← Back
Home › Systems › Security and identity

e2e-cloud-backup

end-to-end encrypted cloud backup

iCloud Advanced Data Protection

SystemTechniques · 12Primitives · 54 e2e-cloud-backup Deterministic simulation testingdistributed · medium: Run the whole system in one thread under a seeded scheduler with simulated network, disk and clock, so every failure replays from its seed.›Primary-backup replicationdistributed · medium: One node orders all writes and ships them to standbys; the acknowledgement rule (none, one, all) sets what a crash loses, and an external arbiter decides who takes over.›Coverage-guided fuzzingsecurity · medium: Mutate inputs, run an instrumented target, and keep any input that reaches a new code edge; feedback turns blind guessing into incremental search.›Envelope encryptionsecurity · medium: Encrypt each object with its own data key and wrap that key under a KMS-held key, so rotation re-wraps 60 bytes and deleting a key shreds data.›Key rotationsecurity · medium: Rotating keys without downtime: key ids, overlap windows, re-wrapping, JWKS publication, revocationErasure codingstorage · medium: Reed-Solomon k+m coding to survive m lost shards at lower overhead than replicationPoint-in-time recoverystorage · medium: Periodic base backups plus a continuously archived change log let you rebuild the state as of any instant, then branch from there.›AEAD (AES-GCM, ChaCha20-Poly1305)security · low: Authenticated encryption that encrypts and detects tampering in one call; the only kind of symmetric encryption you should use.›Object storagecloud · low: S3-compatible blob storage at cents per GB-month with 11 nines durability; pick by egress price, request price and latency, not by storage price alone.›Content defined chunkingcompression · low: Rolling-hash chunk boundaries (Rabin, FastCDC) for deduplication that survives insertionsZstandard (zstd)compression · low: LZ77 plus Huffman and FSE entropy coding, with levels from LZ4-like speed to xz-like ratio, all decoding at about 1-2 GB/s.›Hdr histogramdata-structures · low: Log-linear bucketed histograms with bounded relative error for latency percentilesMerkle treedata-structures · low: Hash tree for verifying and diffing large datasets with logarithmic proofsIdempotency keysfinance · low: Client-chosen unique key per logical operation, stored with a request fingerprint and the final response, so retries replay the first result instead of acting twice.›Process supervisionhardware-os · low: A parent process starts services, reaps their exits and restarts them under a delay and burst-limit policy, then stops them with SIGTERM before SIGKILL.›Resumable uploadsnetworking · low: Open an upload session, send the body in offset-addressed chunks, and after any failure ask the server how much it committed and continue from there.›Cryptographic hashes (SHA-2, BLAKE3)security · low: Collision-resistant fingerprints of data; SHA-256 for interoperability, BLAKE3 for speed, HMAC/HKDF for keyed uses.›ECDH key exchange (X25519, P-256)security · low: Each side multiplies the other's public curve point by its own scalar and both get the same point; always validate the peer key and run the result through a KDF.›Hardware backed keystoresecurity · low: Non-exportable keys in Secure Enclave, StrongBox, TPM: generation, use policies, biometric gatingHKDF key derivation (extract-and-ex…security · low: HMAC-based two-step key derivation: extract a uniform pseudorandom key from any secret, then expand it into as many context-bound keys as you need.›Mutual TLSsecurity · low: TLS where the client also proves a certificate key, so every connection carries a verified, rotatable machine identity.›Password-authenticated key exchange…security · low: Both sides blind a Diffie-Hellman message with a password-derived group element, so an attacker gets one guess per run and nothing to brute-force offline.›Shamir secret sharing (k-of-n)security · low: Split a secret into n shares so any k reconstruct it and any k-1 reveal nothing at all, using a random polynomial over a finite field.›+ 5 more techniques+ 38 more primitives

Similar systems

Share the most building blocks with this one.

password-manager 44 %secrets-kms 36 %patch-delivery 36 %photo-backup 35 %esim-provisioning 34 %