Media services - customer provided key for storage encryption

Question

Hi,

I'm working on a project where we use Azure Media Services to upload video files (to the AMS's associated Storage account), encode them and deliver them for playback in a web application.
We are using .net for this and the official Microsoft Sdks for the media service (Microsoft.Azure.Management.Media) & blob storage (Azure.Storage.Blobs) operations.

Due to a recent legal change, we are now required to have all the videos stored encrypted using our own encryption keys and key store (unfortunately, azure Key Vault is not good option for this)

After doing some research, it looks like storage encryption with keys managed by customer is supported by AMS, which seems to be a good step in that direction. (source).
Also, it appears that Azure Storage supports customer-provided keys; and that looks like it could solve all our problems. (source 1, source 2).

Is it possible for media services to work with customer-provided keys?
For example, after creating an asset and uploading a video with a customer provided key, is there a way to provide the same key for the encoding job so it would be able to decrypt the input video and encode it somehow? And then encrypt the results again?

If this approach isn't a good option, is there an alternative way to achieve the same results?

Thank a lot!

Answer 1

On review, it sounds like your scenario as described above would probably NOT be supported.

We do have support for encryption in Azure Storage where you can set your own key - and that feature can be used by Azure Media Services v3. That would be my only recommendation for the storage side encryption. The first article you linked to is not going to work, as that is the older v2 API that is deprecated and you should not be using that older method of encryption for content at rest, since it pre-dated the storage account subscription support that is now available.

See the details here for how Storage Service encryption works. https://learn.microsoft.com/en-us/azure/storage/common/storage-service-encryption

AMS can then use that same storage account when you are using the v3 API only, which you said above that you are using the Microsoft.Azure.Management.Media SDK, so that is correct.
https://learn.microsoft.com/en-us/azure/media-services/latest/concept-use-customer-managed-keys-byok#double-encryption

The part that is NOT going to work is your requirement to use your own key store. I don't believe that that is supported in any way by the Azure Storage service. The section of the article here describes the differences between various customer provided key options. https://learn.microsoft.com/en-us/azure/storage/common/storage-service-encryption#about-encryption-key-management

From your description above, it the scenario for using Blob storage operation customer provided keys might be close to what you want - "You can specify a customer-provided key on Blob Storage operations. A client making a read or write request against Blob Storage can include an encryption key on the request for granular control over how blob data is encrypted and decrypted. For more information about customer-provided keys, see Provide an encryption key on a request to Blob Storage."

However, Azure Media Services does not support that option. We require that the storage account customer provided key is in the Azure Key Vault and it cannot be provided for each Asset stored in AMS. It's a single customer key, which matches the first bullet point on that same article location - "You can specify a customer-managed key to use for encrypting and decrypting data in Blob Storage and in Azure Files.1,2 Customer-managed keys must be stored in Azure Key Vault or Azure Key Vault Managed Hardware Security Model (HSM)."

So I don't think this would work for you based on your description above. We would not allow you to provide a custom encryption key per-Asset for the storage blobs of the uploaded source files prior to encoding. We only allow the use of the customer provided Key vault encryption key which then allows us to read the storage blobs in the Assets as "clear" content in the encoder process, prior to writing the content back to the storage account where they are once again encrypted with the customer provided key in the Key Vault.