This document primarily lists the basic concepts of the Key Management Service (KMS).
Key Lifecycle
The key lifecycle refers to a series of stages, including key generation, storage, distribution, import, export, usage, recovery, archiving, and termination. KMS provides full lifecycle management for keys, ensuring that these operations are performed securely to prevent key leakage.
Symmetric Encryption and Decryption
Symmetric encryption refers to an encryption method that uses a single-key cryptosystem. The same key can be used for both encrypting and decrypting information.
Asymmetric Encryption and Decryption
Asymmetric encryption and decryption require two keys: a public key and a private key. The public key and private key form a key pair. The sender encrypts data using the public key, and only the recipient can decrypt it with the corresponding private key. On the other hand, the sender can sign confidential information using the private key, and the recipient verifies the signature on the received data using the corresponding public key.
Sensitive Data
Sensitive data refers to sensitive and private information related to users, such as keys, certificates, configuration files, bank account numbers, and ID card numbers.
Hardware Security Module
A Hardware Security Module (HSM) is a computer hardware device designed to protect and manage keys used by strong authentication systems, while also providing related cryptographic operations. At its core, KMS uses HSMs certified by the State Cryptography Administration or FIPS-140-2 to secure keys, ensuring their confidentiality, integrity, and availability.
BYOK
Bring Your Own Key (BYOK) refers to a capability that allows users to import their own key material into a customer master key. For details, see External Key Import.