Help Center/ Data Encryption Workshop/ Service Overview/ KMS/ Applications
Updated on 2026-07-16 GMT+08:00
View PDF
Share

Applications

This section describes the applications of KMS.

Information System Meeting Security Compliance Requirements

  • Keys are generated by authenticated third-party HSMs, meeting Chinese and international legal compliance requirements.
  • The HSMs have been certified by State Cryptography Administration (SCA).
  • Multiple HSMs are running concurrently, and services are deployed in multiple AZs. You can create CMK replicas across regions for DR and backup.

The following table lists the KMS capabilities to help enterprises meet compliance requirements.

Table 1 Compliance capabilities

Function

Description

Reference

Cryptography compliance

KMS uses HSMs to protect keys. All CMKs are protected by root keys in HSMs to avoid key leakage. The HSMs meet the FIPS 140-2 Level 3 security requirements.

Data confidentiality

KMS encrypts personal privacy data to prevent data leakage when being attacked, meeting data protection laws and regulations.

KMS Overview

Identity authentication and access control

KMS interconnects with Resource Access Manager (RAM) to implement unified authentication and authorization management.

Sharing DEW Resources Using RAM

Key usage audit

KMS stores all API call records in Cloud Trace Service (CTS). Operation audit can be used to audit the compliance of key usage.

KMS also allows you to use Config to quickly create a group of DEW compliance rules to evaluate whether your resources meet compliance requirements.

Sensitive Data Encryption and Protection

You can use data encryption to protect sensitive data generated or stored on the cloud. KMS allows you to encrypt sensitive data in multiple ways.

Table 2 Sensitive data encryption and protection

Encryption Method

Requirement

Description

Reference

Application systems using KMS to directly encrypt data

If a small amount of data needs to be encrypted or decrypted, you can use the online tool on the KMS console or call KMS APIs to specify a CMK. Currently, a maximum of 4 KB of data can be encrypted or decrypted in this way.

For example, passwords, certificates, and phone numbers.

Call the KMS encryption API to directly encrypt sensitive data using a key.

Small-Size Sensitive Data Encryption and Decryption

Application systems using KMS to encrypt data in envelope mode

To encrypt or decrypt a large amount of data, you can use envelope encryption to process the data without transmitting it over the network.

For example, photos, videos, and database files.

Envelope encryption is used to store keys in KMS. Only encrypted data keys are deployed. You can use KMS to obtain the DEK plaintext for local service data encryption and decryption when needed.

Alternatively, you can use the encryption SDK that encapsulates envelope encryption for encryption protection.

Cloud product server-side encryption

Protect the security of IT infrastructure data on the cloud.

For example, you can use Object Storage Service (OBS) server-side encryption to protect OBS buckets that store sensitive data. You can also use Transparent Data Encryption (TDE) to protect tables that store sensitive data.

When Huawei Cloud products are used to store data, you can use their server-side encryption to effectively protect data.

Using KMS to Encrypt and Decrypt Data for Cloud Services

Example Scenario

User-Integrated KMS to Applications

Figure 1 Principles of user-integrated KMS to applications

Encrypting and Decrypting a Cloud Service Integrated with KMS

Figure 2 Principles of a cloud service integrated with KMS

Helpful Links

Document

Link

Best Practices

API Example
Parent topic: KMS