments models. In the private cloud model, the organization that owns the private cloud is both cloud consumer and cloud service provider (CSP).