| title | description | ms.custom | ms.date | ms.prod | ms.reviewer | ms.technology | ms.topic | helpviewer_keywords | ms.assetid | author | ms.author | ||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Extensible Key Management using Azure Key Vault |
Use the SQL Server Connector for Extensible Key Management with Azure Key Vault for SQL Server. |
seo-lt-2019 |
07/22/2016 |
sql |
vanto |
security |
conceptual |
|
3efdc48a-8064-4ea6-a828-3fbf758ef97c |
jaszymas |
jaszymas |
[!INCLUDEappliesto-ss-xxxx-xxxx-xxx-md]
The [!INCLUDEssNoVersion] Connector for [!INCLUDEmsCoName] Azure Key Vault enables [!INCLUDEssNoVersion] encryption to use the Azure Key Vault service as an Extensible Key Management (EKM) provider to protect [!INCLUDEssNoVersion] encryption keys.
This topic describes the [!INCLUDEssNoVersion] connector. Additional information is available in Setup Steps for Extensible Key Management Using the Azure Key Vault, Use SQL Server Connector with SQL Encryption Features, and SQL Server Connector Maintenance & Troubleshooting.
[!INCLUDEssNoVersion] provides several types of encryption that help protect sensitive data, including Transparent Data Encryption (TDE), Column Level Encryption (CLE), and Backup Encryption. In all of these cases, in this traditional key hierarchy, the data is encrypted using a symmetric data encryption key (DEK). The symmetric data encryption key is further protected by encrypting it with a hierarchy of keys stored in [!INCLUDEssNoVersion]. Instead of this model, the alternative is the EKM Provider Model. Using the EKM provider architecture enables [!INCLUDEssNoVersion] to protect the data encryption keys by using an asymmetric key stored outside of [!INCLUDEssNoVersion] in an external cryptographic provider. This model adds an additional layer of security and separates the management of keys and data.
The following image compares the traditional service-manage key hierarchy with the Azure Key Vault system.
The [!INCLUDEssNoVersion] Connector serves as a bridge between [!INCLUDEssNoVersion] and Azure Key Vault, so [!INCLUDEssNoVersion] can leverage the scalability, high performance, and highly availability of the Azure Key Vault service. The following image represents how the key hierarchy works in the EKM provider architecture with Azure Key Vault and [!INCLUDEssNoVersion] Connector.
Azure Key Vault can be used with [!INCLUDEssNoVersion] installations on [!INCLUDEmsCoName] Azure Virtual Machines and for on-premises servers. The key vault service also provides the option to use tightly controlled and monitored Hardware Security Modules (HSMs) for a higher level of protection for asymmetric encryption keys. For more information about the key vault, see Azure Key Vault.
The following image summarizes the process flow of EKM using the key vault. (The process step numbers in the image are not meant to match the setup step numbers that follow the image.)
Note
Versions 1.0.0.440 and older have been replaced and are no longer supported in production environments. Upgrade to version 1.0.1.0 or later by visiting the Microsoft Download Center and using the instructions on the SQL Server Connector Maintenance & Troubleshooting page under "Upgrade of SQL Server Connector."
For the next step, see Setup Steps for Extensible Key Management Using the Azure Key Vault.
For use scenarios, see Use SQL Server Connector with SQL Encryption Features.