Tech, ExplainedNetworking, infrastructure and security
Part

Encryption key management

Encryption is only as safe as the keys.

↑ Data security
INSIDE: DATA PROTECTIONHOW IT WORKS · 40 PAYROLL DATABASES AT A COMPANY IN MYSURUEach of the 40databases isencrypted withits own data keyEach data key isencrypted withone master keythat staysinside the HSMThe salaryapplicationsends itsencrypted datakey to thekey managerThe key managerchecks thepermission anddecrypts the keyinside the HSMThe master keyis rotated every12 monthsA client leaves:every copy ofits data key isdeleted, and itsdata and backupsbecomeunreadableALSO TALKS TOCertificate lifecycle managementEnterprise digital rights managementConfidential computingINSIDE: DATA PROTECTIONHOW IT WORKS · 40 PAYROLL DATABASES AT A COMPANYIN MYSURUEach of the 40 databasesis encrypted with its owndata keyEach data key isencrypted with onemaster key thatstays inside the HSMThe salary applicationsends its encrypted datakey to the key managerThe key manager checksthe permission anddecrypts the key insidethe HSMThe master key is rotatedevery 12 monthsA client leaves: everycopy of its data key isdeleted, and its data andbackups become unreadableALSO TALKS TOCertificatelifecycle managementEnterprise digitalrights managementConfidential computingINSIDE: DATA PROTECTION · 40 PAYROLL DATABASESAT A COMPANY IN MYSURUEach of the 40 databases is encryptedwith its own data key↓Each data key is encrypted with onemaster key that stays inside the HSM↓The salary application sends itsencrypted data key to the key manager↓The key manager checks the permission anddecrypts the key inside the HSM↓The master key is rotated every 12 months↓A client leaves: every copy of its datakey is deleted, and its data and backupsbecome unreadableALSO TALKS TOCertificate lifecycle managementEnterprise digital rights managementConfidential computing
Encryption key management keeps one master key inside the HSM, uses it to unlock each of 40 payroll databases' data keys for an approved application, rotates it yearly, and deletes a leaving client's key.
opens a page inside this one a page in the same scene a page in another scene a concept page a label only, with no page

Encryption key management is the software and hardware that create, store, hand out, change and destroy the keys used to encrypt a company's data. Encryption scrambles data so that only the holder of the right key can unscramble it. So encrypted data is only as safe as its keys. If a key is stored next to the data, a thief who takes the data takes the key too.

The most important keys are kept in a hardware security module (HSM). An HSM is a tamper-resistant device, often a card or a box in a data centre, that stores keys and carries out encryption inside itself. The key never leaves it in readable form. Key management software runs on top of the HSM, and decides which application may use which key.

Here is a typical case. A payroll company in Mysuru keeps the salary and bank details of 2 lakh employees of its client companies, in 40 databases. Each database is encrypted with its own key, called a data key. The data keys are not stored in readable form. Each one is itself encrypted with a master key, which stays inside the HSM. Encrypting keys with another key in this way is called envelope encryption.

When the salary application starts, it sends its encrypted data key to the key manager. The key manager checks that this application is allowed to use this key. It decrypts the data key inside the HSM and returns it to the application, which keeps it only in memory. Every use of every key is recorded.

Keys are also replaced on a schedule. This is called rotation. The payroll company rotates its master key every 12 months, so that a key stolen in the past cannot unlock anything encrypted after the change. And when a client company leaves, the payroll company deletes every copy of that client's data key, including the encrypted copies kept with backups. At once, every copy of that client's data, including old backups, becomes unreadable. This is called crypto-shredding.

In the cloud, a company can create its keys in its own key manager and keep control of them, instead of leaving them only with the cloud provider. This is called bring your own key.

Keys are also used in certificates, the files that let machines prove who they are. These are handled by certificate lifecycle management. Enterprise digital rights management asks the key manager for the key to each protected file. With confidential computing, the key manager releases a key only to code that it has checked. A change is also coming: post-quantum cryptography. Some of today's key types will have to be replaced by new algorithms that future quantum computers cannot break, and the key manager is where that replacement is carried out.

Talks to

Certificate lifecycle managementEnterprise digital rights managementConfidential computing

Concepts

EncryptionPost-quantum cryptography

Who builds it

FortanixProtegrityProtecto
Tech, Explained is a part of ingrid.fyi. Every page explains one piece of technology in plain words.