vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Hyper Protect Crypto Services with Unified Key Orchestrator enables you to manage keys in various key management systems, including Key Protect on Satellite, from a single pane of glass.

Hyper Protect Crypto Services Key Protect

+3

Satellite,IBM Cloud Databases,Activity Tracker hosted event search



* 2 hours
* 2023-06-27



[Attaching bare metal hosts to a location](https://cloud.ibm.com/docs/satellite?topic=satellite-assign-bare-metal)Attaching bare metal hosts to a location

You can attach bare metal hosts to your Satellite location. After your hosts are attached, you can set up Red Hat OpenShift virtualization in your Satellite location. By using virtualization, you can provision Windows or other virtual machines on your Bare Metal Servers in a managed Red Hat OpenShift space.

Satellite



* 2023-06-05



[Deploying apps to clusters with Satellite Config](https://cloud.ibm.com/docs/satellite?topic=satellite-begin-sat-config-tutorial)Deploying apps to clusters with Satellite Config

Set up a Satellite configuration to automatically deploy your Kubernetes resources to multiple clusters.

Satellite



* 30 minutes
* 2023-04-06



[Connecting Locations with IBM Cloud using Direct Link](https://cloud.ibm.com/docs/satellite?topic=satellite-direct-link-tutorial)Connecting Locations with IBM Cloud using Direct Link

Use a secure IBM Cloud® Direct Link connection for Satellite Link communications between your services running in an IBM Cloud Satellite® Location and IBM Cloud®.

Satellite Kubernetes service

+1

Direct Link



* 2 hours
* 2023-07-05



[Using IBM Cloud Kubernetes Service on classic to host the dl-reverse-proxy](https://cloud.ibm.com/docs/satellite?topic=satellite-dl-iks-classic)Using IBM Cloud Kubernetes Service on classic to host the dl-reverse-proxy

Follow these steps to set up the dl-reverse-proxy for IBM Cloud® Direct Link by using IBM Cloud Kubernetes Service on classic.

Satellite Kubernetes service
* [Task flow](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-db2-pkcs11tutorial-db2-steps)
* [Initialize your Hyper Protect Crypto Services instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-db2-pkcs11tutorial-db2-initialize)

[Set up the Hyper Protect Crypto Services PKCS #11 library](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-db2-pkcs11tutorial-db2-pkcs11-setup)
* [Set up Db2 native encryption](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-db2-pkcs11tutorial-db2-encrypt)
* [Next steps](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-db2-pkcs11tutorial-db2-summary)







 Tutorials on Unified Key Orchestrator 

[Using Hyper Protect Crypto Services with Unified Key Orchestrator to manage keys in Key Protect on Satellite](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-uko-satellitetutorial-uko-satellite)



* [Objectives](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-uko-satellitetutorial-uko-satellite-objectives)
* [Before you begin](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-uko-satellitetutorial-uko-satellite-prerequisites)
key_type A boolean value that determines whether the key material can leave the service. When you set the extractable attribute to false, the service designates the key as a root key that you can use for wrap or unwrap operations. 
 encrypted_nonce Required. The AES-GCM encrypted nonce that ensures that the bits you send as part of a request are exactly the same as what we receive. The nonce validates the key that you are restoring. To learn more, see [Tutorial: Creating and importing encryption keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-import-keystutorial-import-encrypt-nonce). 
 iv Required. The initialization vector (IV) that is generated by the AES-GCM algorithm when you encrypt a nonce. This value is used to decode the key for storage in the Hyper Protect Crypto Services system. To learn more, see [Tutorial: Creating and importing encryption keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-import-keystutorial-import-encrypt-nonce). 



A successful rotation request returns an HTTP 204 No Content response, which indicates that your root key was replaced by the new key material.
6. Optional: Verify that the key was rotated by retrieving details about the key.

curl -X GET 
https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/keys/<key_id>/metadata 
-H 'authorization: Bearer <IAM_token>' 
-H 'bluemix-instance: <instance_ID>'
-H 'accept: application/vnd.ibm.kms.key+json'

Review the lastRotateDate and keyVersion values in the response entity-body to inspect the date and time that your key was last rotated.

