Skip to main content
Typical cloud platforms have a cryptographic environment that directly generates and manages secret keys, but we enable you to manage your own keys for greater control and security, providing the following benefits:
  • Cryptographic key portability
  • Key life cycle management
  • Disaster recovery
  • Advanced auditing and reporting
You can use either Futurex Bring Your Own Key (BYOK) or Key Agent Services to provide and manage your own encryption keys that the cloud service providers use.

​
Bring Your Own Key (BYOK)

BYOK enables you to encrypt data inside cloud services with your own keys, especially with public clouds such as AWS, Google Cloud Platform, and Azure. This ensures that your compliance and reporting requirements are fully addressed and that keys are generated within a FIPS 140-2 Level 3 hardware security module (HSM). Additionally, it ensures cryptographic keys are generated by using a sufficient source of entropy and are protected from disclosure. In typical cloud environments, keys are cryptographically wrapped before transmission to the cloud providers.

​
How BYOK works

BYOK functions through the CLI or API developed by each cloud provider. These interfaces enable programmatic management of your organization’s portion of the cloud platform, which fully automates the cloud infrastructure. An HSM can leverage these APIs to securely generate and distribute the customer-defined keys over a secure channel between their key management platform and the HSM. This enables a one-click transfer of the customer-defined keys with no configuration or manual work. By using the cloud provider REST API, the HSM generates a new empty key object, requests an RSA public import key, generates new symmetric or asymmetric working keys, and wraps them with the import key. After receiving the key, the cloud provider decrypts it with the corresponding private key for secure storage. VirtuCrypt Cloud Payment HSMs support BYOK through management with the Excrypt Touch, a secure remote management tablet. With the Excrypt Touch, you can configure and manage all cloud payment HSMs within your environment from anywhere in the world. Combined, this line of Futurex products and services enables a complete HSM set-up to manage an entire cryptographic environment with redundancy, ease of use, and scalability for future growth. To learn more about BYOK, see our Bring Your Own Key (BYOK): Cloud Key Management whitepaper (info.futurex.com/integrating-public-clouds-financial-hsms-0). Also refer to the Remote Management of Payment Cloud HSMs using the Excrypt Touch administrative guide.

​
Futurex Key Agent Services

The Futurex Key Agent Services provides compliant, secure key management assistance. With this service, our key agent team compliantly loads keys into FIPS 140-2, Level 3 HSMs, and completes the generation, handling, and storing of key components. However, you retain ownership of the keys for the entire key lifespan. When you need access to the keys, we securely generate and print key components in tamper-evident envelopes before mailing them to you. This convenient option ensures that you have access to keys at any point in time, without the responsibility, effort, and liability of generating and loading them into the HSM.

Related topics

Configure database encryption in MongoDBMongoDBConfigure encryption in MongoDBKey managementAWS Cloud Key Management integration and key operations