14. Encryption Multi-Tenancy Considerations

VAST Data Platform provides encryption at rest with full support for multi-tenant environments. Encryption is applied at the encryption group level, enabling secure tenant isolation and encryption path (view) isolation.

Encryption Models: IKM vs. EKM

• Encryption is applied per encryption group (tenant or encryption path scope).

• Data reduction (dedup+similarity) operates only within the same encryption group.

• Using separate encryption groups per tenant improves isolation, but reduces cross-tenant data reduction efficiency.

Note: The ‘default’ tenant uses IKM-managed encryption without an external KMS dependency.

External Key Management (EKM)

EKM enables external control of encryption keys, in which the EKM manages the key lifecycle for a VAST cluster.

• Single EKM configured per cluster (see roadmap below).

• Connectivity to the EKM via the management network (see roadmap below).

• EKM Setup and Management of keys is performed by Cluster Admin only.

Key Handling Model

• VAST does not contact the EKM for every encrypt/decrypt operation

• DEKs (Data Encryption Keys) are retrieved during lifecycle events, such as Service startup and Leader election/failover

• DEKs are then used in-memory on the data path, where the correct key is selected using the key ID stored in the data header

• The EKM must respond within ~5 seconds before timeout → operation fails

Reference: Enabling EKM encryption

Encryption Groups

Encryption groups are part of the cluster security boundary. To use encryption with an EKM for multiple tenants, an encryption group must be assigned at tenant creation or encryption path creation. Multiple tenants can share the same encryption group. The group cannot be changed after the tenant is created.

• An encryption group defines the key (DEK) scope, which is assigned to data paths (tenant/views).

• Encryption groups are managed only by Cluster Admin.

• Use at least one encryption group per tenant for best isolation between tenants - required for supporting secure erase operations.

Encryption Group is assigned as part of the tenant creation, as shown in the figure below (Web UI):

Reference: Managing encryption groups and keys

Encrypted Paths

• Encryption can be applied at the path/view level.

• Each encrypted path is associated with a specific encryption group (DEK).

• Encrypted paths can NOT be created/managed at the tenant level (Tenant Admin).

• After the Cluster admin creates the encryption path for the tenant, the Tenant admin can create a view for the path, which is then associated with the path.

• The path location and tenant association cannot be changed after creation.

• The DEK for a group is created when Encryption path is created.

Creating encryption path:

• Web UI: Element Store → Encryption Path → ‘Create Encryption Paths.’

• API: encryptedpath create --name epath1 --path /epath1 --tenant-id 2

Reference: Managing encrypted paths

Enabling Encryption

New Cluster

• Encryption is configured during cluster deployment.

• The cluster is initialized with:

  • IKM (default), or

  • EKM (external KMS integration)

• This determines how encryption groups obtain and manage keys.

Existing Cluster

• Encryption can be enabled after installation.

• Requires:

  • Configuring key management (IKM or EKM).

  • Creating encryption groups.

  • Assigning encrypted paths to those groups.

References:

• Enabling encryption after installation

• Enabling encryption with internal key management

Keys Management Operations

Note: Key management operations are restricted to the Cluster Admin - not available to tenant users.

Reference: Managing encryption groups and keys

Future Enhancements (Roadmap)

• Support for multiple EKMs per cluster (per-tenant KMS).

• Support for EKM connectivity via customer/data network.

• Expected in VAST 5.6.x or later.