Key Management Service (KMS) is a cloud-based encryption service. Together with Cloud Hardware Security Module (HSM), it helps you manage keys, protect secrets, and meet data security requirements.
Overview
Key Management Service (KMS) provides secure, compliant key and secret management as a SaaS solution. It supports server-side encryption for cloud products and offers cryptographic services that comply with Chinese national standards. KMS also stores sensitive data as secrets, eliminating hard-coded credentials and reducing data leakage risk. By using KMS, you avoid the overhead of building and maintaining your own cryptographic infrastructure.
Cloud Hardware Security Module (HSM) is an IaaS solution that provides cloud-based encryption and decryption through hardware security modules. It meets Chinese mainland compliance requirements and international standards such as FIPS 140-3.
Scenarios
Key Management Service (KMS)
Encrypt and protect sensitive data
Alibaba Cloud provides multiple encryption methods to protect sensitive data generated or stored in the cloud.
Meet security compliance requirements for information systems
Enterprises or organizations assessing information system compliance typically face two situations:
Regulations mandate cryptography for information systems. The cryptographic techniques and key management systems must meet specific technical standards and security regulations.
Regulations do not mandate cryptography, but using it accelerates compliance — for example, by earning more points in score-based evaluations.
Integrate KMS secrets with ISV services
Users manage secrets in KMS and authorize ISV services to access them. KMS acts as a security intermediary, enabling both parties to maintain their roles while ensuring system security.
Cloud Hardware Security Module (HSM)
Migrate on-premises HSM workloads to cloud
When migrating data center HSM workloads to Elastic Compute Service (ECS), replace on-premises hardware with Cloud HSM for encryption, decryption, signing, and signature verification to protect your cloud data.
Provide compliant encryption and decryption for encryption applications
For example, you can use Cloud HSM with Alibaba Cloud Dedicated KMS to encrypt and decrypt sensitive application data, with database encryption applications to encrypt and decrypt database data, and with file encryption applications to encrypt and decrypt file storage.
SSL offloading for HTTPS websites
GVSMs in the Chinese mainland support SSL offloading, reducing server CPU load and improving client response times. Cloud HSM also generates certificate private keys, strengthening private key protection and preventing private key leakage from servers.
Protect certificate private keys
For digital certificates issued by certification authorities (CAs), you can store certificate private keys in HSMs and use HSMs for signing operations to protect your certificate private keys.
Oracle TDE integration
Cloud HSM integrates with Oracle databases to provide Transparent Data Encryption (TDE). TDE stores encryption keys in HSMs outside the database and uses the keys to encrypt sensitive data in database files, ensuring the security of sensitive data.
Encrypt sensitive data
In public services, e-commerce, and financial industries, you can integrate Cloud HSM with your applications to encrypt or store sensitive user data to meet security and compliance requirements.
Features
Key Management Service (KMS)
Manage and use keys
Key lifecycle management: Manages keys through their full lifecycle — creation, storage, distribution, use, and destruction.
Key rotation: Supports automatic and manual key rotation.
Bring Your Own Key (BYOK): Import your own key material for greater control over data security.
Cryptographic operations: Supports symmetric and asymmetric keys for encryption, decryption, signing, and verification.
Manage and use secrets
Secret lifecycle management: Manages secrets through their full lifecycle — creation, storage, distribution, use, and destruction.
Use secrets: Retrieve secrets from KMS instead of hard-coding sensitive data in applications.
Multi-account resource sharing: KMS instance owners (resource owners) can share instances with other Alibaba Cloud accounts (principals). Principals can create keys and secrets, use keys for server-side encryption or data encryption in self-managed applications, and store secrets to eliminate hard-coded credentials.
Backup management: Back up KMS data after purchasing a backup quota. Cross-region backup to other KMS instances is also supported.
Access control: Provides access control and audit features for keys to ensure that only authorized users and systems can access them.
Logging: Records key and secret access logs for auditing and monitoring.
Cloud Hardware Security Module (HSM)
Shared virtual HSMs and dedicated HSMs: All HSMs meet China's Cryptography Law and international standards such as FIPS 140-3. Small and medium-sized enterprises or low-performance scenarios can choose shared virtual HSMs. Large enterprises, financial institutions, or high-security, high-performance scenarios can choose dedicated HSMs.
Key management: Device and key management permissions are separated. Alibaba Cloud manages HSM availability and activation; customers manage all keys. Alibaba Cloud cannot access customer keys.
Encryption and decryption: Use HSM vendor APIs for encryption, decryption, signing, and validation.
Data backup and restoration: Restore HSM instance data to recover from accidental operations or replicate data to another instance.
Security audit: HSM operational logs are automatically saved to Object Storage Service (OSS) in an audit format for compliance.