How-to guides

Users can enter the required information for the Key Management Service through the Samsung Cloud Platform Console, select detailed options, and create the service.

Create a customer-managed key

You can create and use a customer-managed key in the Samsung Cloud Platform Console.

To create a customer-managed key, follow the steps below.

1. All Services > Security > Key Management Service Click the menu. Go to the Service Home page of Key Management Service.

2. Click the Customer Managed Key Creation button on the Service Home page. You will be taken to the Customer Managed Key Creation page.

3. Customer Managed Key Creation On the page, enter the information required to create the service and enter additional information.

   • Service Information Input area, input or select the required information.

     Category	Required	Detailed description
     Key name	Required	Enter key name
     Public Authentication Algorithm	Select	Use When selected, can generate encryption keys that meet public encryption standards Public Authentication Algorithm option is available only in the KR SOUTH region In the Public Authentication Algorithm, the ARIA algorithm, which has passed security verification through the Korean cryptographic module verification system, is provided
     Purpose	Required	Select the key’s purpose and encryption method If you do not select the use of public authentication algorithms, choose among encryption/decryption (AES-256), encryption/decryption and signing/verification (RSA-2048), signing/verification (ECDSA), generation/verification (HMAC)
     Automatic rotation	Select	Select whether to use automatic rotation of the key If Use is selected, the internal algorithm of the generated key is converted to a different value and applied at each set rotation period The rotation period can be set to a value between 1 and 730 days. If no rotation period is entered, it defaults to 90 days
     Description	Selection	Enter additional key information

     Table. Customer Managed Key Service Information Input Items
   • Additional Information Input Enter or select the required information in the area.

     Category	Required	Detailed description
     Tag	Select	Add Tag Up to 50 can be added per resource After clicking the Add Tag button, enter or select Key, Value values

     Table. Customer Managed Key Additional Information Input Items

4. Summary Check the detailed information and estimated billing amount generated in the panel, and click the Create button.

   • When creation is complete, check the created resource on the Customer Managed Key List page.

Check detailed information of customer-managed key

Customers can view and edit the full resource list and detailed information of customer-managed keys. The Customer Managed Key Details page consists of Details, Tags, Activity Log tabs.

To view detailed information about the Key Management Service, follow these steps.

1. Click the All Services > Security > Key Management Service menu. Navigate to the Service Home page of Key Management Service.

2. Click the Customer Managed Key menu on the Service Home page. Navigate to the Customer Managed Key List page.

3. Click the resource to view detailed information on the Customer Managed Key List page. It navigates to the Customer Managed Key Details page.

   • Customer Managed Key Details At the top of the page, status information and descriptions of additional features are displayed.

     Category	Detailed description

     | Status | Displays the status of the customer-managed key

     • Active: available/activated

     • Stop: disabled/deactivated

     • To be terminated: scheduled for deletion

     • Creating: in progress/creation error (immediate retry possible)

     | | Key Rotation | Button that can manually rotate the generated key |
     | Key Deactivation | Button to deactivate the created key | | Service termination | Button to terminate the service

     • When in To be terminated state, display Cancel termination button

     |

     Table. Customer-managed key status information and additional functions

Detailed Information

Customer Managed Key List page allows you to view detailed information of the selected resource and, if necessary, edit the information.

Tag

Customer Managed Key List page, you can view the tag information of the selected resource, and you can add, modify, or delete it.

Work History

You can view the operation history of the selected resource on the Customer Managed Key List page.

Managing customer-managed keys

You can create a new version of a registered key or change its usage status.

Setting up customer-managed key rotation

Key rotation is a function that converts the internal algorithm of a generated key to a different value.

To create a new version of the generated customer-managed key (key rotation), follow the steps below.

1. All Services > Security > Key Management Service Click the menu. Go to the Service Home page of Key Management Service.
2. Click the Customer Managed Key menu on the Service Home page. You will be taken to the Customer Managed Key List page.
3. Customer Managed Key List page, click the resource to view detailed information. You will be taken to the Customer Managed Key Details page.
4. Customer Managed Key Details page, click the Key Rotation button. Key Rotation alert window will open.
5. Key Rotation Click the Confirm button in the notification window.

Enabling Customer Managed Key

You can set whether the selected key is used.

To set the activation/deactivation status of the generated customer-managed key, follow the steps below.

1. All Services > Security > Key Management Service Click the menu. Navigate to the Service Home page of Key Management Service.
2. Click the Customer Managed Key menu on the Service Home page. Navigate to the Customer Managed Key List page.
3. Click the resource to view detailed information on the Customer Managed Key List page. You will be taken to the Customer Managed Key Details page.
4. Customer Managed Key Details page, click the Key Activation/Key Deactivation button. You will be taken to the Key Activation/Key Deactivation notification window.
5. Key activation/key deactivation Click the Confirm button in the alert window.

Encryption case using Key Management Service

The example procedure for encrypting and storing important user application data by issuing a data key from KMS is as follows.

1. When the Application starts, obtain a data key using the KMS master key information, and perform and store security data encryption on the client side using the plaintext data key.
2. The data key is stored in the database in an encrypted form with the master key.
3. When performing secure data decryption, retrieve the data key stored in the database and request decryption using the KMS master key information.

The encryption/decryption procedure using the Key Management Service key is explained with the following diagram.

Encryption

Decryption

Cancel customer-managed key

You can cancel unused customer-managed keys.

To cancel a customer-managed key, follow the steps below.

1. All Services > Security > Key Management Service Click the menu. Navigate to the Service Home page of Key Management Service.
2. Click the Customer Managed Key menu on the Service Home page. Navigate to the Customer Managed Key List page.
3. Customer Managed Key List Click the resource to view detailed information on the page. Customer Managed Key Details Navigate to the page.
4. Customer Managed Key Details page, click the Service Cancellation button. Service Cancellation alert window will appear.
5. Service Termination in the alert window, select Immediate termination/Scheduled termination and confirm the details, then click the Confirm button.
6. When termination is complete, check on the Customer Managed Key List page whether the resource has been terminated.
   • When key deletion is completed, notifications are sent to both the user who created the key and the user who deleted it.