A Key Management Server Built for Object Storage Scale

Highly available, powerful and operationally simple, MinIO's Enterprise Key Management Server is optimized for large storage infrastructures where billions of cryptographic keys are required.

MinIO's Enterprise KMS establishes its foundational trust using the concept of an hardware security module (but given KES is software, this is only a concept). That module assumes a pivotal role in sealing and unsealing the KMS root encryption key. The module responsibility extends to safeguarding the integrity of KMS by allowing the unsealing of its encrypted on-disk state and facilitating communication among nodes within a KMS cluster.

It solves the challenges associated with billions of cryptographic keys and hundreds of thousands of cryptographic operations per node per second - which are commonplace in larger deployments.

Context

The MinIO Enterprise KMS should be used in situations where an object-storage specific key management server is needed. This generally starts when there are millions of cryptographic keys to be managed.

Features

Features

The unique challenges posed by large, highly available, and performant data infrastructures requires a unique set of features for our KMS:

High Availability and Fault Tolerance

High Availability and Fault Tolerance

In the dynamic landscape of large-scale systems, network or node outages are inevitable. Taking down a cluster for maintenance is rarely feasible. MinIO's Enterprise KMS ensures uninterrupted availability, even when faced with such disruptions, mitigating cascading effects that can take down the entire storage infrastructure. Specifically, you could lose all but one node of a cluster and still handle any encryption, decryption or data key generation requests.

Predictable Behavior

Predictable Behavior

MinIO's Enterprise KMS is designed to be easily managed, providing operators with the ability to comprehend its state intuitively. Due to its simple design, MinIO's Enterprise KMS is significantly easier to operate than similar solutions that rely on more complex consensus algorithms like Raft, or Paxos.

Scalability

Scalability

While the amount of data usually only increases, the load on a large-scale storage system may vary significantly from time to time. MinIO's Enterprise KMS supports dynamic cluster resizing and nodes can be added or removed at any point without incurring any downtime.

Consistent and Performant

Consistent and Performant

The responsiveness of the KMS for GET/PUT operations directly influences the overall efficiency and speed of the storage system. MinIO's Enterprise KMS nodes don’t have to coordinate when handling such requests from the storage system. Therefore, the performance of a MinIO's Enterprise KMS cluster increases linearly with the number of nodes. Further, MinIO's Enterprise KMS supports request pipelining to handle hundreds of thousands of cryptographic operations per node and second.

Multi-Tenancy

Multi-Tenancy

Large-scale storage infrastructures are often used by many applications and teams across the entire organization. Isolating teams and groups into their own namespaces is a core requirement. MinIO's Enterprise KMS supports namespacing in the form of enclaves. Each tenant can be assigned its own enclave which is completely independent and isolated from all other enclaves on the KMS cluster.

Simplicity

Simplicity

Operating a KMS cluster does not require expertise in cryptography or distributed systems. Everything can be done from the Enterprise Console.

MinIO's Enterprise KMS FAQs

Learn more about MinIO’s Enterprise KMS

Ask an Expert

Speak Immediately to an Engineer at MinIO About Your KMS Questions

Send Us An Email by Completing the Form Below

We will be in touch within the hour.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Request a Demo Request a Demo

You are using Internet Explorer version 11 or lower. Due to security issues and lack of support for web standards, it is highly recommended that you upgrade to a modern browser.