[Audio] O-C-I Vault – Key Management Service Protect your data using customer managed keys Hi Gsc. 

Scene 1

Protect your data using customer managed keys

Scene 2

[Audio] Agenda Introduction to OCI-Vaults (K-M-S--). 

Scene 3

[Audio] Introduction to OCI-Vaults Introduction to O-C-I vault. 

Scene 4

[Audio] O-C-I Vault (1/2) Oracle Cloud Infrastructure Vault is a managed service that lets you centrally manage the encryption keys that protect your data and the secret credentials that you use to securely access resources. Vaults securely store master encryption keys and secrets that you might otherwise store in configuration files or in code. The Vault service to create and manage the following resources: Vaults Keys Secrets HSM Protected A close up of a logo Description automatically generated Master Encryption Keys Native O-C-I Storage Database Image signing Secrets. 

Scene 5

Oracle Cloud Infrastructure Vault is a managed service that lets you centrally manage the encryption keys that protect your data and the secret credentials that you use to securely access resources. 
 Vaults securely store master encryption keys and secrets that you might otherwise store in configuration files or in code. 
 The Vault service to create and manage the following resources: Vaults Keys Secrets

A close up of a logo

Description automatically generated  Master Encryption Keys

[Audio] O-C-I Vault (2/2) Centralized and customer controlled key management Natively integrated to many O-C-I services: OCI-Native Storage, DBaaS (ADB-D, ExaCS), O-K-E--, Streams Fully managed and highly available service Availability 99.9% S-L-As and 99.99% S-L-O-s Support regulatory compliance Meets PCI DSS and fips 140-2 Level 3 standard for cryptographic processing. 

Scene 6

Centralized and customer controlled key management Natively integrated to many OCI services: OCI-Native Storage, DBaaS (ADB-D, ExaCS), OKE, Streams
 Fully managed and highly available service Availability  - 99.9% SLAs and 99.99% SLOs
 Support regulatory compliance Meets PCI DSS and FIPS 140-2 Level 3 standard for cryptographic processing

[Audio] O-C-I Encryption Portfolio More Control Simple Control Customer-managed encryption (KMS – Virtual Private Vault) Customer-managed encryption (External keys*) Oracle-managed encryption Customer-managed encryption (KMS Vault) Default No access and control over keys Customer control and manage keys Multi-tenant H-S-M-s Customer control and manage keys Single-tenant H-S-M-s Customer control and manage keys On premise H-S-M-s *future. 

Scene 7

Customer-managed encryption (External keys*)

Customer-managed encryption  (KMS - Vault)

Customer-managed encryption  (KMS – Virtual Private Vault)

Customer control and manage keys Multi-tenant HSMs

Customer control and manage keys Single-tenant HSMs

Customer control and manage keys On premise HSMs

[Audio] Key Management Vault types K-M-S Vault (Multi-tenant H-S-M-) Virtual Private Vault (Single-tenant H-S-M-) Software Keys HSM Keys HSM Keys Software Keys Keys are hosted on a dedicated H-S-M partition Keys are hosted on a shared H-S-M partition Single tenant H-S-M with higher isolation cryptographic throughput ~3k – 5K TPS for A-E-S Multi-tenant H-S-M with moderate isolation Throughput depends on #of tenants Customers get 10 Vaults by default Supports large #of key versions no hard limit. Customers must request Virtual Private Vault limits. Supports up to 3000 key versions per Vault.. 

Scene 8

Virtual Private Vault (Single-tenant HSM)

Keys are hosted on a dedicated HSM partition

Keys are hosted on a shared HSM partition

Single tenant HSM with higher isolation  cryptographic throughput - ~3k – 5K TPS for AES

Multi-tenant HSM with moderate isolation  Throughput depends on #of tenants

Customers must request Virtual Private Vault limits. Supports up to 3000 key versions per Vault.

Customers get 10 Vaults by default  Supports large #of key versions - no hard limit.

