vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Use cases - Unified Key Orchestrator Plan 

IBM Cloud® Hyper Protect Crypto Services can be used as a key management service to pervasively protect data at rest in the IBM Cloud as well as a cloud HSM for general-purpose cryptographic operations.



 Pervasively protecting data at rest in the cloud 

With the integration in the IBM Cloud Security Architecture, you can use Hyper Protect Crypto Services to encrypt your data at rest for cloud data and storage services in the highest security level with your own keys. The service uses the same key-provider API as Key Protect to provide a consistent envelope encryption and file system encryption approach to adopting IBM Cloud services.

IBM Cloud Hyper Protect Crypto Services supports Keep Your Own Key (KYOK) so that you have more control and authority over your data with encryption keys that you can bring, control, and manage. At the same time, you still maintain the control over the HSM that the encryption key is located in. With Hyper Protect Crypto Services, you fully leverage the proven technology that is co-developed and operated by large enterprises for managing their most sensitive data.

Encryption keys that are generated and protected by Hyper Protect Crypto Services can be used to provide application record-level or field-level encryption to protect data from other insider threats such as from database administrators.



 Data at rest encryption with KYOK 

Keys are protected by customer-managed dedicated HSMs, which means, only you have access to your data. The cryptographic capabilities of Hyper Protect Crypto Services are built on top of a FIPS 140-2 Level 4 Certified Hardware Security Module. You can benefit from the cryptographic capabilities of Hyper Protect Crypto Services for both your new and existing workloads. The IBM Key Protect for IBM Cloud API is integrated for generating and protecting encryption keys.
Overview - Unified Key Orchestrator Plan 

IBM Cloud® Hyper Protect Crypto Services is a dedicated key management service and

Hardware Security Module (HSM)that provides you with the Keep Your Own Key capability for cloud data encryption. Built on FIPS 140-2 Level 4 certified hardware, Hyper Protect Crypto Services provides you with exclusive control of your encryption keys. With Unified Key Orchestrator, you can connect your service instance to keystores in IBM Cloud and third-party cloud providers, back up and manage keys using a unified system, and orchestrate keys across multiple clouds.

Watch the following video to learn how Hyper Protect Crypto Services with Unified Key Orchestrator provides you with exclusive encryption key control and unified key management in the cloud:



 Why IBM Cloud Hyper Protect Crypto Services? 

Data and information security is crucial and essential for IT environments. As more data moves to the cloud, keeping data protected becomes a nontrivial challenge. Built on IBM LinuxONE technology, Hyper Protect Crypto Services helps ensure that only you have access to your keys and data.

A single-tenant key management service with key vaulting that is provided by dedicated customer-controlled HSMs helps you easily create and manage your encryption keys. Alternatively, you can bring your own encryption keys to the cloud. The service uses the same key-provider API as Key Protect, a multi-tenant key management service, to provide a consistent approach to adopting IBM Cloud services.

Hyper Protect Crypto Services offers a dedicated HSM that is controlled by you. IBM Cloud administrators have no access. The service is built on FIPS 140-2 Level 4-certified hardware, the highest offered by any cloud provider in the industry. IBM is the first to provide cloud command-line interface (CLI) for HSM

master keyinitialization to help enable you to take ownership of the cloud HSM. You can also load the master key with the IBM Hyper Protect Crypto Services Management Utilities. The Management Utilities create and store your master key parts on smart cards and never exposes your secrets to the workstation and cloud, thus ensuring the highest level of protection to your secrets.