You can also list the versions that are available for the key by using the Hyper Protect Crypto Services API.
* [List instance policies](https://cloud.ibm.com/apidocs/hs-cryptogetinstancepolicy).



* Deprecated: [Invoke an action on a key](https://cloud.ibm.com/apidocs/hs-cryptoactiononkey).

This method is originally used for performing actions on a key, such as wrap, unwrap, and rotate. It is now replaced with individual request path for each action.



For more information about the API updates, see [Hyper Protect Crypto Services key management service API reference](https://cloud.ibm.com/apidocs/hs-crypto).





 30 November 2020 

Added: Support for the BIP32 mechanism
: Hyper Protect Crypto Services now supports the Bitcoin Improvement Proposal 0032 (BIP32) standard for hierarchical deterministic wallets to define how to derive private and public keys of a digital wallet. To enable BIP 32, follow the instructions in [Enabling BIP32 deterministic wallets](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-enable-mechanismsenable-BIP32).

Added: TKE activity tracker events
: Hyper Protect Crypto Services now supports the Trusted Key Entry (TKE) events auditing. You can now use IBM Cloud Activity Tracker to monitor TKE activities and analyze failed actions. For more information, see [Auditing events for Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-at-events).





 30 September 2020 

Added: Master key rotation
: You can now rotate your master key on demand by using the IBM Cloud® Trusted Key Entry CLI plug-in so as to meet industry standards and cryptographic best practices. For more information about how it works, see [Master key rotation introduction](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-master-key-rotation-intro).
As the HSM used by Hyper Protect Crypto Services, the IBM 4768 or IBM 4769 crypto card is also certified with Common Criteria EAL4 and FIPS 140-2 Level 4. For more information, see [Security and compliance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-security-and-compliance).
* Can I monitor my service instance?

Yes, you can monitor the status of your service instance through [IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-at-events).
* What is the difference between key management, key orchestration, and key governance?

Key orchestration brings both key management and key governance capabilities into operations within an enterprise:



* Key management is the people, processes, and technology that define how encryption keys exist and operate within an enterprise, including key lifecycle stages, and roles and duties definitions.
* Key governance is the business control that is defined by the security and risk management practices of an enterprise. Key governance ensures encryption key risks are identified, assessed, and addressed by risk mitigation policies and controls, including applicable regulations and compliance requirements.
* Key orchestration is the activities and means that initiate and manage encryption keys through their lifecycle within an enterprise, including automation and integration into reporting and monitoring.



For more information about key management, see [NIST SP 800-57 Part 2 Rev 1 "Recommendation for Key Management: Part 2 – Best Practices for Key Management Organizations"](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt2r1.pdf).
* Does Hyper Protect Crypto Services with Unified Key Orchestrator provide key management, governance, and orchestration at the same time?

Yes. Unified Key Orchestrator provides a simplified means of key management, governance, and orchestration: one place to define, operate, and oversee encryption keys across hybrid multicloud environments.
* Is Unified Key Orchestrator a separate offering?

No. From a technology point of view, Unified Key Orchestrator is a feature of Hyper Protect Crypto Services.
For more information, see [Initializing your service instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-introduce-service).





 Performing cryptographic operations by accessing the cloud HSM 

Hyper Protect Crypto Services provides a set of cryptographic functions that are executed in the cloud HSM. You can perform cryptographic operations such as key generation, data encryption, and signature verification. To do so, access the cloud HSM with either the PKCS #11 API or the Enterprise PKCS #11 over gRPC (GREP11) API.

