Enlarge / Apple’s iCloud Drive Web interface in Safari. (credit: Samuel Axon)
Apple has updated its publicly available iOS security documentation to disclose that personal data associated with the company’s iCloud service is stored in cloud servers operated by Google—specifically, the Google Cloud service.
Apple didn’t specify exactly what iCloud data is stored on Google’s servers. But the new document does explain a little bit about how the data is encrypted. Here is the entire iCloud section entry that includes the Google Cloud reference from the document in question:
iCloud stores a user’s contacts, calendars, photos, documents, and more and keeps the information up to date across all of their devices, automatically. iCloud can also be used by third-party apps to store and sync documents as well as key values for app data as defined by the developer. Users set up iCloud by signing in with an Apple ID and choosing which services they would like to use. iCloud features, including My Photo Stream, iCloud Drive, and iCloud Backup, can be disabled by IT administrators via MDM configuration profiles. The service is agnostic about what is being stored and handles all file content the same way, as a collection of bytes.
Each file is broken into chunks and encrypted by iCloud using AES-128 and a key derived from each chunk’s contents that utilizes SHA-256. The keys and the file’s metadata are stored by Apple in the user’s iCloud account. The encrypted chunks of the file are stored, without any user-identifying information, using third-party storage services, such as S3 and Google Cloud Platform.
S3 is part of Amazon Web Services (AWS). Previously, the document mentioned S3 and Microsoft’s Azure cloud computing service. There is no longer any reference to Azure in the document, but the language does not necessarily preclude continued use of that service. The update to the document came in January; the most recent update before then was in March of 2017.
Read 4 remaining paragraphs | Comments
