vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Security <br><br> * [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-security-compliance)<br><br><br> <br><br> * [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-security-compliance)<br><br><br> <br><br> * [App ID](https://cloud.ibm.com/docs/appid?topic=appid-manage-security-compliance)<br><br><br> 
 Logging and monitoring <br><br> * Activity Tracker Event Routing<br> * Security and Compliance Center<br> * [Flow Logs for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-manage-security-compliance)<br><br><br> <br><br> * Activity Tracker Event Routing<br> * Security and Compliance Center<br><br><br> 
 Integration <br><br> * Event Streams<br><br><br> 
 Databases <br><br> * [Hyper Protect DBaaS for MongoDB](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-mongodb?topic=hyper-protect-dbaas-for-mongodb-manage-security-compliance)<br> * [Hyper Protect DBaaS for PostgreSQL](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-postgresql?topic=hyper-protect-dbaas-for-postgresql-manage-security-compliance)<br><br><br> 



For more information, see:



* [Managing security and compliance in IBM Cloud](https://cloud.ibm.com/docs/overview?topic=overview-manage-security-compliance) - provides details on security and compliance within platform services.







 Related controls in IBM Cloud Framework for Financial Services
You can check the certificates at the following sites:



* [IBM 4769-001 Cryptographic Coprocessor Security Module](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4079)
* [IBM 4768 Cryptographic Coprocessor Security Module](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3410)



* Which IBM regions are Hyper Protect Crypto Services available in?

Currently, Hyper Protect Crypto Services is available in Dallas, Sydney, and Frankfurt. For an up-to-date list of supported regions, see [Regions and locations](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regions).
* I have workloads in a data center where Hyper Protect Crypto Services is not available. Can I still subscribe to this service?

Yes. Hyper Protect Crypto Services can be accessed remotely worldwide for key management and cloud HSM capabilities.
* How do I set up a high availability configuration?

It is suggested that you provision at least two crypto units for high availability. In this way, there is always at least one extra crypto unit operating in a crypto unit failure. Hyper Protect Crypto Services is built to provide high availability by default.

For more information, see [High availability and disaster recovery](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-ha-dr).
* Can I back up my service instance manually?

You need to back up only your master key parts and signature keys for service initialization. Your data in Hyper Protect Crypto Services is backed up automatically by IBM Cloud daily.
* What happens if my service instance fails?

IBM Cloud has automatic in-region failover plan in place. Currently, your data is backed up daily by the service and you don't need to do anything to enable it.
For more information about the KMS API, see the [KMS API reference](https://cloud.ibm.com/apidocs/hs-crypto).



* Key lifecycle management

Hyper Protect Crypto Services provides a single-tenant key management service to create, import, rotate, and manage keys with the standardized API. After the encryption keys are deleted, you can be assured that your data is no longer retrievable.
* Encryption for IBM Cloud data and workload services

By integrating with other IBM Cloud services, Hyper Protect Crypto Services offers the capability of bringing your own encryption to the cloud. The service provides double-layer protection for your cloud data by wrapping the encryption keys that are associated with your cloud services.
* Access management and auditing

Hyper Protect Crypto Services integrates with Cloud Identity and Access Management (IAM) to enable your granular control over user access to service resources. For more information, see [Managing user access](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-manage-access).

You can also monitor and audit events and activities of Hyper Protect Crypto Services by using IBM Cloud Activity Tracker. For more information, see [Auditing events for Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-at-events).







 Cloud hardware security module 



* Customer-controlled HSM

With Keep Your Own Key, you can take the ownership of the HSM through assigning your own administrators and loading master keys with Hyper Protect Crypto Services. This ensures your full control of the entire key hierarchy with no access even from IBM Cloud administrators.
* Cryptographic operations

Hyper Protect Crypto Services supports the standard PKCS #11 API and the Enterprise PKCS #11 over gRPC (GREP11) API for cryptographic operations. The operations include generating keys, encrypting and decrypting data, signing data, and verifying signatures. The cryptographic functions are executed in HSMs and can be accessed through APIs to provide hardware-based protection for your applications.
* [List Keys with advanced filtering](https://cloud.ibm.com/apidocs/hs-crypto::text=Default%3A%20id-,filter,-string) to including lastRotateDate filtering.
* [Create key with policy overrides](https://cloud.ibm.com/apidocs/hs-cryptocreatekeywithpoliciesoverrides) to enable users with Manager role to create keys with policies in a single call, overriding instance level policies.
* [Disable a key rotation policy](https://cloud.ibm.com/apidocs/hs-crypto::text=policy%2Bjson%22%2C%0A%20%20%20%20%20%20%20%20%22rotation%22%3A%20%7B%0A%20%20%20%20%20%20%20%20%20%20%22-,enabled,-%22%3A%20%3Ctrue%7Cfalse%3E%2C%0A%20%20%20%20%20%20%20%20%20%20%22interval_month) to allow an automatic key rotation policy to be paused temporarily.



