Skip to main content

DuoKey SQL EKM Overview

External key management for Microsoft SQL Server Transparent Data Encryption

Applies to:
SQL Server 2016+Windows Server 2012 R2+Azure SQL MIEnterprise / Standard / Developer

What is SQL EKM?

DuoKey SQL EKM (Extensible Key Management) is a comprehensive solution that enables Microsoft SQL Server to use external key management for Transparent Data Encryption (TDE). This integration provides enhanced security by storing encryption keys outside the database, giving organizations greater control over their data protection.

Key Sovereignty

Full control over your encryption keys, stored in DuoKey's MPC-protected HSM

Enhanced Security

Keys stored separately from database infrastructure for defense-in-depth

Seamless Integration

Native SQL Server EKM support with transparent encryption/decryption

Compliance Ready

Meets GDPR, HIPAA, PCI-DSS, and other regulatory requirements

Note
EKM is available in SQL Server Enterprise, Standard, and Developer editions (SQL Server 2016 and later). Express edition does not support EKM.

Architecture

DuoKey SQL EKM provides a seamless bridge between SQL Server's native TDE capabilities and external key management through a cryptographic provider DLL.

SQL Server

TDE Engine
EKM ProviderDuoKeyCryptoProvider.dll
HTTPS 443
▶

DuoKey Cloud

Key Vault
MPC HSMFIPS 140-2 Level 3

System Components

ComponentLocationDescription
DuoKey Cloud PlatformCloudCentral key management service with MPC-protected HSM
DuoKey EKM ProviderSQL ServerCryptographic provider DLL (DuoKeyCryptoProvider.dll)
SQL Server TDESQL ServerNative Transparent Data Encryption engine
Asymmetric Keymaster databaseRSA-2048 key protecting the DEK
Database Encryption KeyUser databaseAES-256 key encrypting data files

Encryption Hierarchy

SQL Server TDE with DuoKey EKM uses a multi-layer encryption hierarchy. Each layer protects the layer below it, with the Master Encryption Key (MEK) in DuoKey serving as the root of trust.

DuoKey Cloud Platform

Master Encryption Key (MEK)

MPC Protected
Protects

SQL Server (master database)

Asymmetric Key (EKM)

RSA-2048
Protects

User Database

Database Encryption Key (DEK)

AES-256
Encrypts

Data Files

.mdf, .ndf, .ldf

Encrypted at Rest
Tip
This hierarchy ensures that even if database files are stolen, they cannot be decrypted without access to the DuoKey platform where the MEK resides.

Key Features

Transparent Data Encryption

Encrypt databases at rest without application changes.

External Key Storage

Keys stored securely in DuoKey's cloud-based MPC HSM.

Key Rotation Support

Seamlessly rotate encryption keys without downtime.

Multi-Server Support

Deploy across multiple SQL Server instances.

Backup & Restore

Encrypted backups work across any configured server.

Audit & Compliance

Comprehensive logging for all key operations.

System Requirements

SQL Server

  • SQL Server 2016 or later
  • Enterprise, Standard, or Developer
  • EKM must be enabled

Operating System

  • Windows Server 2012 R2+
  • Windows 10/11 (dev only)
  • 64-bit architecture

Network

  • HTTPS to DuoKey platform
  • Port 443 outbound
  • TLS 1.2 or higher

Prerequisites

  • DuoKey platform account
  • SQL EKM app created
  • Administrator privileges
Caution
SQL Server Express edition does not support Extensible Key Management.

Getting Started

Ready to implement SQL EKM? Follow these guides:

Create App

Set up DuoKey app

Install

Install EKM provider

Configure

Configure SQL Server

Encrypt

Enable TDE

Tip
See the Quick Start Guide for a complete walkthrough.

See Also