Add key from an External Key Manager
Overview
Bring Your Own Key (BYOK) is a feature that allows you to use your own key encryption key(KEK) instead of Zoho's KEK. You can add a key either from an External Key Manager (EKM) of your choice or upload an encrypted key manually.
If you choose to provide access to your own KEK from an External key manager, it will be used to encrypt or decrypt the DEKs we provide. This ensures that the data security rests in your control, thus enhancing the security of your organization.
The process is as follows:
After you configure your key in Zoho Directory, we will send a request to your EKM to have our DEKs encrypted.
The encrypted DEK returned from the EKM will be stored in our in-house KMS.
To decrypt the encrypted DEK, we will send a decrypt request to your EKM using the stored ciphered text and receive plain DEK.
The plain DEK will be cached only for the duration allowed by you, after which we will send encrypt/decrypt requests to EKM again, repeating the entire process.
Add key
Sign in to Zoho Directory
.
Click Admin Panel, then click Security.
- Click BYOK, then click Setup.Note: Click Add key on the right if you already have a key added.
In the Add key screen, enter the Key name, select applications, and choose your key type as External key manager.
Note: The key name cannot be edited if you've chosen all available apps. Only one key can be applied to an app, and apps already assigned will not be listed under Available applications.Under Key details, provide the necessary details about your key provider.
If AWS is selected, choose an Authentication type:
IAM credentials: Enter the Client ID, Client secret, Key ID, and Domain.
IAM Roles Anywhere: Enter the Key ID, Domain, Roles Anywhere domain, Trust anchor ARN, Profile ARN, Role ARN. Then upload the Certificate, and Private Key.
Configure key in AWS
If you select your Key provider as Google KMS,
enter the Key ring, Key ring name, Key version, and Location, upload the Service account key in JSON format, and toggle on Raw encrypt.
Configure key in Google KMSIf you select your Key provider as Thales CTM,
enter the User name, Password, Key ID, and Domain.
Configure key in Thales CTMIf you select your Key provider as Fortanix DSM,
enter the API key, Key ID, and Domain.
Configure key in Fortanix DSMIf you select your Key provider as Futurex CryptoHub, enter the API key, Key ID, and Domain.
Configure key in Futurex CryptoHubIf you select your Key provider as Azure, enter the Client ID, Client secret, OAuth 2.O token endpoint (v2), Key identifier URL.
Configure key in Azure Key Vault
Select the required cache duration from the drop-down list.
Click Add.
Access your files securely from anywhere
Zoho CRM Training Programs
Learn how to use the best tools for sales force automation and better customer engagement from Zoho's implementation specialists.
Zoho DataPrep Personalized Demo
If you'd like a personalized walk-through of our data preparation tool, please request a demo and we'll be happy to show you how to get the best out of Zoho DataPrep.
- Zoho Workerly Home
- Forums
- Connect With Us:
- Zoho Recruit Home
- Forums
- Connect With Us:
All-in-one knowledge management and training platform for your employees and customers.
Create. Review. Publish.
You are currently viewing the help pages of Qntrl’s earlier version. Click here to view our latest version—Qntrl 3.0's help articles.
Zoho Sheet Resources
Zoho Forms Resources
Zoho Sign Resources
Sign, Paperless!
Zoho TeamInbox Resources
Design. Discuss. Deliver.
Related Articles
Configure key in Google KMS
Creating a Google Cloud Project 1. Go to Google Cloud Platform. 2. Click Encryption EAR, then click NEW PROJECT. 3. Give a Project name, set your Location, then click Create. Creating a Service account in Google cloud 1. Click APIs & Services in the ...Configure key in Thales CTM
1. Log in to the CipherTrust Manager Portal. 2. Click Access Management in the left menu, then click Users. 3. Click Add User and fill in the relevant details. Note down the Username and Password to configure later in Zoho. [Optional] Add the ...Configure key in AWS KMS
1. Log in to your AWS Console. 2. Use the search option to find IAM. 3. Click Users in the left menu. Click Create user if you haven't added a user yet. 4. Select the required user and click Create access key. 5. Select Application Running Outside ...Upload Key
Overview Bring Your Own Key (BYOK) is a feature that allows you to use your own key encryption key(KEK) instead of Zoho's KEK. You can add a key either from an External Key Manager (EKM) of your choice or upload an encrypted key manually. If you ...Configure a key in Azure Key Vault
Microsoft Azure Prerequisites 1. Log in to portal.azure.com. 2. Search and click "App registrations" under Azure services. 3. Click + New registration. 4. Enter a name, choose the preferred option in Supported account types and click Register. 5. ...