Added: Activity Tracker event names
: Find the latest event names and mapping in [Historical information regarding events](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-at-events&interface=uihistorical-mapping-events).





 19 December 2022 

Added: Managed key rotation support for Unified Key Orchestrator
: You can now manually rotate a managed key in your Hyper Protect Crypto Services with Unified Key Orchestrator instance. Managed key rotation shortens the cryptoperiod of the keys and reduces the probability for a security breach. For more information about how managed key rotation works, see [Managed key rotation](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-managed-key-rotation-intro).
Protecting your data with envelope encryption - Standard Plan 

Envelope encryption is the practice of encrypting data with a

data encryption key (DEK)and then wrapping the DEK with aroot keythat you can fully manage. The root keys in Hyper Protect Crypto Services service instance are also wrapped and protected by the hardware security module (HSM)master key.

With envelope encryption, Hyper Protect Crypto Services protects your at-rest data with advanced encryption and offers the following benefits:



Table 1. Describes the benefits of customer-managed encryption

 Benefit Description 

 Customer-managed encryption keys With the service, you can provision root keys to protect the security of your encrypted data in the cloud. Root keys serve as key-wrapping keys, which help you manage and safeguard the data encryption keys (DEKs) provisioned in IBM Cloud data services. You decide whether to [import your existing root keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-import-root-keys), or have Hyper Protect Crypto Services [generate root keys on your behalf](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-root-keys). 
 Confidentiality and integrity protection Hyper Protect Crypto Services uses the Advanced Encryption Standard (AES) algorithm in Cipher Blocker Chaining (CBC) mode to create and protect keys. When you create keys in the service, Hyper Protect Crypto Services generates them in the Hyper Protect Crypto Services instance and the master key encrypts the keys to ensure only you have the access. 
 Cryptographic shredding of data If your organization detects a security issue, or your application no longer needs a set of data, you can choose to shred the data permanently from the cloud. When you delete a root key that protects other DEKs, you ensure that the keys' associated data can no longer be accessed or decrypted. 
 Delegated user access control By assigning Cloud Identity and Access Management (IAM) roles, Hyper Protect Crypto Services supports a centralized access control system to enable granular access for your keys.
This ensures your full control of the entire key hierarchy with no access even from IBM Cloud administrators.
* Cryptographic operations

Hyper Protect Crypto Services supports the standard PKCS #11 API and the Enterprise PKCS #11 over gRPC (GREP11) API for cryptographic operations. The operations include generating keys, encrypting and decrypting data, signing data, and verifying signatures. The cryptographic functions are executed in HSMs and can be accessed through APIs to provide hardware-based protection for your applications.

In the Hyper Protect Crypto Services with Unified Key Orchestrator plan, currently you can perform the cryptographic operations only through the APIs. For more information about the APIs, see the

[PKCS #11 API reference](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-api-ref) and the [GREP11 API reference](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grep11-api-ref).
* Security certification

The service is built on FIPS 140-2 Level 4-certified hardware, the highest security level that is offered in the industry. The HSM is also certified to meet the Common Criteria Part 3 conformant EAL 4.









 What's next 



* To get an overall tutorial about using Hyper Protect Crypto Services, check out [Getting started with IBM Cloud Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-started).
* To find out more about managing your Unified Key Orchestrator keys and keystores, check out the [Unified Key Orchestrator API reference doc](https://cloud.ibm.com/apidocs/uko).
* To find out more about programmatically managing your KMS keys, check out the [Hyper Protect Crypto Services key management service API reference doc](https://cloud.ibm.com/apidocs/hs-crypto).
* To find out more about the PKCS #11 API, see
* [8 June 2022](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newhs-crypto-8june2022)



* [Added: Post-quantum cryptography support](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newadd-pqc)



* [3 June 2022](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newhs-crypto-3june2022)



* [Added: Hyper Protect Crypto Services Unified Key Orchestrator CLI plug-in](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newadd-uko-cli)



* [1 April 2022](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newhs-crypto-1april2022)



* [Updated: Pricing model of the Hyper Protect Crypto Services standard plan](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newupdate-pricing-model)
* [Updated: Process of ordering smart cards and smart card readers](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newupdate-smartcard-procurement)



* [25 March 2022](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newhs-crypto-25mar2022)



* [Added: Hyper Protect Crypto Services expands into the Toronto region](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newadd-toronto-region)



* [22 March 2022](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newhs-crypto-march2022)
Added: Hyper Protect Crypto Services expands into the São-Paulo region
: You can now create Hyper Protect Crypto Services instances in the São-Paulo (br-sao) region where the infrastructure is based on IBM Cloud Virtual Private Cloud (VPC). For more information, see [Regions and locations](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regions).





