vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Server-Side Encryption with Customer-Provided Keys (SSE-C) 

SSE-C is enforced on objects. Requests to read or write objects or their metadata that use customer-managed keys send the required encryption information as headers in the HTTP requests. The syntax is the same as the S3 API, and S3-compatible libraries that support SSE-C work as expected against IBM Cloud® Object Storage.

Any request that uses SSE-C headers must be sent by using SSL. The ETag values in response headers are not the MD5 hash of the object, but a randomly generated 32-byte hexadecimal string.

A typical [PUT object](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-object-operationsobject-operations-put) request can make use of the following headers:



 Header Type Description 

 x-amz-server-side-encryption-customer-algorithm String This header is used to specify the algorithm and key size to use with the encryption key stored in x-amz-server-side-encryption-customer-key header. This value must be set to the string AES256. 
 x-amz-server-side-encryption-customer-key String This header is used to transport the base 64 encoded byte string representation of the AES 256 key used in the server-side encryption process. 
 x-amz-server-side-encryption-customer-key-MD5 String This header is used to transport the base64-encoded 128-bit MD5 digest of the encryption key according to RFC 1321. The object store uses this value to validate the key passes in the x-amz-server-side-encryption-customer-key has not been corrupted during transport and encoding process. The digest must be calculated on the key BEFORE the key is base 64 encoded. 



A [cURL command](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-curl) might look like the following:

curl -v -T $FILE https://$ENDPOINT/$BUCKET 
-H "Authorization: bearer $TOKEN"
Working with Parquet modular encryption 

IBM Analytics Engine Serverless supports Parquet modular encryption, a new addition to the Parquet standard that allows encrypting sensitive columns when writing Parquet files, and decrypting these columns when reading the encrypted files. See [Parquet modular encryption](https://github.com/apache/parquet-format/blob/apache-parquet-format-2.7.0/Encryption.md).

Besides ensuring privacy, Parquet encryption also protects the integrity of stored data. Any tampering with file contents is detected and triggers a reader-side exception.

Key features include:



1. Parquet encryption and decryption is performed in the Spark workers. Therefore, sensitive data and the encryption keys are not visible to the storage.
2. Standard Parquet features, such as encoding, compression, columnar projection and predicate push-down, continue to work as usual on files with Parquet modular encryption format.
3. You can choose one of the two encryption algorithms that are defined in the Parquet specification. Both algorithms support column encryption, however:



* The default algorithm AES-GCM provides full protection against tampering with data and metadata parts in Parquet files.
* The alternative algorithm AES-GCM-CTR supports partial integrity protection of Parquet files. Only metadata parts are protected against tampering, not data parts. An advantage of this algorithm is that it has a lower throughput overhead compared to the AES-GCM algorithm.



4. You can choose which columns to encrypt. Other columns won’t be encrypted, reducing the throughput overhead.
5. Different columns can be encrypted with different keys.
6. By default, the main Parquet metadata module (the file footer) is encrypted to hide the file schema and list of sensitive columns. However, you can choose not to encrypt the file footers in order to enable legacy readers (such as other Spark distributions that don't yet support Parquet encryption) to read the unencrypted columns in the encrypted files.
7.
Securing your data in Qiskit Runtime 

To ensure that you can securely manage your data when you use Qiskit Runtime, it is important to know exactly what data is stored and encrypted and how you can delete any stored data.



  Protecting your sensitive data in Qiskit Runtime 

The data that you store in IBM Cloud is encrypted at rest by using a randomly generated key.





  Deleting your data in Qiskit Runtime 

Deleting a service instance removes all of the content associated with that instance, such as your jobs, results, parameters, and programs. To delete an instance, from the [Instances page](https://cloud.ibm.com/quantum/instances), find the instance you want to remove, click its overflow menu, then click Delete. You will be asked to confirm the deletion.



  Deleting Qiskit Runtime instances 

The Qiskit Runtime data retention policy describes how long your data is stored after you delete the service. The data retention policy is included in the Qiskit Runtime service description, which you can find in the [IBM Cloud Terms](https://www.ibm.com/support/customer/csol/terms/?id=i126-9425&lc=endetail-document).
To display the secret data as decoded, use the --decode option with the secret get command.





 Creating a generic secret with the CLI 

A generic secret stores simple key-value pairs and Code Engine makes no assumptions about the defined key-value pairs nor about the intended use of the secret.

You can create a generic secret with the secret create command in one of the following ways. By default, a generic secret is created when the --format option is not specified.



