vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* [Encrypting your regulated workloads with Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-regulated-workloadsencrypt-regulated-workloads)
* [Regulated workloads use cases](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-regulated-workloadsregulated-workloads-use-cases)
* [Getting started to manage your regulated workloads with Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-regulated-workloadsget-started-regulated-workloads)
* [Reference](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-regulated-workloadsreference-regulated-workloads)







 Integrating IBM Cloud services with Hyper Protect Crypto Services 

[Integrating IBM Cloud services with Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-integrate-servicesintegrate-services)



* [Storage service integrations](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-integrate-servicesstorage-integration)
* [Database service integrations](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-integrate-servicesdatabase-integration)
* [Compute service integrations](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-integrate-servicescompute-integration)
* [Container service integrations](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-integrate-servicescontainer-integration)
* [Ingestion service integrations](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-integrate-servicesIngestion-integrations)
Security and compliance - Unified Key Orchestrator Plan 

IBM Cloud® Hyper Protect Crypto Services has data security strategies in place to meet your security and compliance needs and ensure that your data remains protected in the cloud.



 Security readiness 

Hyper Protect Crypto Services ensures security readiness by adhering to IBM best practices for systems, networking, and secure engineering.

To learn more about security controls across IBM Cloud, see [How do I know that my data is safe](https://cloud.ibm.com/docs/overview?topic=overview-securitysecurity).



 Data encryption 

Hyper Protect Crypto Services offers a dedicated

hardware security module (HSM)to generate key material that you manage and perform [envelope encryption](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-envelope-encryption) operations. Hyper Protect Crypto Services also supports the management of your own HSMmaster keys. Built on FIPS 140-2 Level 4-certified HSMs, Hyper Protect Crypto Services offers the highest security level for cloud-based HSMs and stores cryptographic key material without exposing keys outside of a cryptographic boundary.

Access to the service takes place over HTTPS, and internal Hyper Protect Crypto Services communication uses the Transport Layer Security (TLS) 1.2 protocol to encrypt data in transit.





 Data deletion 

When you delete a key from Hyper Protect Crypto Services, the service marks the key as deleted, and the key moves to the Destroyed state. Keys in this state can no longer decrypt data that is associated with the key. Therefore, before you delete a key, review the data that is associated with the key and ensure that you no longer require access to it. Do not delete a key that is actively protecting data in your production environments.

Within 30 days after you delete a key, you can restore the key to reverse the deletion. For more information, see [Restoring keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-restore-keys).

Note that even if the key is not restored, your data remains in those services in the encrypted form.
const hashBuffer = await crypto.subtle.digest("SHA-256", msgBuffer)

// convert ArrayBuffer to Array
const hashArray = Array.from(new Uint8Array(hashBuffer))

// convert bytes to hex string
const hashHex = hashArray.map(b => ("00" + b.toString(16)).slice(-2)).join("")
return hashHex
}

async function handlePostRequest(event) {
const request = event.request
const body = await request.clone().text()
const hash = await sha256(body)
const cacheUrl = new URL(request.url)

// Store the URL in cache by prepending the body's hash
cacheUrl.pathname = "/posts" + cacheUrl.pathname + hash

// Convert to a GET to be able to cache
const cacheKey = new Request(cacheUrl.toString(), {
headers: request.headers,
method: "GET",
})

const cache = caches.default

//Find the cache key in the cache
let response = await cache.match(cacheKey)

// Otherwise, fetch response to POST request from origin
if (!response) {
response = await fetch(request)
event.waitUntil(cache.put(cacheKey, response.clone()))
}
return response
}