Hyper Protect Crypto Services can integrate with IBM Cloud data and storage services as well as VMware® vSphere® and VSAN, for providing data-at-rest encryption.
Security <br><br> * [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-cli-plugin-hpcs-cli-plugin)<br><br><br> <br><br> * [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-cli-plugin-hpcs-cli-plugin)<br><br><br> <br><br> * App ID [3]<br><br><br> 
 Logging and monitoring <br><br> * Activity Tracker Event Routing [4]<br> * Security and Compliance Center [5]<br> * Flow Logs for VPC [6]<br><br><br> <br><br> * Activity Tracker Event Routing<br> * Security and Compliance Center<br><br><br> 
 Integration <br><br> * [Event Streams](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-clicli)<br><br><br> 
 Databases <br><br> * [Hyper Protect DBaaS for MongoDB](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-mongodb?topic=hyper-protect-dbaas-for-mongodb-install-dbaas-cli-plugin)<br> * [Hyper Protect DBaaS for PostgreSQL](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-postgresql?topic=hyper-protect-dbaas-for-postgresql-install-dbaas-cli-plugin)<br><br><br> 







 Application programming interfaces 

IBM Cloud offers a rich set of [APIs](https://cloud.ibm.com/docs?tab=api-docs) for working with your resources.
Server-Side Encryption with Hyper Protect Crypto Services 

You can use [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/services/hs-crypto?topic=hs-crypto-overview) to create, add, and manage keys, which you can then associate with your instance of IBM® Cloud Object Storage to encrypt buckets.

This feature is not currently supported in Object Storage for Satellite. [Learn more.](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-about-cos-satellite)



 Before you begin 

Before you plan on using Hyper Protect Crypto Services with Cloud Object Storage buckets, you need:



* An [IBM Cloud™ Platform account](http://cloud.ibm.com/)
* An [instance of IBM Cloud Object Storage](http://cloud.ibm.com/catalog/services/cloud-object-storage) with a standard pricing plan.



You will need to ensure that a service instance is created by using the [IBM Cloud catalog](https://cloud.ibm.com/catalog) and appropriate permissions are granted. This section outlines step-by-step instructions to help you get started.





 Provisioning an instance of Hyper Protect Crypto Services 

Refer to the service-specific product pages for instructions on how to provision and setup appropriate service instances.



* Getting started with [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/services/hs-crypto?topic=hs-crypto-get-started)



Once you have an instance of Hyper Protect Crypto Services, you need to create a root key and note the CRN ([Cloud Resource Name](https://cloud.ibm.com/docs/account?topic=account-crn)) of that key. The CRN is sent in a header during bucket creation.

Before creating the bucket for use with Hyper Protect Crypto Services, review the [relevant guidance around availability and disaster recovery](https://cloud.ibm.com/docs/hs-crypto?hs-crypto-ha-dr).





 Create or add a key in Hyper Protect Crypto Services
[Service architecture - Unified Key Orchestrator Plan](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-architecture-workload-isolationuko-architecture-workload-isolation)



* [Hyper Protect Crypto Services architecture](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-architecture-workload-isolationuko-architecture)
* [Hyper Protect Crypto Services workload isolation](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-architecture-workload-isolationuko-workload-isolation)
* [Service dependencies](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-architecture-workload-isolationuko-service_dependencies)



[Use cases - Unified Key Orchestrator Plan](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-use-casesuko-use-cases)



* [Pervasively protecting data at rest in the cloud](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-use-casesuko-data-at-rest-encryption)
* [Using Unified Key Orchestrator for multicloud key orchestration](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-use-casesuko-use-case)

[Using Hyper Protect Crypto Services as PKCS #11 HSMs](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-use-casesuko-pkcs11_hsm)

[Using Hyper Protect Crypto Services as Enterprise PKCS #11 HSMs](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-use-casesuko-ep11-hsm)
hs-crypto.importtoken.read hs-crypto.import-token.read 
 hs-crypto.importtoken.default hs-crypto.import-token.request 
 hs-crypto.instance.readallowedipport hs-crypto.instance-allowed-ip-port.read 
 hs-crypto.instance.readipwhitelistport hs-crypto.instance-ip-allowlist-port.read 
 hs-crypto.instancepolicies.write hs-crypto.instance-policies.write 
 hs-crypto.instancepolicies.read hs-crypto.instance-policies.read 
 hs-crypto.instancepolicies.default hs-crypto.instance-policies.request 
 hs-crypto.keyrings.create hs-crypto.key-rings.create 
 hs-crypto.keyrings.delete hs-crypto.key-rings.delete 
 hs-crypto.keyrings.list hs-crypto.key-rings.list 
 hs-crypto.keyrings.default hs-crypto.key-rings.request 
 hs-crypto.secrets.defaultalias hs-crypto.secrets-alias.request 
 hs-crypto.secrets.createalias hs-crypto.secrets-alias.create 
 hs-crypto.secrets.deletealias hs-crypto.secrets-alias.delete 
 hs-crypto.secrets.eventack hs-crypto.secrets-event.ack 
 hs-crypto.secrets.listkeyversions hs-crypto.secrets-key-versions.list 
 hs-crypto.secrets.readmetadata hs-crypto.secrets-metadata.read 