* Create a secret directly from the command line by using the --from-literal option in KEY=VALUE format. For example,

ibmcloud ce secret create --name myliteralsecret --from-literal "TARGET=My literal secret"
* Create a secret by using the --from-file option to point to a file. By using this option, all the contents of the file become the value for the key-value pair. For this example, use a file that is named secrets.txt, which contains my little secret1.



* The following example uses the --from-file KEY=FILE format with the secret create command:

ibmcloud ce secret create --name mysecretmsg1 --from-file TARGET=secrets.txt
* The following example command uses the --from-file FILE format with the secret create command. In this example, TARGET (no extension) is the name of the file, which is the same as the name of the environment variable that is known to the job.

ibmcloud ce secret create --name mysecretmsg2 --from-file TARGET



* Create a secret by using the --from-env-file option to point to a file that contains one or more lines that match the format KEY=VALUE. Each line from the specified file is added as a key-value pair. Any lines in the specified file that are empty or begin with are ignored. For this example, use a file that is named secrets_multi.txt, which contains the key-value pairs: sec1=mysec1, sec2=mysec2, and sec3=mysec3.
One of: sha256, sha384, sha512.
* DH_GROUP: The Diffie-Hellman group. One of: 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 31.
* ENCRYPTION_ALGORITHM: The encryption algorithm. One of: aes128, aes192, aes256.
* IKE_VERSION: The IKE protocol version. One of: 1, 2.
* --key-lifetime: The key lifetime in seconds. Maximum: 86400, Minimum: 1800. (default: 28800).
* --resource-group-id: ID of the resource group. This ID is mutually exclusive with --resource-group-name.
* --resource-group-name: Name of the resource group. This name is mutually exclusive with --resource-group-id.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is ike-policy-delete 

Delete one or more IKE policies.

ibmcloud is ike-policy-delete (IKE_POLICY1 IKE_POLICY2 ...) [--output JSON] [-f, --force] [-q, --quiet]



 Command options 



* IKE_POLICY1: ID or name of the IKE policy.
* IKE_POLICY2: ID or name of the IKE policy.
* --output: Specify output format, only JSON is supported. One of: JSON.
* --force, -f: Force the operation without confirmation.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is ike-policy-update 

Update an IKE policy.
* UI
* CLI
* API







 Creating block storage volumes with customer-managed encryption 

By default, Block Storage for VPC boot and data volumes are encrypted with IBM-managed encryption. You can also create customer-managed encrypted volumes by using a supported key management service to create or import your customer root key. Your data is protected while in transit and while at rest.



 Before you begin 

To create block storage volumes with customer-managed encryption, you must first provision a key management service and create or import your customer root key (CRK). You must also authorize access between Cloud Block Storage and the key management service. When you complete these prerequisites, you can start creating block storage volumes that use customer-managed encryption.

For more information about prerequisite steps, see [Prerequisites for setting up customer-managed encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-planningbyok-encryption-prereqs).





 Creating customer-managed encryption data volumes in the UI 

This procedure explains how to specify customer-managed encryption when you create a stand-alone block storage volume. You can also specify customer-managed encryption for volumes that are created during instance provisioning. For more information, see [Creating virtual server instances with customer-managed encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-instances-byok).

Follow these steps to specify customer-managed encryption from the UI:



1. In the [IBM Cloud console](https://cloud.ibm.com/login), go to menu icon ![menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) > VPC Infrastructure > Storage > Block storage volumes to view a list of your block storage volumes.
2. Select New volume.
3. Enter the information in Table 1 to define your new block storage volume.
4. Update the fields in the Encryption section (see Table 2). When your changes are complete, click Create Volume.
5.
Securing your data in IBM Cloud for Education Applications Lab 

To ensure that you can securely manage your data when you use IBM Cloud for Education Applications Lab, it is important to know exactly what data is stored and encrypted and how you can delete any stored personal data. Data encryption by using IBM managed keys with IBM Cloud for Education Applications Lab.



  How your data is stored and encrypted in IBM Cloud for Education Applications Lab 

IBM Cloud for Education Applications Lab store data in IBM Cloud Object storage and block storage. Virtual machine images are stored in IBM Cloud Object Storage, and IBM managed key with AES256 is used for encryption. Personal persistent storage is running on IBM VPC Gen2 block storage, IBM managed key with AES256 is used for data encryption, and all data have three replicas in three [zones](https://cloud.ibm.com/docs/overview?topic=overview-locations) in [MZR](https://cloud.ibm.com/docs/overview?topic=overview-locations) to maintain high availability.





