Creation of a user encryption key

When Connected creates a user, it makes a request to Connected Key Management Server (CMX-KMS) for a user-specific encryption key. Connected stores the encrypted user key on its servers for use in encrypting the user's workspace keys. The following figure illustrates the creation of a user encryption key.

1. Connected sends the encrypted customer key to CMX-KMS and requests an encrypted user key.
2. CMX-KMS requests that the hardware security module (HSM) decrypt the customer key.
3. The HSM decrypts the customer key using the site's master encryption key and returns the decrypted key to CMX-KMS.
4. CMX-KMS creates a user key and encrypts it with the decrypted customer key. It returns the encrypted user key to Connected, which stores it for future use.