登录查看更多内容

How can you design an encryption scheme that balances security and performance for real-time systems?

由人工智能和领英社区提供技术支持

Encryption is a vital component of any system that handles sensitive or confidential data. However, encryption can also introduce overhead and latency that can affect the performance and responsiveness of real-time systems. How can you design an encryption scheme that balances security and performance for real-time systems? In this article, we will explore some encryption best practices and patterns that can help you achieve this goal.

此文章中的业界达人

由社区从 9 条内容中精选。了解更多

James Lin

Information Technology Manager, Regional Municipality of Halton
Magdalena Wojnarowska-Pietrzak

Cloud Architect | Azure | AWS | Author of "Mind The Gap: Most Common Cloud Mistakes"

1 Choose the right encryption algorithm

The first step is to choose an encryption algorithm that suits your system's requirements and constraints. There are different types of encryption algorithms, such as symmetric, asymmetric, and hybrid, each with their own advantages and disadvantages. Symmetric algorithms, such as AES, use the same key for encryption and decryption, and are generally faster and more efficient than asymmetric algorithms, such as RSA, which use different keys for encryption and decryption, and are more secure but slower. Hybrid algorithms, such as SSL/TLS, combine both symmetric and asymmetric encryption, and are widely used for secure communication over the internet. Depending on your system's architecture, you may need to use one or more of these algorithms to encrypt different layers or components of your system.

添加您的观点

James Lin

Information Technology Manager, Regional Municipality of Halton
举报内容
Do not design your own encryption schemes. If you're qualified in building an encryption scheme you likely do not need this guidance. Even cryptographers publish their algorithms for review and testing. AES came from a NIST competition. Choose tested, industry recognized encryption algorithms (AES, ChaCha20) operating in the correct mode(s). GCM mode for AES in transmission and maybe XTR mode for AES for data at rest. Choose AES over ChaCha20 if you have hardware acceleration, ChaCha20 if you don't (for streaming ciphers). Various vendors and open source projects will build encryption to industry standard, validate that. If they can provide a CMVP (Cryptographic Module Validation Program) number then it's tested encryption not snake oil.

已翻译

赞
Jerry Ho

Product Growth Manager at Qinetics Solutions Sdn Bhd | webnic.cc
举报内容
-depends on the frequency of encrypting data, higher frequency shall use lower cost encryption methods to keep the performance. Except for crucial data that required to transmit in extremely secure ways. -depends on the use case, sometimes not even require to use encryption, but hashing simply solves the issue. -choose existing encryption algorithms based on the above use case, those have been proven mathematically or technically whether it works or not, unless the requirements require you to make a new encryption algorithm.

已翻译

赞

加载更多内容

2 Minimize the amount of data to encrypt

The second step is to minimize the amount of data that needs to be encrypted, as encryption adds overhead and complexity to your system. You can do this by applying the principle of least privilege, which means that only the data that is absolutely necessary for the system's functionality and security should be encrypted, and the rest should be left in plain text or discarded. For example, you may only need to encrypt the data that is transmitted over the network, or the data that is stored in a database, or the data that is sensitive or confidential, and not the data that is used for internal processing or display. You can also use compression techniques, such as gzip, to reduce the size of the data before encrypting it, which can improve the performance and bandwidth of your system.

添加您的观点

加载更多内容

3 Use encryption keys wisely

The third step is to use encryption keys wisely, as they are the most critical and vulnerable part of your encryption scheme. You need to ensure that your encryption keys are generated, stored, distributed, and rotated securely and efficiently, and that they are protected from unauthorized access or tampering. You can use various techniques, such as key derivation functions, key management services, key exchange protocols, and key rotation policies, to manage your encryption keys effectively. You also need to choose the appropriate key length and strength for your encryption algorithm, as longer and stronger keys provide more security but also require more computational resources and time.

添加您的观点

Magdalena Wojnarowska-Pietrzak

Cloud Architect | Azure | AWS | Author of "Mind The Gap: Most Common Cloud Mistakes"
举报内容
When managing encryption keys, ensure to take care who can access them. Remember to apply least privilege principles. Grant only necessary permissions e.g. based on job or system requirements. Don’t forget about key lifecycle management, which entails creation, usage, rotation as well as destruction. To detect any suspicious behavior or unauthorized activities related to encryption keys, it is worth to consider setting up monitoring and alerting.

已翻译

赞

加载更多内容

4 Optimize your encryption code

The fourth step is to optimize your encryption code, as it can have a significant impact on the performance and reliability of your system. You need to ensure that your encryption code is written in a clean, concise, and consistent manner, and that it follows the best practices and standards of your programming language and platform. You also need to test, debug, and benchmark your encryption code regularly, and identify and eliminate any errors, bugs, or bottlenecks that may affect your system's functionality or security. You can also use various tools, such as profilers, analyzers, and libraries, to optimize your encryption code and make it more efficient and robust.

添加您的观点

加载更多内容

5 Monitor and update your encryption scheme

The fifth step is to monitor and update your encryption scheme, as it can evolve and change over time due to various factors, such as new threats, new technologies, new regulations, or new requirements. You need to keep track of the performance and security of your encryption scheme, and collect and analyze relevant metrics, such as encryption speed, encryption quality, encryption errors, encryption breaches, and encryption costs. You also need to review and update your encryption scheme periodically, and implement any necessary changes or improvements, such as changing your encryption algorithm, increasing your key length, or adding new encryption layers or components. You can also use various methods, such as audits, reviews, and feedback, to evaluate and improve your encryption scheme and ensure that it meets your system's needs and expectations.

添加您的观点

加载更多内容

6 Learn from others

The sixth step is to learn from others, as you can benefit from the experience and expertise of other system architects, developers, and users who have designed or used encryption schemes for real-time systems. You can consult various sources, such as books, articles, blogs, podcasts, videos, courses, or forums, to learn more about encryption best practices and patterns, and to discover new ideas, tips, or solutions that can help you design your own encryption scheme. You can also participate in various communities, such as groups, networks, events, or conferences, to share your knowledge, insights, or challenges, and to get feedback, support, or advice from your peers or mentors.

添加您的观点

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

Eliyahu Ravuna

Sr. Software Engineering Manager at Johnson & Johnson MedTech (Biosense)
(已编辑)
举报内容
Encryption shall come together with authentication. Encryption without authentication is prone to man-in-the-middle attacks. Authentication can be achieved via shared secret keys, or with a public key infrastructure. Secrets and certificates may be stored in tamper-resistant TPM chips. Some systems-on-a-chip and CPUs, such as ARMv8, offer hardware cryptographic accelerators. Some NICs offer TLS offloading. These hardware may enable real-time systems to implement security requirements without hurting the performance.

已翻译

赞

System Architecture

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

How can you design an encryption scheme that balances security and performance for real-time systems?

1

2

3

4

5

6

7

1 Choose the right encryption algorithm

2 Minimize the amount of data to encrypt

3 Use encryption keys wisely

4 Optimize your encryption code

5 Monitor and update your encryption scheme

6 Learn from others

7 Here’s what else to consider

System Architecture

给文章评分

感谢您的反馈

更多System Architecture相关文章

更多相关阅读内容

How can you design an encryption scheme that balances security and performance for real-time systems?

1

2

3

4

5

6

7

1 Choose the right encryption algorithm

2 Minimize the amount of data to encrypt

3 Use encryption keys wisely

4 Optimize your encryption code

5 Monitor and update your encryption scheme

6 Learn from others

7 Here’s what else to consider

System Architecture

给文章评分

感谢您的反馈

查看其他技能