01
Keys on the encrypted host
A local keyring or a key file on the same server or cluster leaves the key next to the data. Whoever copies the disk, the VM or the backup copies the key too.
Why infrastructure encryption needs an external key manager
Encryption at rest only protects data if the key does not sit next to it.
02
One key manager per product
Hypervisor, storage and database teams each buy their own key manager. Policies, rotation and audit end up in as many consoles as there are vendors.
03
Auditors ask who can use the key
PCI DSS, DORA, NIS2 and GDPR audits want key custody separated from the systems that hold the data, with a trail of every key operation.
How DuoKey for KMIP works
DuoKey for KMIP runs inside the DuoKey Cockpit: there is no separate appliance to install. Deploy a KMIP endpoint, bind it to a key vault, choose the authentication methods and the allowed operations, then point any OASIS KMIP 1.x or 2.x client at it over the binary TLS transport on port 5696 with mutual TLS.
Hypervisors and storage: VMware vSphere VM encryption, vTPM and vSAN, and Nutanix AHV data-at-rest encryption register DuoKey as their external key manager.
Databases: MySQL and Percona Server TDE, Percona PostgreSQL pg_tde, Cassandra and Couchbase encryption at rest fetch their principal key over KMIP.
Standard Key Provider: vCenter registers DuoKey as a standard (KMIP) key provider, not the Native Key Provider that keeps keys inside vCenter.
Lifecycle: Create, Activate, Get, Locate, Encrypt and Decrypt (AES-256-GCM), Revoke and Destroy, with a per-endpoint policy that restricts operations and object types.
Client mode: connect DuoKey to an existing external KMIP server, such as Fortanix SDKMS or Thales CipherTrust, and manage its keys from the same console while you migrate.
Key Benefits
What a single KMIP key manager changes
Keys off the hosts they protect
vCenter, Nutanix and the database engines fetch their keys from DuoKey at boot or on demand. Key material is not stored on the hypervisor or the database server: the KMIP server keeps it sealed at rest with AES-256-GCM under the platform key.
One policy and audit trail
With audit logging enabled on the endpoint, every KMIP operation is recorded and reviewed in the same Cockpit that runs your HYOK, BYOK and PKI keys.
Standard protocol, no lock-in
KMIP is an OASIS standard. Clients are tested end to end with the PyKMIP reference client, and a built-in client simulator lets you check an endpoint before wiring up production.
Migrate at your pace
Client mode reads keys from an existing KMIP server, so you can move workloads from one key manager to DuoKey without a big-bang cut-over.
Next step
Still weighing the control model?
Bring the constraint. We’ll map the shortest practical path.
Bring your KMIP workloads under one key manager
Talk to us about VMware, Nutanix and database encryption with DuoKey for KMIP.
Trust
Assurance and customer programmes
Customer programmes