The combination of cloud computing and big data has led to the emergence of a data-driven era. As cloud computing and big data technologies are deeply applied, security issues are always the Sword of Damocles hanging over the application of digital technologies. From countries and societies to enterprises and individuals, everyone faces the issue of how to ensure their data security.

Data security safeguard measures should be implemented. First, important workload data should be classified and stored with different levels of encryption. For example, user passwords are encrypted through the SM3 hash algorithm, and important workload information (such as personal information and transaction records) is encrypted through public key cryptographic algorithms such as SM2 and SM4. Second, data should be regularly backed up, and its validity should be verified. For environments with high requirements for workload continuity and data real-timeness, real-time backup is essential.

 Big data generated based on the Internet is an important national resource, and data security has become the lifeblood of a strong cyberpower. For this reason, comprehensive requirement surveys have been conducted based on cryptography. Key Management Service (KMS) uses Hardware Security Modules (HSMs) certified by the Cryptography Administration at its underlying layer to create and protect keys. In addition, it provides managed key lifecycle management to meet the key management needs of multiple applications and workloads.

KMS is a security management service that uses HSMs certified by a third party to generate and protect keys. It helps users easily create and manage keys, meets users' key management needs of multiple applications and workloads, and meets regulatory and compliance requirements.

For users, the core key components involved in KMS include the customer master key (CMK) and data encryption key (DEK). A CMK is a first-level key used to encrypt and decrypt sensitive data and generate DEKs. A DEK is a second-level key used in the envelope encryption process. It is protected by a CMK and used to encrypt business data.

CMK is the core resource in KMS, protected by third-party certified HSMs, and serves as the first-level key for encryption and decryption. KMS is mainly a management service for CMKs.

A CMK is a logical representation of a master key, and it contains metadata such as key ID, creation date, description, and key status. Generally, you can use the automatic CMK generation feature in KMS or import your own key to generate a CMK.

CMK consists of user keys and cloud service keys. User keys are CMKs that users create via the console or API. You can perform actions such as creation, enabling, disabling, rotation, and permission control on user keys. Cloud service keys are CMKs automatically created for users by TCE products/services (such as CBS, COS, and TDSQL) when calling KMS. You can query these keys and initiate key rotation but cannot disable or schedule deletion.

DEK is a second-level key generated based on a CMK used to encrypt and decrypt local data. KMS allows you to use your CMKs to generate DEKs, but KMS does not store, manage, or track them or use them to perform encryption operations. You have to use and manage your DEKs outside of KMS.

Generally, DEKs are used in enveloping encryption to encrypt local business data. They are protected by CMKs and are customizable. DEKs can be created through the GenerateDataKey API.

KMS uses HSMs certified by FIPS-140-2 to generate and protect keys.

Multi-region disaster recovery with hot and cold backups.

KMS provides sensitive data encryption and automatic data migration and backup and recovery mechanisms for envelope encryption service data.

Deployment of Centralized Key Management Policies

KMS provides multi-region and high-availability access services through unified APIs.

KMS supports SDKs in various programming languages such as Java, Python, PHP, Go, Node.js, and .NET.

KMS is seamlessly integrated with the encryption feature of Cloud products.

After key rotation is enabled, CMKs will be rotated once a year. Key rotation is managed by KMS and is transparent to the upper layer. After a CMK is rotated, the old ciphertext encrypted with this CMK can still be decrypted. You need to use a new CMK to implement new encryption.

Distributed, cluster-based workload deployment and hot backup across IDCs.

Cluster-based deployment of underlying HSM devices and dual-IDC hot and cold backups.

Unified APIs are deployed in different regions with both unified and region-specific access domain names provided to ensure high accessibility.

tencent cloud