To ensure the exclusive control on the execution of cryptographic operations, you can enable the second layer of authentication for GREP11 or PKCS #11 API connections with the [certificate manager CLI plug-in](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-cli-plugin-hpcs-cli-plugincert-manager-cli-plugin). By enabling this function, you add an extra layer of access control on top of the Identity and Access Management (IAM) token to the EP11 applications. A mutual TLS connection is established to ensure that only EP11 applications with a valid client certificate can perform EP11 operations. For more information about how to enable the TLS authentication, see [Enabling the second layer of authentication for EP11 connections](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-enable-authentication-ep11).



 Accessing the cloud HSM with the PKCS 11 API 

[Public-Key Cryptography Standards (PKCS) #11](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html) is an industry standard that defines a platform-independent API, called Cryptoki, for devices such as HSMs that hold cryptographic information and perform cryptographic operations. With Hyper Protect Crypto Services, you can use the standard PKCS #11 API to access the cloud HSM with the PKCS #11 library.
The Management Utilities create and store your master key parts on smart cards and never exposes your secrets to the workstation and cloud, thus ensuring the highest level of protection to your secrets.

Hyper Protect Crypto Services can integrate with IBM Cloud data and storage services as well as VMware® vSphere® and VSAN, for providing data-at-rest encryption.

The managed cloud HSM supports the industry-standard cryptographic operations by using the Public-Key Cryptography Standards (PKCS) #11. You don't need to change your existing applications that use PKCS #11 standard to make it run in the Hyper Protect Crypto Services environment. The PKCS #11 library accepts the PKCS #11 API requests from your applications and remotely accesses the cloud HSM to execute the corresponding cryptographic functions, such as digital signing and validation.

Enterprise PKCS #11 over gRPC (GREP11) is also supported by Hyper Protect Crypto Services. The EP11 library provides an interface similar to the industry-standard

[PKCS #11 application programming interface (API)](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html).

With the built-in encryption of Hyper Protect Crypto Services, you can easily build cloud applications with sensitive data. Hyper Protect Crypto Services provides you with complete control of your data and encryption keys, including the master key. The service also helps your business meet regulatory compliance with the technology that provides exclusive controls on the external and privileged user access to data and keys.





 How does Hyper Protect Crypto Services work? 

The following items are a few highlights of the Hyper Protect Crypto Services architecture:



* Applications connect to Hyper Protect Crypto Services through the PKCS #11 API or the GREP11 API.
* Dedicated keystore in Hyper Protect Crypto Services is provided to ensure data isolation and security. Privileged users are locked out for protection against abusive use of system administrator credentials or root user credentials.
(https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-ukofaq-uko-vendor-cloud)
* [How is Unified Key Orchestrator different from EKMF Web?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-ukofaq-uko-ekmf)
* [What multizone regions is Hyper Protect Crypto Services with Unified Key Orchestrator available in?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-ukofaq-uko-mzr)
* [Can I still use Hyper Protect Crypto Services with Unified Key Orchestrator for key management even if Hyper Protect Crypto Services is not available in the IBM Cloud region that my service resides in?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-ukofaq-uko-region)
* [How many keystores can be created for an instance of Hyper Protect Crypto Services with Unified Key Orchestrator?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-ukofaq-uko-keystore-number)



[FAQs: Security and compliance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-security-compliancefaq-security-compliance)



* [How can I manage user access to my service instances? Does IBM have access to my instances?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-security-compliancefaq-hpcs-ibm-access)
* [How does IBM offer a unique and secure process for service initialization (key ceremony)?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-security-compliancefaq-hpcs-user-access)
Hyper Protect Crypto Services key management service API change log 

In this change log you can learn about the latest changes, improvements, and updates for the Hyper Protect Crypto Services key management service API. The change log lists changes that have been made, ordered by the date they were released. Changes to existing API versions are designed to be compatible with existing client applications.



 API versioning 

The latest released version is 22.11.





