Data Privacy for SaaS Kafka or Pulsar Offerings
summary
Demonstrates end-to-end encryption for SaaS streaming brokers (Kafka via Redpanda and Pulsar) using a prototype built with Docker, Redpanda, Spring Boot (Java), and a mocked centralized key service to encrypt per-message session keys. Shows an initial AES-ECB ciphertext-pattern leak, then switches to AES-CBC with random IVs and transports an encrypted session key per message with session-key rotation (every 10s) incurring about 25% CPU overhead; notes Pulsar has native E2E key handling but requires careful key management and monitoring.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:03Speaker intro
- 4:12Cloud security challenges
- 6:20End-to-end encryption
- 7:23Kafka basics demo
- 9:53AES encryption
- 12:45Algorithm risks
- 13:55Kafka compression impact
- 16:44Java object encryption
- 19:55Key management with Vault
- 24:01Apache Pulsar overview
- 25:46Pulsar native encryption
- 30:04Pulsar demo
- 33:16Pattern summary
- 33:36Best practices
- 36:49Q&A
related talks
27mEnd-to-End Encryption for Streaming Data Pipelines
45mDeep Dive into Data Streaming Security
56mDeep dive into data streaming security
40mKeeping data private in real-time pipelines
51mClient-Side Field-Level Encryption for Apache Kafka Connect
30mThe Secure Metamorphosis: Streaming Logs with Kafka and TLS
36mMulti-tenanted streams @Workday
24mData Security for startups