Encrypting sensitive information is a core capability of Key Management Service (KMS), suitable for protecting small sensitive data (less than 4KB), such as keys, certificates, and configuration files. Use a Customer Master Key (CMK) to encrypt sensitive data instead of storing plaintext directly. When needed, decrypt the ciphertext into memory to ensure the plaintext is never written to disk. The entire interaction and transmission process uses HTTPS requests to guarantee the security of sensitive data.
If you need high-performance encryption and decryption services for massive data through KMS, see the Envelope Encryption scenario.
Examples of sensitive information
-
Key/Certificate
Backend Configuration File
Purpose
Encrypting business data, communication channels, and digital signatures.
Save system architecture and other business information, such as database IP addresses and passwords.
Risk of data loss
Risk of confidential information theft, encrypted channels being intercepted, and signatures being forged.
Business data being dragged, serving as a jump point to attack other systems.
Diagram
In this scenario, sensitive data is encrypted and decrypted using the Customer Master Key (CMK), which is protected by a third-party certified Hardware Security Module (HSM). The CMK performs encryption and decryption operations within the HSM, ensuring that no unauthorized personnel, including Tencent Cloud staff, can access the CMK plaintext.
Feature Characteristics
Access Control: Integrates with Tencent Cloud CAM to control account access permissions to CMKs through identity management and policy management.
Built-in Auditing: Integrates with Tencent Cloud Audit to record all API requests, including key management operations and key usage. This ensures that data operations are traceable and auditable.
Centralized Key Management: Achieve centralized management of keys for various applications through the Tencent Cloud KMS service.
Security and Compliance: The Key Management Service uses Hardware Security Modules (HSMs) certified by the State Cryptography Administration or FIPS-140-2 at its underlying layer to protect key security, ensuring key confidentiality, integrity, and availability.
Sensitive Data Encryption: Supports encryption and decryption operations for sensitive data (less than 4KB), such as keys, certificates, and configuration files.
Must-Knows
You must ensure the secure storage of SecretId and SecretKey:
Authentication for Tencent Cloud APIs primarily relies on SecretID and SecretKey, which serve as the user's unique credentials. Business systems require these credentials to call Tencent Cloud APIs.
You must manage the access control for SecretID and SecretKey:
We recommend using a sub-account and authorizing APIs based on business needs to manage risks.
You must pay attention to the storage of plaintext data:
Data has been encrypted via sensitive data encryption. To ensure data security, you must delete the original plaintext data.
