Key Management System Keys

You can use Key Management System (KMS) keys for data encryption instead of secret keys based on a password. KMS keys are based on an asymmetric key encryption algorithm. They are managed and rotated by an external KMS server and provide a higher level of security.

You can use KMS keys to encrypt backup files on the following encryption levels:

• Job-level encryption:

• Backup and backup copy jobs
• Veeam Agent backup jobs managed by Veeam Backup & Replication
• Application backup policies managed by Veeam Backup & Replication
• File backup jobs and object storage backup jobs
• Transaction log backup and backup copy jobs
• VeeamZIP jobs

For more information about job-level encryption, see Job Encryption.

• Storage-level encryption:

• Backup repositories that store backup files created by:

• Veeam Plug-Ins for Enterprise Applications operating in the standalone mode
• Veeam Plug-In for Nutanix AHV
• Veeam Plug-In for Proxmox VE
• Veeam Plug-In for HPE Morpheus VM Essentials
• Veeam Plug-In for oVirt KVM
• Veeam Plug-In for Xen (XCP-ng/XenServer)
  
• Veeam Plug-In for KubeVirt (Red Hat OpenShift Virtualization)
• Veeam Plug-In for Universal Hypervisor API (Platform9/VergeOS)
• Veeam Plug-In for Scale Computing HyperCore
  
• Veeam Plug-In for Sangfor aSV
  
• Veeam Kasten for Kubernetes

For more information about storage-level encryption for Veeam Backup & Replication additional solutions, see Encrypting Standalone Application Backups in Backup Repositories.

• Capacity tier repositories. For more information about storage-level encryption for capacity tier repositories, see Encryption for Capacity Tier.
• Media pools and GFS media pools. For more information about storage-level encryption for tape devices, see Tape Encryption.
• External repositories (decryption only).

In This Section

• How KMS Works
• Requirements and Limitations
• KMS Certificates
• Adding KMS Server
• Using KMS Keys