 21 January 2022 

Updated: Hyper Protect Crypto Services key management functions
: The Hyper Protect Crypto Services key management service API is updated to version 2.82. The following functions are added:



1. Purge a deleted key: By default, a deleted key becomes purged automatically after 90 days of the deletion. Now you can manually purge a key to permanently remove the key from your instance before 90 days. After a key is deleted, there is a wait period of up to 4 hours before you can perform the action. Make sure that you are assigned the KMS Key Purge role before you purge a key. For more information, see [Purging keys manually](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-purge-keys).
2. Update the key ring of a key: After you create a key, you can move the key to a different key ring. For more information, see [Transferring a key to a different key ring](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-managing-key-ringstransfer-key-key-ring).







 30 July 2021 

Added: Exclusive control on the execution of cryptographic operations
: To ensure the exclusive control on the execution of cryptographic operations, you can use the Hyper Protect Crypto Services certificate manager CLI to enable the second layer of authentication for EP11 (GREP11 or PKCS #11 API) connections. By enabling this function, you enable an extra layer of access control on top of the Identity and Access Management (IAM) token to the EP11 applications. A mutual TLS connection is established to ensure that only EP11 applications with a valid client certificate can perform EP11 operations.
* UI
* API







 Viewing a list of root keys or standard keys 

IBM Cloud® Hyper Protect Crypto Services provides a centralized system to view, manage, and audit your encryption keys. Audit your keys and access restrictions to keys to ensure the security of your resources.

Audit your key configuration regularly:



* Examine when keys were created and determine whether it's time to rotate the key.
* [Monitor API calls to Hyper Protect Crypto Services with Activity Tracker](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-at-events).
* Inspect which users have access to keys and if the level of access is appropriate.



For more information about auditing access to your resources, see [Managing user access](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-access).



 Viewing root keys or standard keys with the console 

If you prefer to inspect the keys in your service by using a graphical interface, you can use the IBM Cloud console.

[After you create or import your existing keys into the service](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-root-keys), complete the following steps to view your keys.



1. [Log in to the IBM Cloud console](https://cloud.ibm.com/login).
2. Go to Menu > Resource list to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Hyper Protect Crypto Services.
4. On the KMS keys page, browse the general characteristics of your keys in the Keys table:



Table 1. Describes the table of keys

 Column Description 

 Name The unique, human-readable name that was assigned to your key. 
 ID A unique key ID that was assigned to your key by the Hyper Protect Crypto Services service. You can use the ID value to make calls to the service with the [Hyper Protect Crypto Services key management service API](https://cloud.ibm.com/apidocs/hs-crypto).
This description is also displayed in the console when you assign access to the service.
6. From the list of services, select Hyper Protect Crypto Services.
7. Select Add to add actions for the role.

The following table lists the suggested custom roles and corresponding actions for your reference:



Table 1. Custom roles and actions corresponding to the Unified Key Orchestrator operations