addEventListener("fetch", event => {
try {
const request = event.request
if (request.method.toUpperCase() === "POST")
return event.respondWith(handlePostRequest(event))
return event.respondWith(handleRequest(event))
} catch (e) {
return event.respondWith(new Response("Error thrown " + e.message))
}
})
Show more
"crn": "crn:v1:bluemix:public:hs-crypto:us-south:a/f047b55a3362ac06afad8a3f2f5586ea:12e8c9c2-a162-472d-b7d6-8b9a86b815a6:key:02fd6835-6001-4482-a892-13bd2085f75d",
"imported": false,
"creationDate": "2020-03-12T03:37:32Z",
"createdBy": "...",
"algorithmType": "AES",
"algorithmMetadata": {
"bitLength": "256",
"mode": "CBC_PAD"
},
"algorithmBitSize": 256,
"algorithmMode": "CBC_PAD",
"lastUpdateDate": "2020-03-12T03:37:32Z",
"keyVersion": {
"id": "2291e4ae-a14c-4af9-88f0-27c0cb2739e2",
"creationDate": "2020-03-12T03:37:32Z"
},
"dualAuthDelete": {
"enabled": false
},
"deleted": false
}
]
}

For a detailed description of the response parameters, see the Hyper Protect Crypto Services [REST API reference doc](https://cloud.ibm.com/apidocs/hs-crypto).
3. Optional: Verify that the key was created by running the following call to browse the keys in your Hyper Protect Crypto Services service instance.

curl -X GET 
https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/keys 
-H 'accept: application/vnd.ibm.collection+json'
[HashiCorp Vault](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/devsecops_hashicorp1_orig.png)

Figure 10. HashiCorp Vault



* Name: A name for this tool integration. This name is displayed in the toolchain.
* Server URL: The server URL for your HashiCorp Vault Instance. (for instance https://192.168.0.100:8200)
* Integration URL: The URL that you want to navigate to when you click the HashiCorp Vault Integration tile.
* Secrets Path: The mount path where your secrets are stored in your HashiCorp Vault Instance.
* Authentication Method: The Authentication method for your HashiCorp Vault Instance.
* Role ID: Your team's [AppRole Role ID](https://www.hashicorp.com/blog/authenticating-applications-with-vault-approle).
* Secret ID: Your team's [Secret ID](https://www.hashicorp.com/blog/authenticating-applications-with-vault-approle).



Note: We advise you to use AppRole authentication method as this method can be used to read secret values.







 Evidence Storage 

All raw compliance evidence that belongs to the application is collected in this repository. Use this repository option for evaluation purposes only.

The default behavior of the toolchain is to Create new evidence locker repository that creates a new repository as IBM-hosted Git Repos and Issue Tracking Repository. If you ant to link an existing Evidence Locker for the toolchain, choose Use existing evidence locker repository option and provide it as input to Repository URL field. As noted earlier, the toolchain currently supports linking only to existing Git Repos and Issue Tracking repositories.

However, you must collect and store all the evidence in a Cloud Object Storage bucket that can be configured as described in the following image.

Zoom

!
Introducing cloud HSM - Standard Plan 

IBM Cloud® Hyper Protect Crypto Services consists of a cloud-based, FIPS 140-2 Level 4 certified hardware security module (HSM) that provides standardized APIs to manage encryption keys and perform cryptographic operations.



 What is cloud HSM? 

A hardware security module (HSM) is a physical device that safeguards and manages digital keys for strong authentication and provides crypto-processing. HSMs protect the cryptographic infrastructure by securely managing, storing, and protecting cryptographic keys inside a tamper-resistant device.

Hyper Protect Crypto Services consists of a cloud-based dedicated HSM to manage encryption keys and perform cryptographic operations. The FIPS 140-2 Level 4 certified HSM provides the highest level of security for cryptography in the cloud industry. With the Keep Your Own Key (KYOK) feature, you can take ownership of the cloud HSM, which guarantees that no one, including cloud admins, have access to your cryptographic keys. In this way, you can benefit from the highest level of hardware-based encryption without the need to deploy a real HSM on your workstation or local server.

To use the Hyper Protect Crypto Services cloud HSM to protect your keys and data, first take control of the HSM by loading the

master key. The master key, as the key-wrapping key, owns the root of trust that encrypts the entire hierarchy of encryption keys. For more information, see [Initializing your service instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-introduce-service).





