How-to guides

Users can create the service by entering the required information for the Key Management Service through the Samsung Cloud Platform Console and selecting detailed options.

Create a customer-managed key

You can create and use a customer-managed key in the Samsung Cloud Platform Console.

To create a customer-managed key, follow these steps.

1. All Services > Security > Key Management ServiceClick the menu. 1. Go to the Service Home page of Key Management Service.

2. On the Service Home page, click the Create Customer Managed Key button. 2. Navigate to the Customer Managed Key Creation page.

3. On the Customer Managed Key Creation page, enter the information required to create a service and provide additional details.

   • Enter or select the required information in the Service Information Input area.

     Category	Required	Detailed description
     key name	Required	Enter key name
     Public authentication algorithm	Selection	When Use is selected, you can generate encryption keys that meet public encryption standards The public authentication algorithm option is available only in the KR SOUTH region The public authentication algorithm provides the ARIA algorithm, which has passed security verification through Korea’s cryptographic module certification system
     Purpose	Required	Select the key purpose and encryption method If you do not select the public authentication algorithm, choose among encryption/decryption (AES-256), encryption/decryption and signing/verification (RSA-2048), signing/verification (ECDSA), and generation/verification (HMAC)
     Auto rotation	Selection	Select whether to enable automatic key rotation If you select Use, the internal algorithm of the generated key is converted to a different value and applied at each configured rotation interval The rotation interval can be set to a value between 1 and 730 days. If no rotation interval is entered, it defaults to 90 days automatically
     Explanation	Selection	Enter additional information for the key

     Table. Customer-managed key service information input items
   • In the Additional Information Input area, enter or select the required information.

     Category	required status	Detailed description
     tag	Selection	Add Tag Up to 50 per resource can be added Add Tag After clicking the Add Tag button, enter or select Key, Value values

     Table. Customer-managed key additional information input fields

4. Summary Check the detailed information and estimated charges generated in the panel, and click the Create button.

   • When creation is complete, check the created resources on the Customer Managed Key List page.

Check detailed information of customer-managed key

You can view and edit the complete list of resources and detailed information for customer-managed keys. Customer Managed Key Details page is composed of Details, Tags, Activity Log tabs.

To view detailed information about the Key Management Service, follow these steps.

1. Click the All Services > Security > Key Management Service menu. 1. Go to the Service Home page of Key Management Service.
2. On the Service Home page, click the Customer Managed Key menu. 2. Navigate to the Customer Managed Key List page.
3. On the Customer Managed Key List page, click the resource to view detailed information. 3. Navigate to the Customer Managed Key Details page.
   • Customer Managed Key Details page displays status information and descriptions of additional features at the top.

     Category	Detailed description
     status	Indicates the status of a customer-managed key Active: available/activated Stop: stopped/disabled To be terminated: scheduled for deletion Creating: creating/creation error (immediate retry possible)
     key rotation	Button to manually rotate the generated key
     Key Deactivation	Button to deactivate the generated key
     Service cancellation	Terminate service button When the status is To be terminated, display Cancel termination button

     Table. Customer-managed key status information and additional features

Detailed Information

On the Customer Managed Key List page, you can view detailed information of the selected resource and, if necessary, edit the information.

Tag

Customer Managed Key List page allows you to view the tag information of the selected resource, and you can add, modify, or delete it.

Job History

You can view the operation history of the selected resource on the Customer Managed Key List page.

Managing Customer-Managed Keys

You can create a new version of a registered key or change its usage status.

Configure customer-managed key rotation

Key rotation is a function that converts the internal algorithm of a generated key to a different value.

To create a new version of a customer-managed key (key rotation), follow these steps.

1. Click the All Services > Security > Key Management Service menu. 1. Go to the Service Home page of Key Management Service.
2. On the Service Home page, click the Customer Managed Key menu. 2. Navigate to the Customer Managed Key List page.
3. Customer Managed Key List page, click the resource to view detailed information. 3. Navigate to the Customer Managed Key Details page.
4. On the Customer Managed Key Details page, click the Key Rotation button. 4. Key Rotation Go to the notification window.
5. In the Key Rotation notification window, click the Confirm button.

Configure Customer-Managed Key Activation

You can configure the usage of the selected key.

To set the activation/deactivation status of a customer-managed key you created, follow these steps.

1. Click the All Services > Security > Key Management Service menu. 1. Go to the Service Home page of Key Management Service.
2. On the Service Home page, click the Customer Managed Key menu. 2. Navigate to the Customer Managed Key List page.
3. On the Customer Managed Key List page, click the resource to view its details. 3. Navigate to the Customer Managed Key Details page.
4. On the Customer Managed Key Details page, click the Key Activation/Key Deactivation button. 4. Key activation/Key deactivation Navigate to the notification dialog.
5. In the Key activation/key deactivation notification window, click the OK button.

Encryption case using Key Management Service

The following is an example procedure for encrypting and storing important data of a user application by obtaining a data key from KMS.

1. When the application starts, it obtains a data key using the KMS master key information, then performs and stores secure data encryption on the client side with the plaintext data key.
2. The data key is stored in the database in an encrypted form using the master key.
3. When performing secure data decryption, the data key stored in the database is retrieved and a decryption request is made using the KMS master key information.

The encryption/decryption process using the Key Management Service key is explained with the following diagram.

Encryption

Decryption

Terminate customer-managed key

You can revoke customer-managed keys that are not in use.

To cancel a customer-managed key, follow these steps.

1. Click the All Services > Security > Key Management Service menu. 1. Go to the Service Home page of Key Management Service.
2. On the Service Home page, click the Customer Managed Key menu. 2. Navigate to the Customer Managed Key List page.
3. On the Customer Managed Key List page, click the resource to view its details. 3. Navigate to the Customer Managed Key Details page.
4. On the Customer Managed Key Details page, click the Terminate Service button. 4. Navigate to the Service Cancellation alert window.
5. In the Service termination alert window, select Immediate termination/Scheduled termination, verify the details, and click the Confirm button.
6. When termination is complete, verify on the Customer Managed Key List page whether the resource has been terminated.
   • When the key deletion is complete, a notification is sent to both the user who created the key and the user who deleted it.