 Supported events 



 Key events 

The following table lists the key actions that generate an event:



Table 2. Lifecycle key actions

 Action Description 

 hs-crypto.secrets.create Create a key. 
 hs-crypto.secrets-alias.create Create a key alias. 
 hs-crypto.secrets.default Invalid key request event. 
 hs-crypto.secrets.delete Delete a key.
Cryptographic operations: PKCS 11 API 

IBM Cloud® Hyper Protect Crypto Services provides a set of cryptography functions that are executed in a

Hardware Security Module (HSM)in the cloud. You can perform cryptographic operations by accessing a PKCS #11 library that is written to the PKCS #11 standard. PKCS #11 is a standard that specifies an application programming interface (API), called Cryptoki, for devices that hold cryptographic information and perform cryptographic functions.

For more information about PKCS #11, see

[Introducing PKCS #11](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-intro).



 Installing and configuring PKCS 11 library 

To perform a PKCS #11 API call, you need to first

[install the PKCS #11 library](https://github.com/IBM-Cloud/hpcs-pkcs11/releases), and then

[set up PKCS #11 user types](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-best-practice-pkcs11-access).

The library file names use the naming convention: pkcs11-grep11-<platform>.so.<version>. The platform is either amd64 or s390x and the version is the standard major.minor.build syntax. After you download the library, move the library into a folder that is accessible by your applications. For example, if you are running your application on Linux®, you can move the library to /usr/local/lib, /usr/local/lib64, or /usr/lib.

To access the PKCS #11 API, configure the PKCS #11 library by setting the API endpoint and API key in the grep11client.yaml configuration file. And then, initialize the library. For detailed instructions, see
The multiple crypto units in a service instance are automatically synchronized and load balanced across multiple availability zones. If one availability zone cannot be accessed, the crypto units in a service instance can be used interchangeably.

A crypto unit is a single unit that represents a hardware security module and the corresponding software stack that is dedicated to the hardware security module for cryptography. Encryption keys are generated in the crypto units and stored in the dedicated keystore for you to manage and use through the standard RESTful API. WithHyper Protect Crypto Services, you take the ownership of the crypto units by loading the master key and assigning your own administrators through CLI or the Management Utilities applications. In this way, you have an exclusive control over your encryption keys.

Hyper Protect Crypto Services built on FIPS 140-2 Level 4 HSM supports Enterprise PKCS #11 for cryptographic operations. The functions can be accessed through gRPC API calls.





 What crypto card does Hyper Protect Crypto Services use? 

If you create your instance in [regions](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regions) that are based on Virtual Private Cloud (VPC) infrastructure, Hyper Protect Crypto Services uses the [IBM 4769 crypto card](https://www.ibm.com/security/cryptocards/pciecc4/overview), also referred to as Crypto Express 7S (CEX7S). If you create your instance in other non-VPC regions, Hyper Protect Crypto Services uses the [IBM 4768 crypto card](https://www.ibm.com/security/cryptocards/pciecc3/overview), also referred to as Crypto Express 6S (CEX6S). Both IBM CEX6S and IBM CEX7S are certified at FIPS 140-2 Level 4, the highest level of certification achievable for commercial cryptographic devices. You can check the certificates at the following sites:



