Bring Your Own Key

Scope

Bring Your Own Key (BYOK) is a security feature that allows organizations to use their own encryption keys to protect their data. This ensures that they maintain control over their encryption keys and, consequently, their data.

Supported Key Management Services

Illumina integrates with leading Key Management Services (KMS), including Azure Key Vault and AWS KMS, so organizations can maintain full control over their encryption keys. These integrations combine Illumina’s Bring Your Own Key (BYOK) feature with your preferred KMS provider to deliver robust key management and enhanced data security.

Azure Key Vault

is a cloud service that provides a secure way to store and manage sensitive information like API keys, passwords, and certificates. It offers robust features for key management, including key generation, storage, and lifecycle management.

AWS KMS

(KMS) allows you to create and control encryption keys used to encrypt your data across a wide range of AWS services and applications. It provides centralized management of encryption keys and integrates seamlessly with other AWS services.

Setup

Azure Key Vault Setup

The API server encrypts the organization's information before storing it in the database and decrypts it when needed (e.g., during pipeline execution). The key vault is managed by the organization.

To configure encryption in Emedgene, you need the following information from Azure Key Vault:

Application tokens:

• Client Id

• Tenant Id

• Client Secret

The key information:

• Key URL

Create a new application

Add a client secret

Create a new key

Find key details

AWS Key Management Service (KMS) Setup

Description is coming soon.

Architecture

The API server will encrypt the client's information before storing it in a database and decrypt that information when needed (e.g., running the pipeline). The key vault is managed by the client, and Emedgene will only be provided with access to encrypt/decrypt functions in that key vault. This guarantees that clients control access to the information.

Illustration of data flow when creating a case in Emedgene platform:

Illustration of data flow when reading a case data from emedgene platform:

A preliminary step to this solution is having a key vault owned by the client, and a key that Emedgene is given access to.

The client will create an access policy in the key vault of type “Application” and provide the matching key and secret to Emedgene. The access policy must contain permissions to perform encrypt and decrypt actions.

In order for Emedgene to integrate with the key, depending on the key vault provider, the client needs to provide the following information:

• Client Id

• Client Secret

• Tenant Id

• Key vault name

Searching Encrypted Fields

Since some of our platform search capabilities run directly on the DB, we can’t directly search any data that is encrypted. To overcome this, we will implement a hashing search functionality as follows.

• The case data will still be fully encrypted in the DB as it is today

• Specific fields we want to make “searchable” - as defined by the customer, we will save their hash value alongside the encrypted data.

• Hashing will be done using SHA-256, and will include a secure random generated salt of 32 characters, which will be added to the value.

Illustration of data flow when searching in Emedgene platform:

Illustration of data flow when creating a case with searchable field in Emedgene platform:

Appendix