[Audio] K-M-S Capabilities (1/2) Supports both Symmetric and Asymmetric encryption as well as Sign/Verify use cases. AES-GCM, R-S-A and ECDSA Flexibility to create your [Master Encryption] key as H-S-M or Software protected. HSM(default): Keys are stored and processed within the H-S-M while Software Keys are stored and processed on server memory but encrypted at rest with a H-S-M key Bring your own key (B-Y-O-K-) to manage and protect your data in O-C-I Meet your compliance and DR needs – key rotation, auditing and cross-region replication Backup/Restore Centralized key management for most of your O-C-I services DBaaS TDE (ADB-D, ExaCS), Block Volumes, File Storage, Object Storage and others. Audits all key management activity Soft-Delete for Vaults (minimum of 7 days). 

Scene 9

Supports both Symmetric and Asymmetric encryption as well as Sign/Verify use cases. AES-GCM, RSA and ECDSA
 Flexibility to create your [Master Encryption] key as HSM or Software protected. HSM(default):  Keys are stored and processed within the HSM while Software Keys are stored and processed on server memory but encrypted at rest with a HSM key Bring your own key (BYOK) to manage and protect your data in OCI Meet your compliance and DR needs – key rotation, auditing and cross-region replication Backup/Restore Centralized key management for most of your OCI services  DBaaS TDE (ADB-D, ExaCS), Block Volumes, File Storage, Object Storage and others. Audits all key management activity
 Soft-Delete for Vaults (minimum of 7 days)

[Audio] OCI-Vault Options Feature ‘Private’ Vault Standard Vault H-S-M Isolation Processing Cost $$$$ $ Billing Metric Vault/Hour Key Version. 

Scene 10

Feature ‘Private’ Vault Standard Vault HSM

 Isolation

 Processing

 Cost         $$$$                      $ Billing Metric         Vault/Hour              Key Version

[Audio] Key Management Pricing and faqs
oracle F-A-Q oracle. 

Scene 11

Oracle Cloud Infrastructure Key Management
Oracle Cloud Infrastructure Key Management -
Virtual Private Vault
Oracle Cloud Infrastructure Key Management - Vault
Software protected Keys
HSM protected Keys
(First 20 Key Versions free)
unit Price
S3.724
Free
SO.5334
Metric
Virtual Private Vault per hour
Key Version per month

https://www.oracle.com/cloud/security/pricing.html












FAQ - https://www.oracle.com/security/cloud-security/key-management/faq/

Scene 12

[Audio] Resources KMS Technical Documentation:
oracle Software protected Keys:
oracle ExaCS with KMS: oracle ADB-D with K-M-S Demo:
oracle Asymmetric Encryption: oracle Cross Region Replication (C-R-R--) for keys:
oracle. 

Scene 13

KMS Technical Documentation:
https://docs.oracle.com/en-us/iaas/Content/KeyManagement/Concepts/keyoverview.htm

Software protected Keys:
https://blogs.oracle.com/cloudsecurity/software-protected-keys-in-oracle-cloud-infrastructure-vault

ExaCS with KMS: 
https://blogs.oracle.com/cloudsecurity/announcing-customer-managed-encryption-keys-for-oracle-exadata-cloud-service

ADB-D with KMS - Demo:
https://blogs.oracle.com/dbcs/autonomous-database%3a-customer-controlled-encryptions-keys

Asymmetric Encryption: 
https://blogs.oracle.com/cloudsecurity/announcing-asymmetric-keys-support-in-oracle-cloud-infrastructure-vault

Cross Region Replication (CRR) for keys:
https://blogs.oracle.com/cloudsecurity/post/announcing-cross-region-replication-for-keys-in-oracle-cloud-infrastructure-vault

OCI Vault – Key Management Service

O-C-I Vault – Key Management Service
 Protect your data using customer managed keys
 						
 Hi Gsc

avatar

Agenda
 Introduction to OCI-Vaults (K-M-S--)

Introduction to OCI-Vaults
 Introduction to O-C-I vault

O-C-I Vault (1/2)


 Oracle Cloud Infrastructure Vault is a managed service that lets you centrally manage the encryption keys that protect your data and the secret credentials that you use to securely access resources. 
 Vaults securely store master encryption keys and secrets that you might otherwise store in configuration files or in code. 
 The Vault service to create and manage the following resources: Vaults Keys Secrets