* [IBM 4769-001 Cryptographic Coprocessor Security Module](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4079)
IBM Cloud Hyper Protect Crypto Services is a dedicated key management service and cloud Hardware Security Module (HSM) A physical appliance that provides on-demand encryption, key management, and key storage as a managed service. service that provides the following features:



* Keep Your Own Key (KYOK) with the FIPS 140-2 Level 4 certified HSM that ensures your full control of the entire key hierarchy where no IBM Cloud administrators have access to your keys.
* Single-tenant key management system to create, import, rotate, and manage keys with the standardized API.
* Data-at-rest encryption with customer-owned keys with seamless [integration with other IBM Cloud data and storage services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-integrate-services).
* PKCS #11 library and Enterprise PKCS #11 (EP11) library for cryptographic operations, which is enabled by the Hyper Protect Crypto Services HSMs with the highest security level in the cloud.



* What is Unified Key Orchestrator?

Unified Key Orchestrator provides the only cloud native single-point-of-control of encryption keys across hybrid multicloud environments of your enterprise.



* Unified Key Orchestrator enables you with both Keep Your Own Key and Bring Your Own Key capabilities from across hybrid multicloud environments that include on-premises environments.
* Unified Key Orchestrator manages and orchestrates all keys from the multicloud environments on IBM Cloud.



* What is a key management service?

Hyper Protect Crypto Services provides a single-tenant key management service to create, import, rotate, and manage keys. Once the encryption keys are deleted, you can be assured that your data that is protected by these keys is no longer retrievable. The service is built on FIPS 140-2 Level 4 certified HSM, which offers the highest level of protection in the cloud industry. Hyper Protect Crypto Services provides the same [key management service API](https://cloud.ibm.com/apidocs/hs-crypto) as IBM Key Protect for IBM Cloud for you to build your applications or leverage IBM Cloud data and infrastructure services.
* What is Hardware Security Module?
Overview - Standard Plan 

IBM Cloud® Hyper Protect Crypto Services is a dedicated key management service and

Hardware Security Module (HSM)that provides you with the Keep Your Own Key capability for cloud data encryption. Built on FIPS 140-2 Level 4 certified hardware, Hyper Protect Crypto Services provides you with exclusive control of your encryption keys.

Watch the following video to learn how Hyper Protect Crypto Services provides you with exclusive encryption key control and data protection in the cloud:



 Why IBM Cloud Hyper Protect Crypto Services? 

Data and information security is crucial and essential for IT environments. As more data moves to the cloud, keeping data protected becomes a nontrivial challenge. Built on IBM LinuxONE technology, Hyper Protect Crypto Services helps ensure that only you have access to your keys and data. A single-tenant key management service with key vaulting that is provided by dedicated customer-controlled HSMs helps you easily create and manage your encryption keys. Alternatively, you can bring your own encryption keys to the cloud. The service uses the same key-provider API as Key Protect, a multi-tenant key management service, to provide a consistent approach to adopting IBM Cloud services.

Hyper Protect Crypto Services is a dedicated HSM that is controlled by you. IBM Cloud administrators have no access. The service is built on FIPS 140-2 Level 4-certified hardware, the highest offered by any cloud provider in the industry. IBM is the first to provide cloud command-line interface (CLI) for HSM

master keyinitialization to help enable you to take ownership of the cloud HSM. You can also load the master key with the IBM Hyper Protect Crypto Services Management Utilities. The Management Utilities create and store your master key parts on smart cards and never exposes your secrets to the workstation and cloud, thus ensuring the highest level of protection to your secrets.

Hyper Protect Crypto Services can integrate with IBM Cloud data and storage services as well as VMware® vSphere® and VSAN, for providing data-at-rest encryption.

The managed cloud HSM supports the industry-standard cryptographic operations by using the Public-Key Cryptography Standards (PKCS) #11.
With the security and regulatory compliance support, your data is encrypted and privileged access is controlled. Even IBM Cloud administrators have no access to the keys.

