Overview
Service Overview
Key Management Service(KMS) is a service that easily creates encryption keys and securely stores/manages them to safely protect an application’s critical data. Users encrypt and decrypt data using an encryption key, which is securely managed through a centrally controlled hierarchical encryption key system.
Provided features
Key Management Service provides the following features.
- Key Management: KMS can create/delete and manage customer-managed keys. * The user directly creates a data key that encrypts data using the master key generated by KMS.
- Key Permission Management: You can control and manage usage permissions for master keys based on custom policy.
- Key Lifecycle Management: Through key rotation, you can generate new encrypted data for the master key without creating a new key, and the key rotation interval can be set according to customer policy. * Through lifecycle management, encryption keys that are no longer used are deactivated or deleted, safely protecting data from cryptographic threats.
- Platform-managed key: When another product within the Samsung Cloud Platform encrypts using a KMS key, the CSP (Cloud Service Provider) generates a platform-managed key and performs encryption, so the user does not need to create a key directly in KMS.
Components
master key
Master key is used to generate data keys for encrypting data, and depending on the purpose, can generate symmetric key (encryption/decryption (AES), generation/verification (HMAC)) and asymmetric key (encryption/decryption and signing/verification (RSA), signing/verification (ECDSA)). By properly managing the master key to encrypt data keys, you can protect frequently used data keys during operation.
- The master key is a key generated through the creation of a KMS product service in the Samsung Cloud Platform Console.
Data key
The data key is used to encrypt the actual data and is generated for each target service that performs encryption. Through this, even if a single data key is leaked, it does not affect services encrypted with other data keys.
HSM (hardware security module)
Stores the root key of the KMS system domain. The master key is generated using the root key stored in an HSM (Hardware Security Module) that complies with the FIPS 140-2 Lv3 standard, and is securely distributed and stored in the KMS for protection.
Constraints
The Key Management Service of Samsung Cloud Platform limits the number of key creation and rotation as follows.
| Item | Detailed description | Quota |
|---|---|---|
| KMS Key | Number of KMS Keys created per region | 10000 |
| KMS Validation Password Key | Number of public authentication algorithm keys that can be generated per account | 100 |
When rotating a customer-managed key, the key’s version is changed internally. By using a newly generated version key, you can decrypt information encrypted with the previous version’s key to maintain compatibility.
- Versions changed by key rotation are compatible up to version 100, regardless of the encryption algorithm.
- KMS keys created as a regional service can be used only within that region.
- The restrictions on the public authentication algorithm key apply only to the KR SOUTH region.
Preceding service
Key Management Service has no prerequisite services.