01 | What is a key management system? Why do enterprises need a key management system?
At present, more and more companies are beginning to adopt the KMS key management system, which is not only a requirement for their own companies, but also extends to their supply chain, requiring relevant suppliers to adopt the KMS key management system to improve data security ability to ensure business compliance and legal conduct.
KMS is the abbreviation of Key Management System, the key management system, also known as key management system (CKMS) or enterprise key management system (EKMS), is a comprehensive method for generating, distributing and managing encryption keys devices and applications. They may cover all aspects of security - from secure generation of keys, to secure exchange of keys, to secure key handling and storage on the client. Thus, KMS includes back-end functionality for key generation, distribution, and replacement as well as client-side functionality for injecting, storing, and managing keys on devices.
According to the current commercial password protection scheme commonly used in the industry, enterprises need to align core data and adopt encryption methods for security protection. Because the encryption algorithm is public, the core essence of data encryption is to ensure the security of the key. And a unified key management system is precisely for different businesses and different applications, such as database encryption key, file encryption key, application encryption key, data desensitization key, certificate key pair, firmware signing key, etc. The keys required by various application scenarios are managed in a centralized manner to ensure the security and regular rotation of the keys throughout their life cycle . Therefore, the key management system is prioritized as the infrastructure for enterprise data security, and at the same time avoids the use of an encryption system whose keys cannot be entrusted to KMS. Imagine an encryption system with a fixed encryption key that has not changed for thousands of years, and the security risk is relatively large . of .
02 | What are the common key management systems?
At present, more and more enterprises choose cloud services, so they also habitually choose key services on the cloud. In fact, it is relatively safe to choose encryption services on the cloud, and key management is in their own hands. BYOK It is also a security practice supported by all mainstream clouds, that is, the user master key on the cloud is imported by itself, which will better meet regulatory and compliance requirements.
❥ For the user-built KMS system, it is more flexible to use a third-party certified hardware security module HSM (Hardware Security Module) to generate and protect keys, further improving system security.
03 | Adang KSP key management system function introduction, what features does it have compared with conventional products in the market?
With key management as the core, Andang KSP key management system provides professional, platform-based, and service-oriented cryptographic services for industry applications based on national secret codes, and realizes unified management and scheduling of cryptographic resources, unified management and control of cryptographic services, and key encryption services . Centralized management can quickly realize the secure integration and application of cryptographic technology, improve customer business security, and create higher business value. At the same time, the platform has the characteristics of strong comprehensiveness, high cost performance, easy deployment, and high energy efficiency. It supports international and national encryption algorithms, and provides a complete key centralized management mechanism and key policy management tools. Encryption and decryption of application data, the system Services such as certificate management and application data signature/verification provide efficient and flexible cryptographic operation support.
❥ KSP allows you to easily create and manage keys, protect the confidentiality, integrity and availability of keys, meet the key management needs of users for multiple applications and multiple services, and meet regulatory and compliance requirements.
04 | KSP's functional characteristics in response to the requirements of suppliers of multinational companies
Self-management and ownership of encryption keys can manage the entire life cycle of keys
KSP implements separate deployment and storage from encrypted data to improve security
More than ten different user roles are divided to realize the fine-grained security control of keys and the least privileged key access rights
Supports automatic or manual key rotation, replacing potential risk keys at any time
Secure key backup mechanism balances key security and system reliability
The account authority of the KSP system is independent of the account authority of the operating system
It can connect and manage the encryption key of the user application system to realize the centralized management of the key
Support national secret SM2, SM3, SM4 and international AES256, RSA, ECC and other algorithms, support other algorithm development integration import
Complete key logging function
05 | Typical application scenarios of Andang KSP key management system
06 | Scenario-based solutions
● Pain point: Any communication and storage data of financial and government agencies has high value and high confidentiality, and encryption security and compliance need to be considered
● Solution: Provide encryption services, key protection and authority management for protocol communication content, important files and materials through envelope encryption, meeting security and compliance requirements
● Pain points: core intellectual property rights, user’s mobile phone number, ID number, bank account number, password and other private data are strictly protected, and sensitive data is encrypted and stored, but the security of the data key cannot be guaranteed
● Solution: use envelope encryption to encrypt all core data with a data key, and then encrypt the data key with KSP to provide double protection for core data
● Pain point: Application development configuration files need to be encrypted to protect program data security
● Solution: Use KSP to encrypt and protect the integrity of sensitive data configuration information, database connection information, database passwords, login keys, and background service configuration information
● Pain point: When providing services such as HTTPS, certificates and keys are required. If these information are stored locally in plain text, attackers can easily obtain them.
● Solution: Use KSP to encrypt and decrypt the key. After encryption, the ciphertext file of the key is stored locally. When used, it is decrypted and not stored locally, making it difficult for attackers to obtain, thereby ensuring the security of web pages and applications