With Hyper Protect Crypto Services, you can ensure regulatory compliance and strengthen data security. Your data is protected with encryption keys in a fully managed, dedicated key management system and cloud HSM service that supports Keep Your Own Key. Keep your own keys for cloud data encryption protected by a dedicated cloud HSM. If you are running regulation intensive applications or applications with sensitive data, this solution is right for you.

Key features are as follows:



* Full control of the entire key hierarchy, including the master keys.
* Tamper-proof hardware device for sensitive data.
* Industry-leading security for cloud data and digital assets.
* Reduced data compromise risk because of in-built protection against privileged access threats.
* Regulatory compliance through data encryption and controls on privileged access.
* Keep Your Own Key (KYOK) that ensures your full control of the entire key hierarchy.



* How does Hyper Protect Crypto Services work?

When you use Hyper Protect Crypto Services, you create a service instance with multiple crypto units that reside in different availability zones in a region. The service instance is built on [Secure Service Container (SSC)](https://www.ibm.com/marketplace/secure-service-container), which ensures isolated container runtime environment and provides the enterprise level of security and impregnability. The multiple crypto units in a service instance are automatically synchronized and load balanced across multiple availability zones. If one availability zone cannot be accessed, the crypto units in a service instance can be used interchangeably.

A crypto unit is a single unit that represents a hardware security module and the corresponding software stack that is dedicated to the hardware security module for cryptography. Encryption keys are generated in the crypto units and stored in the dedicated keystore for you to manage and use through the standard RESTful API. WithHyper Protect Crypto Services, you take the ownership of the crypto units by loading the master key and assigning your own administrators through CLI or the Management Utilities applications. In this way, you have an exclusive control over your encryption keys.
region Required. The region abbreviation, such as us-south or au-syd, that represents the geographic area where your Hyper Protect Crypto Services instance resides. For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regionsservice-endpoints). 
 port Required. The port number of the API endpoint. 
 key_ID Required. The unique identifier for the key that you would like to delete. 
 IAM_token Required. Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the cURL request. For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Hyper Protect Crypto Services instance. For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-instance-ID). 
 key_ring_ID Optional. The unique identifier of the key ring that the key belongs to. If unspecified, Hyper Protect Crypto Services searches for the key in every key ring that is associated with the specified instance. Therefore, it is suggested to specify the key ring ID for a more optimized request.<br><br>Note: The key ring ID of keys that are created without an x-kms-key-ring header is default. For more information, see [Managing key rings](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-managing-key-rings). 
 return_preference A header that alters server behavior for POST and DELETE operations. When you set the return_preference variable to return=minimal, the service returns a successful deletion response. When you set the variable to return=representation, the service returns both the key material and the key metadata.
: IBM Cloud Hyper Protect Crypto Services, which now supports three availability zones in a selected region, is a highly available service with automatic features that help keep your applications secure and operational.

You can create Hyper Protect Crypto Services resources in the supported [IBM Cloud regions](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regions), which represent the geographic area where your Hyper Protect Crypto Services requests are handled and processed. Each IBM Cloud region contains [multiple availability zones](https://www.ibm.com/cloud/data-centers/) to meet local access, low latency, and security requirements for the region.

For more information, see [High availability and disaster recovery](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-ha-dr).

Scalability
: The service instance can be scaled out to a maximum of six crypto units to meet your performance requirement. Each crypto unit can crypto-process 5000 keys. In a production environment, it is suggested to select at least two crypto units to enable high availability. By selecting three or more crypto units, these crypto units are distributed among three availability zones in the selected region.

Read [Provisioning the service](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-provision) for more information.





 28 February 2019 

Hyper Protect Crypto Services Beta is available
: Hyper Protect Crypto Services Beta version is released. You can now access the Hyper Protect Crypto Services service through Catalog > Security directly.

As of 5 February 2019, provisioning new Hyper Protect Crypto Services Experimental instances will no longer be possible. Existing instances will have support until the End of Experimental Support Date (5 March 2019).





 31 December 2018 

Added: Integration of Key Protect API
: Key Protect API is now integrated with Hyper Protect Crypto Services to generate and protect your keys. You can call the Key Protect API directly through Hyper Protect Crypto Services.