Extensible Key Management using Azure Key Vault (SQL Server)

Applies to: SQL Server

The SQL Server Connector for Azure Key Vault enables SQL Server encryption to use the Azure Key Vault service as an Extensible Key Management (EKM) provider to protect SQL Server encryption keys.

This article describes the SQL Server connector. More information is available in:

• Set up SQL Server TDE Extensible Key Management by using Azure Key Vault
• Use SQL Server Connector with SQL Encryption Features
• SQL Server Connector Maintenance & Troubleshooting

What is Extensible Key Management (EKM) and why use it?

SQL Server provides several types of encryption that help protect sensitive data, including Transparent data encryption (TDE), Encrypt a Column of Data (CLE), and Backup encryption. In all of these cases, in this traditional key hierarchy, the data is encrypted using a symmetric data encryption key (DEK). The symmetric data encryption key is further protected by encrypting it with a hierarchy of keys stored in SQL Server.

Instead of this model, the alternative is the EKM Provider Model. Using the EKM provider architecture enables SQL Server to protect the data encryption keys by using an asymmetric key stored outside of SQL Server in an external cryptographic provider. This model adds an additional layer of security and separates the management of keys and data.

The following image compares the traditional service-manage key hierarchy with the Azure Key Vault system.

The SQL Server Connector serves as a bridge between SQL Server and Azure Key Vault, so SQL Server can use the scalability, high performance, and high availability of the Azure Key Vault service. The following image represents how the key hierarchy works in the EKM provider architecture with Azure Key Vault and SQL Server Connector.

Azure Key Vault can be used with SQL Server installations on Azure Virtual Machines and for on-premises servers. The key vault service also provides the option to use tightly controlled and monitored Hardware Security Modules (HSMs) for a higher level of protection for asymmetric encryption keys. For more information about the key vault, see Azure Key Vault.

The following image summarizes the process flow of EKM using the key vault. (The process step numbers in the image aren't meant to match the setup step numbers that follow the image.)

For the next step, see Set up SQL Server TDE Extensible Key Management by using Azure Key Vault.

For use scenarios, see Use SQL Server Connector with SQL Encryption Features.

Related content

• SQL Server Connector Maintenance & Troubleshooting