 Role Description Actions 

 My vault administrator Manages vaults. <br><br> * hs-crypto.managed-keys.read<br> * hs-crypto.managed-keys.list<br> * hs-crypto.target-keystores.read<br> * hs-crypto.target-keystores.list<br> * hs-crypto.key-templates.read<br> * hs-crypto.key-templates.list<br> * hs-crypto.vaults.read<br> * hs-crypto.vaults.list<br> * hs-crypto.vaults.write<br> * hs-crypto.vaults.delete<br> * hs-crypto.uko.initiate-paid-upgrade<br> * hs-crypto.uko.add-paid-keystore<br><br><br> 
 My keystore administrator Manages keystores. <br><br> * hs-crypto.managed-keys.read<br> * hs-crypto.managed-keys.list<br> * hs-crypto.target-keystores.read<br> * hs-crypto.target-keystores.list<br> * hs-crypto.target-keystores.write<br> * hs-crypto.target-keystores.delete<br> * hs-crypto.key-templates.read<br> * hs-crypto.key-templates.list<br> * hs-crypto.vaults.read<br> * hs-crypto.vaults.list<br> * hs-crypto.uko.initiate-paid-upgrade<br> * hs-crypto.uko.add-paid-keystore<br><br><br>
For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-instance-ID). 
 create_root_key Required. Set to true to allow root keys to be created in your Hyper Protect Crypto Services instance. Set to false to prevent root keys from being created in your instance. If this attribute is omitted, true is set as the default value. 
 create_standard_key Required. Set to true to allow standard keys to be created in your Hyper Protect Crypto Services instance. Set to false to prevent standard keys from being created in your instance. If this attribute is omitted, true is set as the default value. 
 import_root_key Required. Set to true to allow root keys to be imported into your Hyper Protect Crypto Services instance. Set to false to prevent root keys from being imported into your instance. If this attribute is omitted, true is set as the default value. 
 import_standard_key Required. Set to true to allow standard keys to be imported into your Hyper Protect Crypto Services instance. Set to false to prevent standard keys from being imported into your instance. If this attribute is omitted, true is set as the default value. 
 enforce_token Required. Set to true to prevent authorized users from importing key material into your Hyper Protect Crypto Services instance without using an import token. Set to false to allow authorized users to import key material into your instance without using an import token. If enforce_token is enabled, it is required that [secure import](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-import-tokens) is enabled for all key import actions. Key import is not available through UI, and you need to perform further actions through the CLI or API. If this attribute is omitted, false is set as the default value. 



A successful request returns an HTTP 204 No Content response, which indicates that your Hyper Protect Crypto Services instance now has enabled. Your Hyper Protect Crypto Services instance can now only allow the creation or importation of keys from the methods that are specified in your request.
3.
Bringing your encryption keys to the cloud - Standard Plan 

Encryption keys contain subsets of information, such as the metadata that helps you identify the key, and the key material that is used to encrypt and decrypt data.

When you use IBM Cloud® Hyper Protect Crypto Services to create keys, the service generates cryptographic key material on your behalf that is rooted in the hardware security modules (HSMs) of your Hyper Protect Crypto Services instance. But depending on your business requirements, you might need to generate key material from your internal solution, and then extend your on-premises key management infrastructure onto the cloud by importing keys into Hyper Protect Crypto Services.



Table 1. Describes the benefits of importing key material

 Benefit Description 

 Keep Your Own Key (KYOK) If you choose to export symmetric keys from your internal key management infrastructure, you can use Hyper Protect Crypto Services to securely bring them to the cloud. The KYOK feature ensures that you own the root trust of your key hierarchy and that no one except you have access to your encryption keys. 
 Secure import of root key material When you export your keys to the cloud, you want assurance that the key material is protected while it's in flight. Mitigate against man-in-the-middle attacks by using an import token to securely import root key material into your Hyper Protect Crypto Services service instance. 





 Planning ahead for importing key material 

Keep the following considerations in mind when you're ready to import root key material to the service.

Review your options for creating key material
: Explore your options for creating 256-bit symmetric encryption keys based on your security needs. For example, you can use your internal key management system, backed by a FIPS-validated, on-premises hardware security module (HSM), to generate key material before you bring keys to the cloud. If you're building a proof of concept, you can also use a cryptography toolkit such as [OpenSSL](https://www.openssl.org/) to generate key material that you can import into Hyper Protect Crypto Services for your testing needs.

Choose an option for importing key material into Hyper Protect Crypto Services
: Choose from two options for importing root keys based on the level of security that is required for your environment or workload.
[Initialize your instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm) by loading a master key from smart cards or from your workstation.
3. [Generate or import your own root key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-root-keys) to your instance of Hyper Protect Crypto Services. When you use Hyper Protect Crypto Services to create a root key, the service generates cryptographic key material that is rooted in cloud-based HSMs. Be sure that the name of your key does not contain any personal information such as your name or location.
4. Grant service access to Hyper Protect Crypto Services. You must be the account owner or an administrator for the instance of Hyper Protect Crypto Services that you're working with. You must also have at least Viewer access for the App ID service.



1. Go to Manage > Access IAM > Authorizations.
2. Create an authorization to allow access to Key Protect.
3. Select the source account.
4. Select App ID as your source service.
5. Select Hyper Protect Crypto Services as your target service.
6. Specify the scope of the access.
7. Assign the Reader role.
8. Click Authorize.



5. Create an instance of the App ID service.



1. Select your Hyper Protect Crypto Services instance.
2. Select the root key that you previously authorized.
3. Click Create.





App ID supports state changes to your key.



 Rotating your keys 

When you [rotate your KEK](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-keys), App ID rewraps the DEKs associated with the rotated key, ensuring your user data is always protected with your up-to-date encryption key.





 Deleting your keys