Cloud Object Storage
- Release Notes and Announcements
- Announcements
- Product Introduction
- Purchase Guide
- Billing Method
- Billable Items
- Metadata Acceleration Fees
- Data Processing Fees
- Getting Started
- Console Guide
- Bucket Management
- Domain Name Management
- Object Management
- Folder Management
- Monitoring Reports
- Data Processing
- Image Processing
- File Processing
- Media Processing
- Function Service
- Content Moderation
- Automatic Moderation
- Historical data moderation
- Data Processing Workflow
- User Tools
- COSBrowser
- COSCLI (Beta)
- Common Commands
- Online Auxiliary Tools
- Practical Tutorial
- Access Control and Permission Management
- Performance Optimization
- Data Migration
- Data Disaster Recovery and Backup
- Domain Name Management Practice
- Image Processing
- Audio/Video Practices
- Direct Data Upload
- Content Moderation
- Data Verification
- Big Data Practice
- Using COS in the Third-party Applications
- Developer Guide
- Creating Request
- Object
- Uploading Object
- Downloading Object
- Copying Objects
- Deleting Objects
- Data Management
- Lifecycle Management
- Data Disaster Recovery
- Versioning
- Using Versioning
- Cross-Bucket Replication
- Data Security
- Cloud Access Management
- Access Permission Configuration Description
- Access Control Overview
- Access Control Methods
- Access Policy Language
- Using CDN to Accelerate Access
- Batch Operation
- Performing Batch Operation
- Global Acceleration
- Data Workflow
- Data Lake Storage
- Cloud Native Datalake Storage
- Metadata Accelerator
- Big Data Security
- GooseFS
- Key Features
- Deployment Guide
- OPS Guide
- Logging Guide
- Data Processing
- Image Processing
- Media Processing
- Troubleshooting
- Resource Access Error
- API Documentation
- Service APIs
- Bucket APIs
- Basic Operations
- Access Control List (acl)
- Cross-Origin Resource Sharing (cors)
- Bucket Policy (policy)
- Hotlink Protection (referer)
- Static Website (website)
- Intelligent Tiering
- Bucket inventory(inventory)
- Cross-Bucket Replication（replication）
- Log Management(logging)
- Global Acceleration (Accelerate)
- Bucket Encryption (encryption)
- Custom Domain Name (Domain)
- Origin-Pull (Origin)
- Object APIs
- Basic Operations
- Access Control List (acl)
- Multipart Upload
- Batch Operation APIs
- Data Processing APIs
- Image Processing
- Basic Image Processing
- AI-Based Content Recognition
- Queue APIs
- Service Configuration
- Media Processing
- Media Screenshot API
- Media Information API
- Private M3U8 API
- File Processing
- File Transcoding
- Async Processing Job APIs
- Async Processing Queue APIs
- File Processing
- Hash Calculation
- File Decompression
- Multi-File Zipping
- Job and Workflow
- Workflow APIs
- Workflow Instance
- Job APIs
- Media Processing
- Canceling Media Processing Job
- Querying Media Processing Job
- Media Processing Job Callback
- Image Processing
- Submit Image Processing Job
- Canceling Image Processing Job
- Querying Image Processing Job
- Multi-Job Processing
- Submitting Multiple Jobs
- AI-Based Content Recognition
- Submitting Content Recognition Job
- Querying Content Recognition Job
- Content Recognition Job Callback
- Sync Media Processing
- Media Screenshot API
- Template APIs
- Media Processing
- Creating Media Processing Template
- Deleting Media Processing Template
- Querying Media Processing Template
- Updating Media Processing Template
- AI-Based Content Recognition
- Creating AI-Based Content Recognition Template
- Querying AI-Based Content Recognition Template
- Updating AI-Based Content Recognition Template
- Batch Job APIs
- Callback Content
- Appendix
- Content Moderation APIs
- Image Moderation
- Video Moderation
- Audio Moderation
- Text Moderation
- Submitting Virus Detection Job
- SDK Documentation
- Android SDK
- Object Operations
- Remote Disaster Recovery
- Cloud Access Management
- Data Verification
- Image Processing
- C SDK
- Object Operations
- Data Management
- Cloud Access Management
- Content Moderation
- Data Verification
- C++ SDK
- Cross-Region Disaster Recovery
- Data Management
- Cloud Access Management
- Data Verification
- Content Moderation
- .NET(C#) SDK
- Bucket Operations
- Object Operations
- Cross-Region Disaster Recovery
- Cloud Access Management
- Image Processing
- SDK for Flutter
- Object Operations
- Go SDK
- Bucket Operations
- Object Operations
- Cross-Region Disaster Recovery
- Cloud Access Management
- Data Verification
- File Processing
- Image Processing
- iOS SDK
- Object Operations
- Cross-region Disaster Recovery
- Cloud Access Management
- Image Processing
- Content Recognition
- Speech Recognition
- Java SDK
