Security & governance
Hold your own key (HYOK)
Hold your own key (HYOK) is an encryption arrangement in which the keys that protect an organization's data are kept in a key management system the organization itself controls, outside the service provider that stores or processes the data. The provider never possesses the key. It must request each cryptographic operation from the customer's system, or it handles only data that was encrypted before it arrived.
How does HYOK work?
Two patterns are common. In external key management, the provider's services are configured to call a key manager or hardware security module that the customer runs, on its own premises or with an independent third party, whenever a key needs to be unwrapped. In client-side encryption, the customer encrypts data before sending it, and the provider stores ciphertext it has no means to read. In both, withdrawing access is a matter of refusing requests at the customer's key system.
What does HYOK protect against?
The aim is that the provider is technically unable to disclose readable data.
| Threat | Effect of HYOK |
|---|---|
| Provider staff or a compromised provider account | Sees ciphertext only |
| Legal order served on the provider | Provider can produce only ciphertext |
| Provider-side key service breach | Customer keys are not there to steal |
| Customer credential theft | Not addressed, the attacker acts as the customer |
| Loss of the customer's own keys | Not addressed, and data becomes unrecoverable |
What are the trade-offs?
The customer's key system becomes part of the data path. If it is unreachable, data cannot be read, so it needs the same availability as the service it protects. Latency rises where each operation involves a remote key call. Provider features that need to see plaintext, such as server-side search, indexing or some analytics, may stop working. And responsibility for backup and recovery of the keys rests entirely with the customer. These costs are why HYOK is applied selectively to the most sensitive data sets.
How does HYOK relate to self-operated storage?
HYOK addresses a problem that arises when someone else holds the data. When an organization runs storage on infrastructure it operates, both the data and the keys are already under its control, and the question becomes one of internal separation: keeping the key management service apart from the storage system and its administrators. The comparison with bring your own key and the sovereignty angle are covered in encryption keys and data sovereignty.
Frequently asked questions
Is HYOK the same as BYOK?
No. With BYOK the key is imported into the provider's key service. With HYOK it never leaves the customer's control.
Can a provider read HYOK-protected data?
Not without a successful request to the customer's key system, which the customer can refuse or log.
What happens if the HYOK key system goes down?
Data protected by it cannot be decrypted until the key system is available again.
Related terms
- Bring your own key (BYOK): the lighter alternative.
- Key management service (KMS): the system that holds the keys.
- Extraterritorial data access: the exposure HYOK is designed to limit.
- Envelope encryption: the key hierarchy external keys plug into.
- CLOUD Act: a law whose reach depends on provider control.