SAP External Resources

SAP Data Custodian KMS supports a customer-managed keystore that allows a customer to create HYOK keys that reside in an external key manager. The lifecycle of HYOK keys is solely managed by an external key manager and SAP Data Custodian KMS does not have any control over it. The external key manager exposes a network endpoint to serve crypto requests and SAP KMS forwards the crypto operations to the external key manager for processing. The key material never leaves the security enclave of the external key manager.

SAP customers have requested to integrate Thales' CipherTrust Manager with SAP Data Custodian KMS for HYOK capabilities.