Questions about Power BI security whitepaper

Hi pennyhoho117 
Thanks for using the Microsoft Fabric Community.
For your clarification please verify the below points and feel free to reach out to us if any assistance reuired.

File Encryption on the Gateway Machine:

• During gateway installation, a Recovery Key is provided to generate a strong AES symmetric key.
• This AES key encrypts a local configuration file that stores RSA keys and other sensitive data.
• AES-256 encryption is typically used for securing files, though exact details are not publicly disclosed by Microsoft.

AES Key Generation from the Recovery Key:

• The Recovery Key serves as input for the Key Derivation Function (KDF), which generates the AES key.
• This AES key remains local to the gateway machine and is never transmitted to the Power BI service.

Encryption Workflow:

• Step 1: The browser encrypts the entered credentials using the RSA public key.
• Step 2: The gateway receives the encrypted credentials and decrypts them using the RSA private key (stored locally).
• Step 3: The credentials are then re-encrypted with the AES symmetric key before being sent to Power BI Service.

Why Use Both RSA and AES:

• RSA encryption is ideal for securing small, sensitive data like credentials but is computationally intensive.
• AES encryption is faster and better suited for larger datasets, which is why Power BI Service stores credentials using AES encryption.

Key Transmission & Storage:

• The AES key never leaves the gateway machine, ensuring the Power BI Service has no access to plaintext credentials.
• Credentials are stored in AES-encrypted form in the Power BI Service, enhancing security.

If you found the above information helpful, we kindly request you to give us a Kudos and mark the response as the Accept as solution.

Thank you,
Cheri Srikanth