  Deleting your data in IBM Cloud for Education Applications Lab 

You can delete virtual machine images through IBM Cloud for Education Applications Lab website (app.education.cloud.ibm.com).

You can delete personal persistent data on persistent storage by following steps:



*  Make an reservation of a virutal machine (VM).
*  Delete data on mounted directory on the reserved VM.





  Deleting IBM Cloud for Education Applications Lab instances 

Include information about whether deleting the service fully erases all data. If deleting the service doesn't remove all personal data, include information about how users can completely delete their data.

Information about how long services keep data after instances are deleted is covered in the service description. Include the following reference for users to find their data retention period.

The servicename data retention policy describes how long your data is stored after you delete the service. The data retention policy is included in the service-name service description, which you can find in the [IBM Cloud Terms and Notices](https://cloud.ibm.com/docs/overview?topic=overview-terms).
Within IBM Cloud Object Storage, DEKs are stored in the service securely, near the resources that they encrypt. When you need to access a bucket, the service checks your user permissions and decrypts the objects within the bucket for you. This encryption model is called provider-managed encryption.

To enable the security benefits of customer-managed encryption, you can add envelope encryption to your DEKs in IBM Cloud Object Storage by integrating with the Key Protect service. With Key Protect, you provision highly secure root keys, which serve as a master keys that you control in the service.

When you create a bucket in IBM Cloud Object Storage, you can configure envelope encryption for the bucket at its creation. This added protection wraps (or encrypts) the DEKs associated with the bucket by using a root key that you manage in Key Protect.

The practice, called key wrapping, uses multiple AES algorithms to protect the privacy and the integrity of your DEKs, so only you control access to their associated data.

Figure 1 shows how Key Protect integrates with IBM Cloud Object Storage to further secure your encryption keys.

Zoom

![The figure shows a contextual view of envelope encryption.](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/key-protect/images/kp-cos-envelope.svg)

Figure 1. Contextual view of envelope encryption.

To learn more about how envelope encryption works in Key Protect, see [Protecting data with envelope encryption](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryption).





 Adding envelope encryption to your storage buckets
By default, file shares are encrypted at rest with IBM-managed encryption.

You can bring your own customer root key (CRK) to the cloud for customer-managed encryption or you can have a key management service (KMS) generate a key for you. You can select the root key when you [create an encrypted file share](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-encryption). For more information, see [Customer-managed encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-aboutvpc-customer-managed-encryption).

After you specified an encryption type for a file share, you can't change it.





 Encryption in transit 

New

You can [establish an encrypted mount connection](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-eit) between the authorized virtual server instance and the storage system by using an IPsec security profile. For file shares based on the dp2 profile, mount targets that are created with a virtual network interface can support the encryption in transit. The mount targets can be for a source or replica share. When you consider choosing this feature, balance your requirements between performance and increased security because encrypting data in transit can decrease data transmission speed.





 File share replication and failover 

You can create replicas of your file shares by setting up a replication relationship between primary file shares in one zone to replica file shares in another zone. Using replication is a good way to recover from incidents at the primary site when data becomes inaccessible or applications fail. [Fail over](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-failover) to the replica share makes it the new, writeable primary share. For more information, see [About file share replication](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-replication).





 Supplemental IDs and Groups for file shares
Understanding business continuity and disaster recovery for Security and Compliance Center 

Disaster recoveryinvolves a set of policies, tools, and procedures for returning a system, an application, or an entire data center to full operation after a catastrophic interruption. It includes procedures for copying and storing an installed system's essential data in a secure location, and for recovering that data to restore normalcy of operation.

In case of failure, a failover design is established to keep your resources running without needing you to act. See [How IBM Cloud ensures high availability and disaster recovery](https://cloud.ibm.com/docs/overview?topic=overview-zero-downtimezero-downtime) to learn more about the high availability and disaster recovery standards in IBM Cloud.



  Responsibilities 

To find out more about responsibility ownership for using IBM Cloud products between IBM and customer, see [Shared responsibilities for IBM Cloud products](https://cloud.ibm.com/docs/overview?topic=overview-shared-responsibilities).





  Disaster recovery strategy 

IBM Cloud has

business continuityplans in place to provide for the recovery of services within hours if a disaster occurs. You are responsible for your data backup and associated recovery of your content.

Security and Compliance Center provides mechanisms to protect your data and restore service functions. Business continuity plans are in place to achieve targeted

recovery point objective(RPO) andrecovery time objective(RTO) for the service. The following table outlines the targets for Security and Compliance Center.



