Bring your own encryption

Bring your own encryption (BYOE), also known as bring your own key (BYOK), is a cloud computing security model that allows cloud service customers to use their own encryption software and manage their own encryption keys.

Overview

BYOE enables cloud service customers to utilize a virtual instance of their encryption software alongside their cloud-hosted business applications to encrypt their data. In this model, hosted business applications are configured to process all data through the encryption software. This software then writes the ciphertext version of the data to the cloud service provider's physical data store and decrypts ciphertext data upon retrieval requests. This approach provides enterprises with control over their keys and the ability to generate their own master key using internal hardware security modules (HSM), which are then transmitted to the cloud provider's HSM. When the data is no longer needed, such as when users discontinue the cloud service, the keys can be deleted, rendering the encrypted data permanently inaccessible. This practice is known as crypto-shredding.

Implementation

Most SaaS implementations of BYOE use envelope encryption. Each piece of data, such as a record, file or message, is encrypted with its own data encryption key (DEK). The DEK is then encrypted ("wrapped") with a master key, or key encryption key (KEK), that is held in a key management service (KMS) the customer controls. The provider stores only the wrapped DEK next to the ciphertext. To decrypt data, it asks the customer's KMS to unwrap the DEK, so the master key never leaves the KMS. If the customer disables or revokes the master key, the provider can no longer decrypt the data.

The model has been adopted by enterprise collaboration tools aimed at regulated industries. Box launched Enterprise Key Management in 2015. It relied on dedicated AWS CloudHSM hardware security modules, and early customers included GE and McKinsey & Company. In 2016 Box rebranded the product as Box KeySafe and added a software-based option on AWS KMS for smaller organizations. KeySafe gives customers their own audit log of key usage, which Box cannot access.

In 2019 Slack introduced Enterprise Key Management (EKM), which stores the customer's master key in AWS KMS. Each data key is bound to a set of scopes: organization, workspace, channel and hour for messages, and organization and file for files. With these scopes, a customer can use an AWS key policy to revoke access to a particular channel for a given period, or to a single file, without cutting off the whole workspace. To reduce the number of KMS requests, Slack caches data keys in memory for five minutes. Key requests are logged in AWS CloudTrail, and Slack keeps additional logs that record cache hits and the reason for each request.

Salesforce Shield Platform Encryption lets customers upload their own key material. Its Cache-Only Key Service instead fetches the key on demand over a secure channel from a key service the customer controls. The key is used only for immediate encryption and decryption and is not kept in any Salesforce system of record or backup, so the customer can revoke it at any time.

Cloud providers offer similar options for their own services. With Google Cloud External Key Manager, keys live in a third-party key manager such as Fortanix, Futurex or Thales, and the external key material is never cached or stored within Google Cloud. Combined with Key Access Justifications, each key request carries a reason code, and the customer's key manager can approve or deny the request based on it. Microsoft Double Key Encryption in Microsoft 365 protects a document with two keys: one stored in Azure and one held by the customer on premises or in a cloud of their choice. Opening the content requires both. Microsoft positions it for an organization's most sensitive data. Because Microsoft's services cannot read DKE-protected content, features such as co-authoring, search indexing, eDiscovery and Copilot do not work with it.

BYOE is sometimes described as a hybrid between on-premises deployment and conventional SaaS: the provider hosts the application, while the key infrastructure can stay on the customer's premises.

Potential Advantages

Organizations can store data with unique encryption that only they can access. Multiple organizations can share the same hardware infrastructure via cloud services like Amazon Web Services (AWS) or Google Cloud while maintaining encryption to comply with regulations such as HIPAA.

Potential Challenges

Resource utilization may be higher compared to traditional encryption practices when multiple users share the same hardware and use their own encryption. Efforts to minimize resource utilization issues may potentially impact security benefits.

See also

• Cloud computing security
• Encryption
• Zero trust security model