Key management and encryption/decryption using KMS

Overview

KMS(Key Management Service) is a Managed Service that enables customers to securely create, store, and manage encryption keys, providing a reliable centralized encryption key management solution.

Data security is a critical factor in cloud environments. You can encrypt data within a service or application using an encryption key via the API.

Additionally, the encryption keys generated by KMS are created using a hardware security module verified according to FIPS 140-2.

Architecture Diagram

1. The Master Key generated by the KMS administrator is created in a secure HSM configured on a separate network and delivered to the KMS.
2. The Master Key generated by the HSM and transmitted is stored in the KMS.
3. The application requests the KMS to generate a data key via the API.
4. KMS issues a Data Key, a subordinate key, using the Master Key.
5. Encrypt plaintext data with the Data Key.
6. Store or retain encrypted data.
7. The Data Key is encrypted via KMS and stored or retained.

Use Cases

Encryption for storing personal data

Sensitive user information (name, resident registration number, mobile phone number, etc.) must be stored in an encrypted form rather than in plain text.

When storing data, encrypting it with an encryption key issued through KMS before saving can reduce the risk of personal data leakage and ensure secure storage.

Digital Signature and Verification

KMS supports asymmetric keys.

Using public-key encryption, you can easily obtain signature and verification values for authentication. The document’s contents are encrypted and signed by the client using their private key, and the receiving server decrypts and verifies them using the public key previously provided by the client.

Using symmetric keys provides higher confidentiality and can also resolve issues caused by theft.

Prerequisites

KMS encryption key can be used only after the Key manager has pre‑created the Master Key.

Constraints

To perform encryption using a Data Key within the application, you must use the API provided by KMS, and the encryption logic required to use the API must be developed within the application.

Considerations

Only the Key administrator has authority over the creation, deletion, and rotation of the Master Key.

The Master Key rotation period is up to 2 years and rotates automatically.

The Data Key, which the customer obtains directly and uses for encryption, is generated through the Master Key and is managed directly by the customer.

Related service

This is a list of Samsung Cloud Platform services that are related to the features or configurations described in this guide. Refer to this when selecting and designing services.