Bring Your Own Key (BYOK) is an approach where the on prem keys are placed in a cloud service provider environment, enabling to use on prem keys with the native cloud key management services to encrypt and decrypt content. BYOK requires HSMs (either dedicated or offered as KMS service) but supports all cloud service models (SaaS, PaaS, and IaaS) so long as the cloud vendor offers key management service.
BYOK with Cloud KMS
Organizations can bring their own ‘master’ keys to the cloud, but the cloud provider uses data encryption keys derived from the master for actual encryption and decryption outside the HSMs. As the cloud vendor controls all the underlying hardware and software, they can choose if encryption is done in hardware or software services, while maintaining security of the derived encryption keys.
- No specialized skilled resources are required
- Enables existing products that need keys to use cryptography
- Provides centralized point to manage keys across heterogeneous products
- Native integration with other services such as system administration, databases, storage and application development tools offered by the cloud provider
- Key exposure outside HSM
- FIPS 140-2 Level 3 and above devices not available
BYOK with Cloud HSM
All encryption operations on the organization’s behalf are performed inside the HSM. The native cloud encryption service may satisfy requests on the organization’s behalf, so encryption and decryption are transparent, but key access and cryptographic operations are kept within the HSM.
- No Key exposure outside the HSM
- FIPS advanced level (FIPS 140-2 Level 3 and above) complaint hardware-based devices meeting all regulatory requirements
- Can perform all core functions of an on prem HSM -key generation, key storage, key rotation, and API interfaces to orchestrate encryption in the cloud
- Designed for security
- Dedicated hardware and software for security functions.
- Need specialized in-house resources to manage key and crypto lifecycle activities
- HSM based approaches are more cost intensive due to the dedicated hardware appliance that is made available
- Performance overheads