 February 2023 

The following functions are added:



* [List Keys with sorting](https://cloud.ibm.com/apidocs/hs-crypto::text=values%3A%20length%20%E2%89%A4%20256-,sort,-string) to include lastRotateDate sorting.
* [List Keys with advanced filtering](https://cloud.ibm.com/apidocs/hs-crypto::text=Default%3A%20id-,filter,-string) to including lastRotateDate filtering.
* [Create key with policy overrides](https://cloud.ibm.com/apidocs/hs-cryptocreatekeywithpoliciesoverrides) to enable users with Manager role to create keys with policies in a single call, overriding instance level policies.
* [Disable a key rotation policy](https://cloud.ibm.com/apidocs/hs-crypto::text=policy%2Bjson%22%2C%0A%20%20%20%20%20%20%20%20%22rotation%22%3A%20%7B%0A%20%20%20%20%20%20%20%20%20%20%22-,enabled,-%22%3A%20%3Ctrue%7Cfalse%3E%2C%0A%20%20%20%20%20%20%20%20%20%20%22interval_month) to allow an automatic key rotation policy to be paused temporarily.







 January 2022 

The following methods are added:



* Update the key ring of a key.
A successful restore request returns an HTTP 201 Created response, which indicates that the key was restored to the Active key state and is now available for encrypt and decrypt operations. All attributes and policies that were previously associated with the key are also restored.

You will have access to data associated with the key as soon as the key is restored.
5. Optional: Verify that the key was restored by retrieving details about the key.

curl -X GET "https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/keys/<key_id>/metadata" -H 'authorization: Bearer <IAM_token>' -H 'bluemix-instance: <instance_ID>' -H 'accept: application/vnd.ibm.kms.key+json'

Where the <key_id> is the ID of the key, the <instance_ID> is the name of your instance, and your <IAM_token> is your IAM token.

Review the state field in the response body to verify that the key moved to the Active key state. The following JSON output shows the metadata details for an Active key.

The integer mapping for the Active key state is 1. Key states are based on NIST SP 800-57.

{
"metadata": {
"collectionType": "application/vnd.ibm.kms.key+json",
"collectionTotal": 1
},
"resources": [
{
"type": "application/vnd.ibm.kms.key+json",
"id": "02fd6835-6001-4482-a892-13bd2085f75d",
"name": "...",
"description": "...",
"tags":
"..."
],
"state": 1,
"extractable": false,
* Can I back up my service instance manually?

You need to back up only your master key parts and signature keys for service initialization. Your data in Hyper Protect Crypto Services is backed up automatically by IBM Cloud daily.
* What happens if my service instance fails?

IBM Cloud has automatic in-region failover plan in place. Currently, your data is backed up daily by the service and you don't need to do anything to enable it. For [cross-region data restores](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-ha-dr), you need to open an IBM support ticket so that IBM can restore the service instance for you.
* How can I restore the content from backups?

For cross-region data restores of Standard Plan instances, you can restore your data by using failover crypto units or open an IBM support ticket so that IBM can restore the service instance for you. For more information, see [Restoring your data from another region](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-restore-data).

For the plan with Unified Key Orchestrator, currently you can only open an IBM support ticket so that IBM can restore the service instance.
* What happens if I delete my service instances?

If you delete your service instance, your keys that are managed are not accessible.
* Can I back up the keys before I delete a service instance?

Backing up the keys manually is not supported.
* What happens when I delete a key?

Within 30 days after you delete a key, you can still view the key and restore the key to reverse the deletion. After 90 days, the key is purged and permanently removed from your instance. The data that is associated with the key becomes inaccessible. Before you delete a key, make sure that the key is not actively protecting any resources. For more information, see [Restoring keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-restore-keys).
* What happens if I lose the signature key or the master key parts?
A success message is displayed when the master key rotation is completed. It might take approximately 60 seconds to reencrypt 3000 keys.

