BYOK / HYOK
Definition
Bring Your Own Key lets the customer supply the master key to a provider KMS, the provider stores it. Hold Your Own Key keeps the key in customer infrastructure entirely, the provider asks the customer to decrypt. HYOK is the strongest sovereignty posture.
- BYOK
- Bring Your Own Key: customer key held in provider's KMS
- HYOK
- Hold Your Own Key: key stays entirely in customer infrastructure
- Stronger posture
- HYOK
- Domain
- Cloud data sovereignty and key management
Common questions
Why is HYOK considered stronger than BYOK for sovereignty?+
Under BYOK the key still resides inside the provider's key management system, so the provider retains technical capability to decrypt if compelled. Under HYOK the key never leaves customer infrastructure, meaning the provider must send data to the customer for decryption, which limits what it can be compelled to hand over directly.
What is the practical downside of HYOK for a customer?+
Because decryption depends on the customer's own systems being available, an outage or misconfiguration on the customer side can lock the customer out of their own provider-hosted data, so HYOK trades some operational resilience for sovereignty.
Related terms
- Hypervisor
- Software or firmware that creates and runs virtual machines. Type 1 runs on bare metal (ESXi, Xen, KVM, Hyper-V Server). Type 2...
- MeghRaj
- The Government of India cloud initiative launched in 2014 as the GI Cloud, providing shared cloud infrastructure for central and state government...
- MeitY Empanelment
- The Indian Ministry of Electronics and IT framework that certifies cloud service providers fit for government workloads. AWS, Azure, GCP and OCI...
- NIST SP 800-145
- The 2011 NIST Special Publication that codified the definition of cloud computing as five essential characteristics, three service models (IaaS, PaaS, SaaS)...
- Shared Responsibility Model
- The cloud security split where the provider secures the underlying infrastructure (security of the cloud) and the customer secures their data, identity,...