Server-side encryption

Main application scenarios of OSS server-side encryption

OSS protects static data by using server-side encryption, which applies to scenarios with high security or compatibility requirements for storage, such as the storage of deep learning sample files and online collaboration document data. The following server-side encryption methods are available for different application scenarios:

• Using KMS for encryption and decryption

  When uploading a file, you can use a specified CMK ID or the CMK fully managed by KMS to encrypt and decrypt a large amount of data. You do not need to send user data to the KMS service side through networks for encryption and decryption, and therefore is a low-cost method.

• Using encryption fully managed by OSS

  Encryption fully managed by OSS is a property of objects. When creating an object, you only need to add the HTTP header, x-oss-server-side-encryption, to the Put Object request and specify its value as AES256 to encrypt and store the object on the server. This method is ideal for bulk data 's encryption and decryption.

Server-side encryption options

OSS server-side encryption provides the following options for users to choose from (based on the key management policy):

• Fully managed by OSS: The generation and management of data encryption keys are conducted by OSS, which provides strong and multi-factor security measures to protect data. The data encryption algorithm adopted is the strong encryption algorithm of AES-256 (256-bit advanced encryption standard).

Server-side encryption - Fully managed by OSS

The OSS server-side encryption is a property of objects. When creating an object, the user only needs to add the HTTP header, x-oss-server-side-encryption, to the Put Object request and specify its value as AES256 to encrypt and store the object on the server.

The following operations support the addition of the HTTP header to requests:

• Put Object: simple upload
• Copy Object: copy an object
• Initiate Multipart Upload: multipart upload

Server-side encryption - CMK managed by KMS

When creating an object, the user only needs to add the HTTP header, x-oss-server-side-encryption to the request and specify its value asKMS, to encrypt and store the object on the server (KMS service is used for key management). With the KMS service, OSS can encrypt and protect the objects stored in OSS by using strong security measures such as envelope encryption and AES-256 encryption algorithm.

KMS is a secure and easy-to-use management service provided by Alibaba Cloud. With the help of KMS, users no longer have to spend a great deal to protect the confidentiality, integrity, and availability of keys. Users can use keys securely and conveniently, and focus on developing encryption/decryption function scenarios. Users can view and manage KMS keys in the KMS console.

The following operations support adding the HTTP header to requests

• Put Object: simple upload
• Copy Object: copy an object
• Initiate Multipart Upload: multipart upload

Server-side encryption - RestAPI usage