Encrypting Data in Ceph: An Overview and Opportunities
summary
A clear proposal to add AEAD ciphers to Ceph and store authentication tags in OMAP for auth tags is presented with a working proof‑of‑concept in the user‑space RBD library that encrypts sequential 4KB chunks, fetches keys from HashiCorp Vault, and benchmarks on one server: under 1% overhead at 4KB and up to 6% at 64KB (small sample). The goal is to provide integrity checks at the RADOS level so RGW, RBD and FS layers can all benefit.
AI-written summary · about
chapters (19)
- 0:00Introduction and overview
- 1:07Server-side encryption basics
- 3:12Implementation in OSDs
- 5:21Common pitfalls in OSD encryption
- 6:22Confidentiality and integrity analysis
- 7:08RGW server-side encryption
- 8:58Setting up RGW encryption
- 10:24Client-side encryption overview
- 11:54Key management challenges
- 12:14RBD encryption implementation
- 13:39RBD encryption pitfalls
- 16:30Summary of RBD encryption
- 16:51CephFS encryption overview
- 17:55CephFS encryption details
- 18:15Integrity issues in current solutions
- 20:02Improving data integrity
- 23:10Proposal for Rados-level integrity
- 24:56Performance benchmarks
- 26:20Conclusion and Q&A
related talks
35mData Security and Storage Hardening in Rook and Ceph
30mData Security: Theoretical and Real World Approache...
18mData Security and Storage Hardening in Rook and Ceph
29mSecuring Data in Motion and at Rest: Quantifying End-to-End Encryption Perfo...
36mCeph Security BoF
13mBest UADK Acceleration Practice on Ceph Storage
44mOn the Road to TDE
29mProtecting data vs systems: practicality, performance, and problems...