 HSM  Protected
 A close up of a logo

Description automatically generated  Master Encryption Keys
 

 Native O-C-I  Storage
 

 Database
 Image signing


 Secrets

O-C-I Vault (2/2)


 Centralized and customer controlled key management Natively integrated to many O-C-I services: OCI-Native Storage, DBaaS (ADB-D, ExaCS), O-K-E--, Streams
 Fully managed and highly available service Availability   99.9% S-L-As and 99.99% S-L-O-s
 Support regulatory compliance Meets PCI DSS and fips 140-2 Level 3 standard for cryptographic processing

O-C-I Encryption Portfolio
 More Control
 Simple Control


 Customer-managed encryption  (KMS – Virtual Private Vault)










 Customer-managed encryption (External keys*)


 Oracle-managed encryption


 Customer-managed encryption  (KMS  Vault)




 Default No access and control over keys


 Customer control and manage keys Multi-tenant H-S-M-s

 Customer control and manage keys Single-tenant H-S-M-s

 Customer control and manage keys On premise H-S-M-s


 *future

Key Management  Vault types
 K-M-S
  Vault  (Multi-tenant H-S-M-)
 Virtual Private Vault (Single-tenant H-S-M-)
 Software Keys
 HSM Keys
 HSM Keys
 Software Keys
 Keys are hosted on a dedicated H-S-M partition
 Keys are hosted on a shared H-S-M partition
 Single tenant H-S-M with higher isolation  cryptographic throughput  ~3k – 5K TPS for A-E-S
 Multi-tenant H-S-M with moderate isolation  Throughput depends on #of tenants



 Customers get 10 Vaults by default  Supports large #of key versions  no hard limit.

 Customers must request Virtual Private Vault limits. Supports up to 3000 key versions per Vault.

K-M-S Capabilities (1/2)

 Supports both Symmetric and Asymmetric encryption as well as Sign/Verify use cases. AES-GCM, R-S-A and ECDSA
 Flexibility to create your [Master Encryption] key as H-S-M or Software protected. HSM(default):  Keys are stored and processed within the H-S-M while Software Keys are stored and processed on server memory but encrypted at rest with a H-S-M key Bring your own key (B-Y-O-K-) to manage and protect your data in O-C-I Meet your compliance and DR needs – key rotation, auditing and cross-region replication Backup/Restore Centralized key management for most of your O-C-I services  DBaaS TDE (ADB-D, ExaCS), Block Volumes, File Storage, Object Storage and others. Audits all key management activity
 Soft-Delete for Vaults (minimum of 7 days)

OCI-Vault Options
 Feature ‘Private’ Vault Standard Vault H-S-M

 Isolation

 Processing

 Cost         $$$$                      $ Billing Metric         Vault/Hour              Key Version

Key Management  Pricing and faqs
oracle












F-A-Q  oracle

Resources
 KMS Technical Documentation:
oracle

Software protected Keys:
oracle

ExaCS with KMS: 
oracle

ADB-D with K-M-S  Demo:
oracle

Asymmetric Encryption: 
oracle

Cross Region Replication (C-R-R--) for keys:
oracle

 KMS Technical Documentation:
https://docs.oracle.com/en-us/iaas/Content/KeyManagement/Concepts/keyoverview.htm

Software protected Keys:
https://blogs.oracle.com/cloudsecurity/software-protected-keys-in-oracle-cloud-infrastructure-vault

ExaCS with KMS: 
https://blogs.oracle.com/cloudsecurity/announcing-customer-managed-encryption-keys-for-oracle-exadata-cloud-service

ADB-D with KMS - Demo:
https://blogs.oracle.com/dbcs/autonomous-database%3a-customer-controlled-encryptions-keys

Asymmetric Encryption: 
https://blogs.oracle.com/cloudsecurity/announcing-asymmetric-keys-support-in-oracle-cloud-infrastructure-vault

Cross Region Replication (CRR) for keys:
https://blogs.oracle.com/cloudsecurity/post/announcing-cross-region-replication-for-keys-in-oracle-cloud-infrastructure-vault