Add key from an External Key Manager
Overview
Bring Your Own Key (BYOK) is a feature that allows you to use your own key encryption key(KEK) instead of Zoho's KEK. You can add a key either from an External Key Manager (EKM) of your choice or upload an encrypted key manually.
If you choose to provide access to your own KEK from an External key manager, it will be used to encrypt or decrypt the DEKs we provide. This ensures that the data security rests in your control, thus enhancing the security of your organization.
The process is as follows:
After you configure your key in Zoho One, we will send a request to your EKM to have our DEKs encrypted.
The encrypted DEK returned from the EKM will be stored in our in-house KMS.
To decrypt the encrypted DEK, we will send a decrypt request to your EKM using the stored ciphered text and receive plain DEK.
The plain DEK will be cached only for the duration allowed by you, after which we will send encrypt/decrypt requests to EKM again, repeating the entire process.
Sign in to Zoho One
, then click Directory icon on the top-right corner.
Click Security.
- Click BYOK, then click Setup.Note: Click Add key on the right if you already have a key added.
In the Add key screen, enter the Key name, select applications, enable availability key if you want it to be used for data recovery in case of unavailability of the configured key, and choose your key type as External key manager.
Only one key can
be applied to an app.
Under Key details, provide the necessary details about your key provider.
If you select your Key provider as AWS,
enter the Client ID, Client secret, key ID, and Domain.If you select your Key provider as Google KMS,
enter the Key ring, Key name, Key version, and Location, upload the Service account key in JSON format, and toggle on Raw encrypt.If you select your Key provider as Thales CTM,
enter the User name, Password, Key ID, and Domain.If you select your Key provider as Fortanix DSM,
enter the API key, Key ID, and Domain.
If you select your Key provider as HSM, enter the Key name, CKU user password, and HSM label.
If you select your Key provider as Futurex, enter the API key, Key ID, and Domain.
Select the required cache duration from the drop-down list.
Click Check Key to validate the entered key credentials.
Click Add.
Sign in to Zoho One
, then click Directory in the left menu.
Click Security.
Click BYOK, then click Setup.
Note: Click Add key on the right if you already have a key added.
In the Add key screen, enter the Key name, select applications, enable availability key if you want it to be used for data recovery in case of unavailability of the configured key, and choose your key type as External key manager.
Under Key details, provide the necessary details about your key provider.
If you select your Key provider as AWS,
enter the Client ID, Client secret, key ID, and Domain.If you select your Key provider as Google KMS,
enter the Key ring, Key name, Key version, and Location, upload the Service account key in JSON format, and toggle on Raw encrypt.If you select your Key provider as Thales CTM,
enter the User name, Password, Key ID, and Domain.If you select your Key provider as Fortanix DSM,
enter the API key, Key ID, and Domain.
If you select your Key provider as HSM, enter the Key name, CKU user password, and HSM label.
If you select your Key provider as Futurex, enter the API key, Key ID, and Domain.
Select the required cache duration from the drop-down list.
Click Check Key to validate the entered key credentials.
Click Add.
Access your files securely from anywhere
Zoho CRM Training Programs
Learn how to use the best tools for sales force automation and better customer engagement from Zoho's implementation specialists.
Zoho DataPrep Personalized Demo
If you'd like a personalized walk-through of our data preparation tool, please request a demo and we'll be happy to show you how to get the best out of Zoho DataPrep.
- Zoho Workerly Home
- Forums
- Connect With Us:
- Zoho Recruit Home
- Forums
- Connect With Us:
Create. Review. Publish.
You are currently viewing the help pages of Qntrl’s earlier version. Click here to view our latest version—Qntrl 3.0's help articles.
Zoho Sheet Resources
Zoho Forms Resources
Zoho Sign Resources
Sign, Paperless!
Zoho TeamInbox Resources
Design. Discuss. Deliver.
Related Articles
Upload Key
Overview Bring Your Own Key (BYOK) is a feature that allows you to use your own key encryption key(KEK) instead of Zoho's KEK. You can add a key either from an External Key Manager (EKM) of your choice or upload an encrypted key manually. If you ...Overview
Encryption is used to secure data by replacing plain text with ciphered text, so that only the intended recipient can understand its contents. Any form of data is initially encrypted at rest using Data Encryption Keys (DEK). The DEKs are further ...Edit, Change and Delete key
The steps to edit, change, and delete key vary between the two User Interface versions supported in Zoho One. Select the UI version you use from the tabs below and proceed with the steps that follow. Spaces UI Unified UI Spaces UI Change Key: Sign in ...Add department
In the mobile application: For iOS devices: Open the Zoho One app on your mobile device. Tap at the bottom, then tap CREATE GROUP. Tap Department, then enter the Department name, Group email, and Department description. Tap Next, assign the ...Device Management
Managing your employees' devices is just as crucial as monitoring their online identities when it comes to making sure they are handling company data responsibly. This is where device management comes in. Zoho One has device management features that ...