Glossary
The terms used across the OpenKCM documentation, in alphabetical order. Each entry links to the page that explains the term in detail.
A–F
| Term | Meaning |
|---|---|
| Approval workflow | A request for a sensitive key operation that other users must approve before CMK carries it out. See Approvals |
| Audit event | A record of a security-relevant action, such as a key change, a login or a rejected request, sent to the operator's log collector. See Audit logging |
| Auditor | Short for tenant auditor: the CMK role that can read everything in a tenant and change nothing. See Roles |
| BYOK | Bring your own key. The customer generates the key material and imports it, wrapped, into the keystore that the platform provides for the tenant. See Keys |
| Cedar | The policy language that ExtAuthZ uses to decide which caller may call which API path. See ExtAuthZ |
| Central deployment | The deployment of the Registry, shared by all CMK regions. See Deployment planning |
| Client data | A short-lived, signed statement about the caller that ExtAuthZ adds to every allowed request, and that CMK verifies. See Signed client data |
| CMK | Customer-Managed Keys: the OpenKCM component that governs customer keys, their keystores, tenants, roles, approvals and the propagation of key changes. See CMK |
| CMK-2-Krypton Bridge | The CMK service that turns CMK's key decisions into Krypton operations. See CMK-2-Krypton Bridge |
| CMK region | A regional deployment of CMK, with the CMK service, CMK UI, ExtAuthZ and Session Manager. It serves the tenants registered for this region. See Deployment planning |
| CMK UI | The web console in which tenant users manage their keys, systems, groups and approvals. See CMK UI |
| Customer key | The tenant's root key, managed through CMK and kept in a keystore. Level L1 of the key hierarchy |
| DEK | Data encryption key: a key that encrypts data. Level L4 of the key hierarchy |
| Envoy Gateway | The API gateway in front of CMK. It terminates TLS and asks ExtAuthZ to check every request |
| ExtAuthZ | The service that authenticates every API request at the gateway, evaluates policies and signs the client data. See ExtAuthZ |
G–K
| Term | Meaning |
|---|---|
| Group | A group of users from the tenant's identity provider. CMK maps groups to roles through their IAM identifiers. See Groups and roles |
| HYOK | Hold your own key. The key stays in the customer's own keystore; CMK links it and checks its state regularly. See Keys |
| IAM identifier | The name of a group as the identity provider sends it in the user's token, for example KMS_TenantAdministrator_acme |
| Identity provider (IdP) | The OpenID Connect service that authenticates a tenant's users, for example the customer's corporate login |
| KEK | Key encryption key: a key that protects other keys |
| Key administrator | The CMK role that manages keys, key configurations and systems in a tenant. See Roles |
| Key configuration | A container for keys in CMK. It belongs to an administrator group, holds one or more keys, and has a primary key that its linked systems use. See Key configurations |
| Key hierarchy | Keys arranged in levels, where each key protects the keys of the level below. Disabling the customer key cuts off every key below it. See Core concepts |
| Key version | A version of a key's material. Keystores create new versions when a key is rotated; CMK detects and records them |
| Keystore | The service where key material lives and key operations happen, for example AWS KMS. CMK connects to keystores through plugins |
| Keystore pool | A set of prepared keystores from which CMK assigns one to each new tenant |
| KMIP | Key Management Interoperability Protocol. Workloads use it to fetch their keys from Krypton |
| Krypton | The OpenKCM component that creates and operates cryptographic key hierarchies and delivers keys to workloads. See Krypton |
L–R
| Term | Meaning |
|---|---|
| L1 to L4 | The levels of the key hierarchy: customer key, tenant key, service key and data encryption key |
| OpenBao | The secrets store in which Krypton keeps sealed key material |
| Orbital | The library that CMK and the Registry use to send jobs and tasks between services over an AMQP broker, and to track their results |
| Plugin | A separate process that connects CMK to a keystore or to a user directory. See Plugins |
| Primary key | The key of a key configuration that its linked systems use |
| Region | Either a CMK region, which serves tenants, or a system region, where systems run. See Deployment planning |
| Regional deployment | The deployment of CMK, CMK UI, ExtAuthZ and Session Manager for one CMK region |
| Registry | The central registry of tenants and systems. Tenants are registered there with their CMK region, and the Registry sends each tenant's jobs to the CMK of that region. See Registry and Connect a regional tenant |
| Role | What a user may do in a tenant: tenant administrator, key administrator or auditor. A user holds exactly one role per tenant |
S–Z
| Term | Meaning |
|---|---|
| SCIM | System for Cross-domain Identity Management: a standard API for user directories, used by CMK to look up users and groups |
| Session Manager | The service that runs the browser sign-in with the tenant's identity provider and keeps the browser sessions. See Session Manager |
| System | A service instance of the cloud service in a region that uses a tenant's key, for example a database of that tenant. Registered in the Registry and mapped to a tenant. See Systems |
| System region | The region where a system runs, for example eu10. The CMK of the system's tenant sends the system's tasks to its target for this region |
| System-managed key | A key that the keystore generates on request. Not available in the current version of CMK; use BYOK or HYOK |
| Tenant | A customer of the cloud service. Each tenant has its own keys, users, identity provider and data, isolated from other tenants. Registered in the Registry with one CMK region. See Connect a regional tenant |
| Tenant administrator | The CMK role that manages the tenant's groups and settings. It has no access to keys. See Roles |
| Trust | The record that tells Session Manager and ExtAuthZ which identity provider a tenant uses |
| Wrapping | Encrypting a key with another key, for example to import BYOK key material safely |