Key objects in the in-memory keystore are not automatically rotated after the master key rotation. If PKCS #11 keystores are enabled in your service instance, you need to restart all active PKCS #11 applications to clear the in-memory keystore after the master key rotation is complete. For detailed information, see

[PKCS #11 implementation components](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-pkcs11-introuko-pkcs11-components).

If an error occurs during master key rotation, see [Why can't I rotate master keys by using recovery crypto units](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-master-key-rotation-recovery-crypto-units).





 What's next 



* To find out more about programmatically managing your keys, check out the Hyper Protect Crypto Services [key management service API reference doc](https://cloud.ibm.com/apidocs/hs-crypto) or the [Unified Key Orchestrator API reference doc](https://cloud.ibm.com/apidocs/uko).
* To find out more about encrypting your data by using the cloud HSM function of Hyper Protect Crypto Services, check out the

[PKCS #11 API reference](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-api-ref) and [GREP11 API reference doc](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grep11-api-ref).
* Hyper Protect Crypto Services - it can be used when the original back is encrypted by using the Hyper Protect Crypto Services service.





Tags are automatically copied over from the parent backup.
6. Click Save.
7. The Summary updates automatically with the selections that you made. For example, the plan might be "Every Monday at -5:53 UTC (12:30 AM CDT) starting on 26 March 2022." The Plan status toggle is enabled by default.
8. Click Create to save the new plan. The list of plans is updated in the policy details page. If you want to make any changes, click the pencil icon for that plan. If you want to delete the plan, click the delete icon.







 Estimating your expected usage and costs 

Use the cost estimator to see what your backups might cost based on the rate of expected change in your Block Storage for VPC volumes.



1. After you [create your backup policy and plan](https://cloud.ibm.com/docs/vpc?topic=vpc-create-backup-policy-and-plan&interface=uibackup-policy-create-ui), on the side panel of Backup summary, click Add to estimate.
2. On the Estimate side panel, enter your expected usage to the initial costs. The backup policy is without charge. You pay for the amount of backup storage that is used. Provide the following estimates:



* Number of volumes you want to associate with the backup policy.
* Average amount of data per volume (in GBs). For example, you might associate two volumes with a policy. The first volume has 4 GB of data and the second 20 GB. An average of the two would be 12 GB.
* Number of backups per volume per month. You can take a maximum of 750 backup snapshots per volume.
* Percent of incremental change after the initial backup. For example, 15 percent increase in size for each subsequent backup.



3. When you're finished, click Calculate cost.
* Hyper Protect Crypto Services - it can be used when the original back is encrypted by using the Hyper Protect Crypto Services service.





Tags are automatically copied over from the parent backup.
6. Click Save.
7. The Summary updates automatically with the selections that you made. For example, the plan might be "Every Monday at -5:53 UTC (12:30 AM CDT) starting on 26 March 2022." The Plan status toggle is enabled by default.
8. Click Create to save the new plan. The list of plans is updated in the policy details page. If you want to make any changes, click the pencil icon for that plan. If you want to delete the plan, click the delete icon.







 Estimating your expected usage and costs 

Use the cost estimator to see what your backups might cost based on the rate of expected change in your Block Storage for VPC volumes.



1. After you [create your backup policy and plan](https://cloud.ibm.com/docs/vpc?topic=vpc-create-backup-policy-and-plan&interface=apibackup-policy-create-ui), on the side panel of Backup summary, click Add to estimate.
2. On the Estimate side panel, enter your expected usage to the initial costs. The backup policy is without charge. You pay for the amount of backup storage that is used. Provide the following estimates:



* Number of volumes you want to associate with the backup policy.
* Average amount of data per volume (in GBs). For example, you might associate two volumes with a policy. The first volume has 4 GB of data and the second 20 GB. An average of the two would be 12 GB.
* Number of backups per volume per month. You can take a maximum of 750 backup snapshots per volume.
* Percent of incremental change after the initial backup. For example, 15 percent increase in size for each subsequent backup.



3. When you're finished, click Calculate cost.