End-to-end Encryption in Cloud Services
summary
Cloud messaging uses a cloud-mediated Diffie-Hellman mediated KMS to give clients session keys while storing only encrypted envelopes in Cassandra encrypted blobs; conversation state maps to per-resource keys that let the system copy keys to another org, rotate keys on removal, and support join-in-progress history. Search runs on an on‑prem indexer that decrypts with the KMS, tokenizes/stems, HMACs terms and sends back encrypted indexing for server-side matching. Prototype is implemented; authentication via the identity provider and web‑client JS key exposure remain the main risks.
AI-written summary · about
chapters (7)
- 0:00Introduction to Cisco Spark
- 4:44Encryption goals and strategy
- 8:27Key management and architecture
- 17:40Authentication and trust
- 21:24Encrypted search functionality
- 26:05Q&A on security and compliance
- 36:47Resource model and final Q&A
related talks
28mYour Secrets in Cloud-Based Key Management Services
50mImprove data control for customers with AWS KMS
05mEnd to End Encryption for Mobile Developers
54mEnabling Message Level Protection at Uber
29mProtecting data vs systems: practicality, performance, and problems...
50mBuilding Production-Grade End to End Encrypted App...
01h 07mIntroduction to cryptography
51mUsing Key Management Service for data protection