Table 1. RPO and RTO for Security and Compliance Center

 Disaster recovery objective  Target value 

 RPO                          12 hours     
 RTO                          4 hours
Disaster recovery includes tasks such as providing dependencies on disaster recovery sites, provision disaster recovery environments, data and configuration backup, replicating data and configuration to the disaster recovery environment, and failover on disaster events. IBM is responsible for the recovery of Hyper Protect Crypto Services components in case of disaster. You are responsible for the recovery of the workloads that run Hyper Protect Crypto Services and your application data.



Table 5. Responsibilities for disaster recovery

 Task IBM responsibilities Your responsibilities 

 Instance backups Continuously perform in-region and cross-region backups of key resources and perform continuous testing of backups. Back up your master key; validate the backups and restore data when needed. 
 Disaster recovery When an in-region disaster occurs, automatically recover and restart service components. When a regional disaster that affects all available zones occurs, ensure that all data except the master key is replicated to another region. IBM will also make additional crypto units available in a different region and manage routing requests to the new crypto units. When a regional disaster that affects all available zones occurs, load your master key to the new crypto units that IBM provisions in a different region for restoring data. You can also enable and initialize failover crypto units before a disaster occurs, which reduces the downtime. 
 Availability Provide high availability capabilities, such as IBM-owned infrastructure in multizone regions, to meet local access and low latency requirements for each supported region. Use the list of [available regions](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regions) to plan for and create new instances of the service.
Disaster recovery 

Recovering from potential disasters requires planning and preparation.

You are responsible for understanding your configuration, customization, and usage of Watson Assistant. You are also responsible for being ready to re-create an instance of the service and to restore your data.



  Disaster recovery 

Your disaster recovery plan includes knowing, preserving, and being prepared to restore all data that is maintained on IBM Cloud®. See [Backing up and restoring data](https://cloud.ibm.com/docs/assistant-data?topic=assistant-data-backup) for information about how to back up your service instances.
In the case that they run the same workload type (same application), it is likely that application data is stored in a single site.

The storage replication functions onboard the storage subsystems in both production sites perform the data replication (synchronous or asynchronous) to the correspondent SDS solution in the DR-cloud space, where data is kept available for emergency restarts.

Storage replication requires likewise storage on both sites, so the two options on Production Zone1 and Production Zone2 might also use different technologies, each one coupled with the appropriate SDS match.

Disaster recovery tests are completed by cloning the live data and attaching to a temporary on-demand DR test environment to validate the ability to restart operations.

Disaster recovery tests will be run on a new set of on-demand dynamic provisioned compute and storage instances that will be loaded with the restored data.

For an emergency, compute can be provisioned on demand leveraging dynamic provisioning, subject to verification that provisioning time allows to meet the RTO of the applications or can be pre-provisioned and in stand-by mode, eventually.

If your backup data retention timeframe is very short, you might still use the cloud native backup functions. Be aware that when moving the workloads on a new cloud, you need to keep the old workload installed on the previous cloud for the retention period, in case you need to recover an application data.
Understanding business continuity and disaster recovery for projects 

Disaster recovery involves a set of policies, tools, and procedures for returning a system, an application, or an entire data center to full operation after a catastrophic interruption. It includes procedures for copying and storing an installed system's essential data in a secure location, and for recovering that data to restore normalcy of operation.



  Responsibilities 

For more information about your responsibilities when using projects, see [Shared responsibilities for projects](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-responsibilities-projects).



  Disaster recovery strategy 

IBM Cloud has business continuity plans in place to provide for the recovery of services within hours if a disaster occurs. You are responsible for your data backup and associated recovery of your content.

IBM Cloud performs regular electronic backups of project data with Recovery Time Objective (RTO) and Recovery Point Objective (RPO) of hours as documented in the [IBM Cloud Disaster Recovery Plan](https://cloud.ibm.com/docs/overview?topic=overview-zero-downtimedisaster-recovery). Projects don't replicate data outside of a region, except for backup data. When possible, backup data is kept within the data centers of a country but data is always kept within a geography. European data does not leave the EU.



Table 1. RPO and RTO for projects

 Disaster recovery objective  Target Value 

 RPO                          1 hour       
 RTO                          4 hours      









  Locations 

For more information about service availability within regions and data centers, see [Service and infrastructure availability by location](https://cloud.ibm.com/docs/overview?topic=overview-services_region).