Enhanced Encryption: Azure Key Vault and Rubrik Cloud Vault

Using this approach, customers have ownership of the hierarchy of encryption keys used to secure their cloud-archived data. Since this encryption is happening with their on-premises Rubrik Secure Vault prior to sending to RCV, they maintain total control of their data security. Even Rubrik cannot read this data while it is in RCV.

Encryption Key Management

Azure Key Vault settings are managed via the Unified Encryption Key Management (UEKM) interface within Rubrik Security Cloud. The UEKM provides a centralized location to configure and manage encryption keys used to protect data across Rubrik’s various solutions. 

Once an RCV location is created, the UEKM interface allows for key lifecycle management operations like key rotation and rekeying. This allows administrators to monitor and maintain the integrity of their encryption keys throughout the entire data lifecycle.

One of the core benefits of RCV is that the data it protects is immutable; it is designed to be unchangeable and tamper-proof. While the stored data cannot be re-encrypted, the encryption keys used to protect the data can be updated and rotated. New Data Encryption Keys (DEKs) are regularly created and used to encrypt new customer data, often for each new data file. KEKs, which are used to encrypt the DEKs and lower level KEKs, can be replaced.

This means that encrypted data is protected by multiple levels of encryption, most of which will use fresh encryption keys for new data.

Updating Key Encryption Keys

Rekeying is the process of replacing an existing KEK with a new key that is then used to protect child keys in the hierarchy. This allows customers to replace compromised keys and reset the security of the lower level KEKs and DEKs. Customers can manually initiate the rekeying process for either the Master Key (changing the KMS or RSA key that manages the entire key hierarchy) or the Root Key (at the top of the key hierarchy) via the Rubrik Security Cloud.

When the Root Key is updated, the intermediate KEKs and DEKs will be automatically re-encrypted using the new Root Key. If the Master Key is updated, a new Root KEK will be automatically issued, resulting in the re-encryption of intermediate KEKs and DEKs