Custos: Increasing Security with Secret Storage as a Service
summary
Prototype Custos implements Secret Storage as a Service and stores encryption keys on a centralized server with a RESTful API, a plug‑in authentication system and ordered access control chains so permissions can require username then IP then password. A FUSE overlay called EncryptFS ties file encryption to Custos so keys never sit locally. Clients can shard keys with Shamir secret sharing across providers for fault tolerance. Prototype works with measurable latency overhead but acceptable throughput.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:30Where do we store data
- 7:38Centralized Secret Storage
- 9:59Custos Client Model
- 12:42Flexible Access Control Model
- 15:06Access Control System
- 17:39Key Storage
- 21:25Custos Prototype
- 23:47Future Work
- 25:17Custos Architecture
- 25:38Cloud Ecosystem
- 26:00Questions
related talks
30mTrust No One: Secure Storage With Confidential Containers
24mSafeguarding Sensitive Data Access At Scale with Privacy-Enhancing Technologies
20mMulticloud and the Chamber of Secrets
34mWhich Vault? Don't tell me your secret(s)!
10mLightning Talk: How to Keep a Secret in GitOps, Without Keeping...
24mCan You Keep a Secret? On Secret Management in Kubernetes
30mData Security: Theoretical and Real World Approache...
20mPrivacy as a Shield: Strengthening Security Through Bitcoin and Self-Custody