Double Key Encryption Integration
Apply two layers of security to your most sensitive content in Azure cloud.
Integrate Microsoft Double Key Encryption with Entrust nShield HSMs
Microsoft Double Key Encryption for Azure Information Protection (AIP) helps enterprises protect their most sensitive Office 365 content. Entrust Double Key Encryption for Microsoft AIP, offered by Entrust Professional Services, integrates certified Entrust nShield® hardware security modules (HSMs) to provide a root of trust for the protection of sensitive cryptographic keys. The tools and hardware give you complete ownership and control of the software that underpins the double key generation process, with no Microsoft footprint on your premises.
Replacing Microsoft Azure Hold your Own Key (HYOK), Double Key Encryption does not require you to operate your own Active Directory and Rights Management Servers. Instead, you can provide your own cryptographic keys, protected with your nShield HSMs, in real-time.
Based on this architecture, you don’t just control your key, you also control the software that manages it. This integrated solution is particularly suitable if you need to:
- Protect sensitive high value artifacts
- Comply with industry and regulatory mandates governing the control of your keys and data
How it works
Double Key Encryption (DKE) utilizes two component keys to protect highly sensitive data — a key that is in the customer’s control and a Microsoft key stored securely in Microsoft Azure. The customer DKE key is generated and protected using a robust FIPS 140-2 Level 3 and Common Criteria EAL4+ certified Entrust nShield(R) HSM and is used to encrypt the organization’s sensitive data. The data is then encrypted again this time with the Azure Information Protection (AIP) key provided by Microsoft. The process ensures 3rd parties including Microsoft do not have access to the customer's content.
Integrating Entrust nShield HSMs
Entrust Double Key Encryption is supported by FIPS 140-2 Level 3 and Common Criteria EAL4+ certified nShield Solo XC (PCIe) and nShield Connect XC (network-attached) HSMs. These HSMs hold the master key protecting the Double Key Encryption server and key store. Four nShield HSMs are typically deployed for redundancy across production and disaster recovery environments.
nShield HSMs
Entrust nShield HSMs are among the highest-performing, most secure and easy-to-integrate HSM solutions available. They facilitate regulatory compliance and deliver the highest levels of data and application security for enterprise, financial, government, and other organizations that need to protect their data. The unique nShield Security World key management architecture provides strong, granular controls over access and usage of keys.
Double Key Encryption Benefits
Double Security
Apply two layers of security to your most sensitive content in Azure cloud.
Control Access to Your Data
Manage user (including Microsoft) access to your key and the content protected by the key.
Own and Control Your Keys
Own and fully control your keys and the software that generates your key.
Control Key Hosting and Storage
Host your key and store your critical data in the location of your choice.
Frequently Asked Questions
What is double key encryption (DKE)?
Double key encryption is an advanced encryption method that uses two separate keys to protect sensitive data. One encryption key is stored in the cloud by a cloud provider, such as Microsoft Azure, while the other is securely managed by the organization, typically in a hardware security module (HSM) or key vault. This ensures encrypted content remains inaccessible to unauthorized users, even if the cloud environment is compromised.
Why is double key encryption important for data security?
DKE provides an extra layer of protection for sensitive information, particularly for regulated industries that must comply with stringent regulatory compliance standards. By splitting the encryption keys, organizations maintain control over their most sensitive data. This ensures that no single entity has full access to encrypted data, mitigating risks from potential breaches.
DKE also supports data security by integrating seamlessly with solutions like Microsoft Azure Information Protection and sensitivity labels to safeguard protected data.
How does double key encryption work?
DKE encrypts data with two encryption keys. The organization manages one, while its cloud provider — such as Microsoft Azure — handles the other.
The organization stores its cryptographic key in a key management solution, such as a hardware security module or an enterprise key vault. The cloud provider manages the second key within its infrastructure. This dual-key approach ensures encrypted content cannot be decrypted without organizational consent and provides enhanced data protection for sensitive and personal information.
What are the common use cases for DKE?
Common use cases for double key encryption include:
- Protecting sensitive information in the cloud: DKE ensures that encrypted content stored in cloud environments like Microsoft Azure remains secure.
- Regulatory compliance: Many industries, such as healthcare and finance, require enhanced encryption to meet compliance standards for protecting sensitive information.
- Data sovereignty: DKE is particularly useful for businesses requiring control over their encryption keys to meet jurisdictional or data residency requirements.
How does Entrust simplify DKE implementation?
Entrust offers streamlined integration with Microsoft Azure Information Protection through nShield HSMs and key management solutions. This ensures organizations can:
- Use hybrid computing environments with added levels of protection, control, and assurance
- Encrypt so that even Microsoft can’t access sensitive content
- Own and control the software that generates the encryption key
- Host and store keys and sensitive data in the location of their choice
Learn more about Entrust Double Key Encryption.
What makes Entrust’s DKE integration different from other solutions?
Entrust’s double key encryption service offers several unique advantages:
- Industry-leading HSMs: Entrust nShield HSMs enable secure key generation, storage, and management.
- Seamless Microsoft integration: Entrust’s solution is fully compatible with Microsoft Azure and Microsoft DKE, ensuring a smooth implementation.
- Robust compliance capabilities: Entrust helps organizations regulatory standards by ensuring sensitive information and encryption keys are securely managed.
Entrust Double Key Encryption is supported by FIPS 140-2 Level 3 and Common Criteria EAL4+ certified nShield Solo XC (PCIe) and nShield Connect XC (network-attached) HSMs.
Double Key Encryption Resources
Related Products
Fill out the form to have one of our experts contact you to discuss how you can integrate Microsoft double key encryption with Entrust nShield HSMs.