Key Management Service

Alibaba Cloud Key Management Service (KMS) is a secure and easy-to-use service to create, control, and manage encryption keys used to secure your data.

KMS enables you to protect the confidentiality, integrity, and availability of keys while also saving on costs. You can integrate KMS with other Alibaba Cloud services such as ApsaraDB for RDS and Object Storage Service, to encrypt critical information including certificates and keys stored with these services. You can use these keys securely and conveniently, and focus on developing encryption/decryption function scenarios.

• Enables easy encryption/decryption of data keys by allowing storage of Customer Master Key (CMK) in KMS

• Manages availability, security, and maintenance of underlying infrastructure

• Transfers data over Transport Layer Security (TLS) to ensure complete security of your data

• Enables easy encryption/decryption of data keys by allowing storage of Customer Master Key (CMK) in KMS

• Manages availability, security, and maintenance of underlying infrastructure

• Supports five regions worldwide; usage limits are relatively independent for each user in different regions

• Saves cost compared to procuring expensive hardware equipment to secure physical environment

• Pay only for resources needed as per your business requirements

Alibaba Cloud Key Management Service (KMS) is a fully managed service to create, delete and manage encrypted keys to protect your data. For common key management scenarios, you can use APIs or Alibaba Cloud management console to produce and manage Customer Master Keys (CMKs).

For common encryption/decryption scenarios, you can use the API to locally encrypt/decrypt small volumes of data or envelope encryption technology for relatively larger volumes of data.

Also, you can define usage policies for data encryption. You can integrate it with various Alibaba Cloud storage services to ensure the security of the stored data.

KMS enables you to easily encrypt data use SDKs or APIs to perform encryption/decryption of data keys.

• Allows you to create, view, enable, and disable CMKs to encrypt/decrypt data keys

• Enables you to view the whole master key list for all services integrated with KMS

• Enables HTTPS protocol to protect data while using SDKs to access keys

• Supports HMAC-SHA1 signature scheme

• Maintains confidentiality, integrity, and availability of keys used to protect data

• Easily integrates with other Alibaba Cloud products such as ApsaraDB for RDS to protect the data stored using these services

• Encrypts your static files stored in Object Storage Service ensuring security

• Allows you to store, transfer and use encrypted data by encapsulating its data keys (DKs) in an envelope and stores CMKs in KMS

• Allows users to call KMS to decrypt data key only when needed

• Automatically scales to meet encryption needs as per your business requirement

• Stores multiple copies of encrypted versions of your master keys ensuring high durability and availability

• Potential to deploy in multiple availability zones within a region to ensure high availability of encryption keys

Listed below are a few common KMS scenarios:

You can directly call the KMS APIs and use the specified Customer Master Key (CMK) to encrypt and decrypt data. This scenario applies to encryption and decryption of a small amount of data (less than 4KB). Data is transmitted to the KMS server through secure channels, encrypted or decrypted at the server, and returned through secure channels.

Envelope encryption is a mechanism similar to the digital envelope technology. It allows you to store, transfer, and use encrypted data by encapsulating its data keys (DKs) in an envelope, instead of encrypting/decrypting data directly with Customer Master Keys (CMKs). This is appropriate when a large volume of data needs to be encrypted or decrypted.

You can directly call the KMS API, use the specified CMK to generate and decrypt the data key, and use the data key for local data encryption and decryption. You do not need to transmit the massive amount of data through the network, which results in cost savings.

This eliminates all kinds of security risks, including eavesdropping and phishing.

For better management of your keys get access to KMS APIs, SDKs.

The Alibaba Cloud Management Console provides a simple web based user interface, which is used to create, describe, enable and disable your keys.

You can call KMS APIs for encryption and decryption of the data keys. Please read the API introduction.

For a step-by-step guide on how to use the Alibaba Cloud KMS management console or APIs, refer to Quick Start Guide.

You can easily manage CMKs by using Alibaba Cloud Key Management Service SDKs available in four languages (Java, Python, PHP, and C#).

View Java SDK sample codes.

Alibaba Cloud Key Management Service (KMS) is an easy-to-use, secure and efficient way to manage encryption keys used to secure data. The following are links to documentation, SDKs, and other resources that can help you understand how KMS works.

CMK is the master key created by a user in the Alibaba Cloud Key Management Service (KMS) to encrypt data keys and generate envelopes. It can also be directly used to encrypt a small amount of data.

Envelope encryption is an encryption mechanism similar to the digital envelope technology. It allows you to store, transfer and use encrypted data by encapsulating its data keys (DKs) in an envelope, instead of encrypting/decrypting data directly with CMKs.

The following is the list of regions where KMS is available with their corresponding location ID and public/private network addresses:

To ensure data security, KMS only supports HTTPS protocol when you use SDKs to access it.

The error typically occurs when you try to decrypt data in an incorrect region. KMS is completely independent in each of the regions. You need to ensure that you decrypt data in the same region where the data was encrypted.

Based on the envelope encryption technology and open APIs of KMS, you can use specified CMKs to encrypt and decrypt data keys. Then you don’t have to store the plain text directly in a storage device. This way, you can easily concentrate on development work without worrying about managing users’ keys.

Each user can create up to 200 CMKs in each region. In case you need to create more than 200 CMKs, you can submit a request to Alibaba Cloud through its ticket system.

Encryption context is a JSON string in the String-String format that may be used in KMS APIs including Encrypt, GenerateDataKey, and Decrypt to protect data integrity.