- Object Operations
- Cross-Region Disaster Recovery
- Cloud Access Management
- File Processing
- Media Processing
- AI-Based Content Recognition
- JavaScript SDK
- Object Operations
- File Processing
- Remote disaster-tolerant
- Data Management
- Cloud Access Management
- Data Verification
- Image Processing
- Node.js SDK
- Object Operations
- Remote disaster-tolerant
- Cloud Access Management
- Data Verification
- Image Processing
- PHP SDK
- Object Operations
- Bucket Operations
- Remote disaster-tolerant
- Cloud Access Management
- Image Processing
- Media Processing
- Document Processing
- File Processing
- Job APIs
- Template APIs
- Python SDK
- Object Operations
- Server-Side Encryption
- Cross-Region Disaster Recovery
- Cloud Access Management
- Content Recognition
- React Native SDK
- Object Operations
- Mini Program SDK
- Object Operations
- Remote disaster-tolerant
- Cloud Access Management
- Data Verification
- Content Moderation
- Image Processing
- FAQs
- Bucket Configuration
- Domain Names and CDN
- Object Operations
- Data Processing
- Related Agreements
- Appendices
- Historical version
DocumentationCloud Object StorageSDK DocumentationAndroid SDKObject OperationsServer-Side Encryption
Server-Side Encryption
Last updated: 2024-06-25 10:53:13
Overview
This document describes how to enable server-side encryption when uploading objects. There are three types of keys that can be used for server-side encryption:
COS-managed key
KMS-managed key
Customer-provided key
SDK API Reference
For the parameters and method descriptions of all the APIs in the SDK, please see SDK API Reference.
Using server-side encryption with COS-managed encryption keys (SSE-COS) to protect data
Description
With this method, your master key and data are managed by COS. COS can automatically encrypt your data when written into the IDC and automatically decrypt it when accessed. Currently, COS supports AES-256 encryption using a COS master key pair.
Sample code
PutObjectRequest putObjectRequest = new PutObjectRequest(bucket, cosPath, srcPath);// Configure server-side encryption with COS-managed encryption keys (SSE-COS) to protect dataputObjectRequest.setCOSServerSideEncryption();// Upload a fileCOSXMLUploadTask cosxmlUploadTask = transferManager.upload(putObjectRequest, uploadId);
Note:
Using server-side encryption with KMS-managed encryption keys (SSE-KMS) to protect data
Description
SSE-KMS encryption is server-side encryption using keys managed by KMS, a Tencent Cloud security management service. KMS is designed to generate and protect your keys using third-party-certified hardware security modules (HSM). It allows you to easily create and manage keys for use in multiple applications and services, while meeting regulatory and compliance requirements. For information on how to activate KMS service, see Server-side Encryption Overview.
Sample code
// Server-side encryption keyString customKey = "customer master key (CMK)";String encryptContext = "encryption context";PutObjectRequest putObjectRequest = new PutObjectRequest(bucket, cosPath, srcPath);// Configure server-side encryption with KMS customer master keys (SSE-KMS) to protect datatry {putObjectRequest.setCOSServerSideEncryptionWithKMS(customKey, encryptContext);} catch (CosXmlClientException e) {e.printStackTrace();}// Upload the filesCOSXMLUploadTask cosxmlUploadTask = transferManager.upload(putObjectRequest, uploadId);
Note:
Using server-side encryption with customer-provided encryption keys (SSE-C) to protect data
Description
With this method, the encryption key is provided by the customer. To upload an object, COS will apply AES-256 encryption to the data using the customer-provided encryption key pair.
Note:
This type of encryption requires using HTTPS requests.
You need to provide a 32-byte string as the key, a combination of numbers, letters, and characters, with Chinese characters not supported.
If a file was key-encrypted when uploaded, you need to include the same key in your GET (download) or HEAD (query) request for it to succeed.
Sample code
// Server-side encryption keyString customKey = "Server-side encryption key";PutObjectRequest putObjectRequest = new PutObjectRequest(bucket, cosPath, srcPath);// Configure server-side encryption with customer-provided encryption keys (SSE-C) to protect datatry {putObjectRequest.setCOSServerSideEncryptionWithCustomerKey(customKey);} catch (CosXmlClientException e) {e.printStackTrace();}// Upload the filesCOSXMLUploadTask cosxmlUploadTask = transferManager.upload(putObjectRequest, uploadId);
Note:
Was this page helpful?
You can also Contact Sales or Submit a Ticket for help.
Yes
No