Securing Data in Motion and at Rest: Quantifying End-to-End Encryption Perfo...
summary
Real-world benchmarks on Ceph RGW quantify costs and show what changes performance: client TLS terminated at RGW has almost no throughput loss and only ~10–20% CPU increase, msgr2+secure adds a small CPU tax (~4–11%) with negligible throughput impact, and SSE‑S3 server‑side encryption hits performance—reads drop up to ~45% and small‑object workloads suffer due to key‑manager round trips. Scaling to 12 nodes yields near‑linear gains reaching 111 GB/s reads (~9.25 GB/s per node) and small‑object reads hit 400k IOPS at ~2 ms latency; HAProxy SSL termination shows unexpected throughput loss.
AI-written summary · about
chapters (15)
- 0:00Introduction and presenters
- 1:27Security challenges in object storage
- 3:14Benchmarking objectives and overheads
- 4:39Architecture decisions and configurations
- 6:47Hardware setup and environment
- 8:12Scaling performance results
- 11:06Large object performance analysis
- 12:30Small object performance analysis
- 15:23Erasure coding vs replication
- 17:12Encryption in transit at RGW
- 18:58SSL termination at HAProxy
- 20:24Internal cluster encryption
- 22:11Encryption at rest performance
- 23:56Key takeaways and recommendations
- 25:07Q&A session
related talks
27mEncrypting Data in Ceph: An Overview and Opportunities
41mLinux Encryption Performance is Not an Excuse Anymore
29mProtecting data vs systems: practicality, performance, and problems...
30mEncrypting Memory at Scale
41mCryptographic speed, reliability & security
30mData Security: Theoretical and Real World Approache...
28mPsycho Security - End to End Encryption
36mCeph Security BoF