6. DKE

Introduction

PKWARE key management support for Microsoft Double Key Encryption (DKE) provides organizations with a simple and seamless experience for administrators. Administrators managing Microsoft’s Information Protection around double key encryption with PKWARE don’t have to worry about the aspects that come from enterprise key management; scalability, auditability, durability, security, and high availability.

Microsoft allows for customers to choose between different types of key management capabilities around their Information Protection suite; Microsoft Managed Key, Bring Your Own Key, and Double Key Encryption. Double key encryption allows organizations to utilize the seamless experiences with encrypted Office file types while also giving customers the benefit of knowing no one else outside their organization can decrypt their files, including Microsoft.

Microsoft DKE uses two keys to access protected content. Microsoft Azure stores one key and the customer holds the second key, which means customers can finally maintain full control of one their keys. Without having both keys, Microsoft cannot decrypt files encrypted with DKE.

How We Integrate

The second key that customers control is managed by a cloud or on-premises instance of the PKWARE Enterprise Manager (PEM). With that DKE controlled by the PEM, an administrator sets what users and groups should have access to the DKE key. Once the key and the users/groups associated with that key are created, the PEM will generate a URL that must be given to the Microsoft Information Protection label with DKE encryption.

When an end user authenticates with their Azure Active Directory, the unified labeling client will retrieve the  appropriate DKE keys from the PEM service. If a user tries to right-click Microsoft’s “Classify and Protect” in Explorer or select a label within an Office application, the DKE label will be available.

Definitions

Import & Export: Transferring DKE Keys

At some point, you may need to move keys used for DKE from one environment to another. Our manager allows you to export the existing keys from one server (server 1) to another server (server 2). Follow these steps:

1. Start on Server 2 that does not have the DKE keys yet, go the DKE page.
2. Click Import/Export.
3. Click Download Public Key. Save the generated JSON file to a convenient location.
4. On server One that has the DKE keys, go to DKE.
5. Click Import/Export.
6. Click Export.
7. In the Upload Public Key to Target Server, browse to the JSON file saved in Step 3.
8. In Select Keys to Export, all existing Communities are checked by default. You may uncheck the box next to any keys you don't want to export. Click OK.
9. Save the generated Key Transfer file to a convenient location.
10. Return to the Server 2.
11. Click Import.
12. Browse to the Key Transfer file. Click OK.
13. After the import, you will see the imported DKE Keys in the DKE table list.