Loading
Prepare for Email to Become the Default Login ExperienceRead More
Set Up and Maintain Your Salesforce Organization
How Salesforce Shield EKM Works

You are here:

  1. Salesforce Help
  2. Docs
  3. Set Up and Maintain Your Salesforce Organization

How Salesforce Shield EKM Works

With External Key Management (EKM), customers designate and use an external key management service (KMS) to manage data encryption keys (DEKs) in Salesforce. These DEKs encrypt and decrypt data. When not in use, Salesforce stores DEKs in a wrapped (encrypted) state within Shield Platform Encryption's key cache. For any encrypt or decrypt operation, Shield Platform Encryption sends the wrapped DEK to the customer's external key service, which then unwraps it and securely returns it.

Required Editions

Available in both Lightning Experience and Salesforce Classic (not available in all orgs).
Available in: Enterprise, Performance, Unlimited, and Developer Editions. Requires purchasing Salesforce Shield or Shield Platform Encryption, and the External Key Management Service. Data 360 customers must also have the Platform Encryption for Consumption license.
User Permissions Needed
To generate, destroy, export, import, upload, and configure tenant secrets and customer-supplied key material: Manage Encryption Keys

Customers first create a root key in their KMS. This root key initiates a policy that grants the Salesforce regional KMS permission to send requests to the external KMS to generate, wrap, and unwrap the DEK with the root key. As a part of this policy, customers create a DEK in Salesforce paired to the root key. Then Shield Platform Encryption sends a request to the customer’s KMS to generate a DEK. The external KMS wraps the DEK and sends it to Salesforce. We store the only existing copy of this wrapped DEK on the TenantSecret standard object.

When an encryption operation requires an EKM DEK, Shield Platform Encryption checks its encrypted key cache. If the unwrapped DEK isn’t present, Shield Platform Encryption requests the key service to unwrap it, which then securely sends it back. Salesforce adds the unwrapped key to the encrypted key cache for immediate use. For subsequent operations, if the unwrapped DEK is already in the cache, it's used directly for encryption and decryption. The Shield KMS includes enhanced cache controls that encrypt fetched key material with an org-specific AES 256-bit cache encryption key, ensuring secure storage. Salesforce protects the cache encryption key with HSM-protected keys and rotates them during key lifecycle events.

Note
Note On average, the cache is flushed about every 72 hours. Some internal operations flush the cache every 24 hours.
 
Loading
Salesforce Help | Article