 Performing cryptographic operations by accessing the cloud HSM 

Hyper Protect Crypto Services provides a set of cryptographic functions that are executed in the cloud HSM. You can perform cryptographic operations such as key generation, data encryption, and signature verification. To do so, access the cloud HSM with either the PKCS #11 API or the Enterprise PKCS #11 over gRPC (GREP11) API.
Introducing cloud HSM - Unified Key Orchestrator Plan 

IBM Cloud® Hyper Protect Crypto Services consists of a cloud-based, FIPS 140-2 Level 4 certified hardware security module (HSM) that provides standardized APIs to manage encryption keys and perform cryptographic operations.



 What is cloud HSM? 

A hardware security module (HSM) is a physical device that safeguards and manages digital keys for strong authentication and provides crypto-processing. HSMs protect the cryptographic infrastructure by securely managing, storing, and protecting cryptographic keys inside a tamper-resistant device.

Hyper Protect Crypto Services consists of a cloud-based dedicated HSM to manage encryption keys and perform cryptographic operations. The FIPS 140-2 Level 4 certified HSM provides the highest level of security for cryptography in the cloud industry. With the Keep Your Own Key (KYOK) feature, you can take ownership of the cloud HSM, which guarantees that no one, including cloud admins, have access to your cryptographic keys. In this way, you can benefit from the highest level of hardware-based encryption without the need to deploy a real HSM on your workstation or local server.

To use the Hyper Protect Crypto Services cloud HSM to protect your keys and data, first take control of the HSM by loading the

master key. The master key, as the key-wrapping key, owns the root of trust that encrypts the entire hierarchy of encryption keys. For more information, see [Initializing your service instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-introduce-service).





 Performing cryptographic operations by accessing the cloud HSM 

Hyper Protect Crypto Services provides a set of cryptographic functions that are executed in the cloud HSM. You can perform cryptographic operations such as key generation, data encryption, and signature verification. To do so, access the cloud HSM with either the PKCS #11 API or the Enterprise PKCS #11 over gRPC (GREP11) API.



 Accessing the cloud HSM with the PKCS 11 API
The service provides double-layer protection for your cloud data by wrapping the encryption keys that are associated with your cloud services.
* Access management and auditing

Hyper Protect Crypto Services integrates with Cloud Identity and Access Management (IAM) to enable your granular control over user access to service resources. For more information, see [Managing user access](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-access).

You can also monitor and audit events and activities of Hyper Protect Crypto Services by using IBM Cloud Activity Tracker. For more information, see [Auditing events for Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-at-events).







 Cloud hardware security module 



* Customer-controlled HSM

With Keep Your Own Key, you can take the ownership of the HSM through assigning your own administrators and loading master keys with Hyper Protect Crypto Services. This ensures your full control of the entire key hierarchy with no access even from IBM Cloud administrators.
* Cryptographic operations

Hyper Protect Crypto Services supports the standard PKCS #11 API and the Enterprise PKCS #11 over gRPC (GREP11) API for cryptographic operations. The operations include generating keys, encrypting and decrypting data, signing data, and verifying signatures. The cryptographic functions are executed in HSMs and can be accessed through APIs to provide hardware-based protection for your applications.
* Security certification

The service is built on FIPS 140-2 Level 4-certified hardware, the highest security level that is offered in the industry. The HSM is also certified to meet the Common Criteria Part 3 conformant EAL 4.









 What's next 



* To get an overall tutorial about using Hyper Protect Crypto Services, check out [Getting started with IBM Cloud Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-started).
</Delete>"



The Content-MD5 header needs to be the binary representation of a base64-encoded MD5 hash.

echo -n (XML block) | openssl dgst -md5 -binary | openssl enc -base64







 Start a multipart upload 

curl -X "POST" "https://(endpoint)/(bucket-name)/(object-key)?uploads"
-H "Authorization: bearer (token)"







 Upload a part 

curl -X "PUT" "https://(endpoint)/(bucket-name)/(object-key)?partNumber=(sequential-integer)&uploadId=(upload-id)"
-H "Authorization: bearer (token)"
-H "Content-Type: (content-type)"







 Complete a multipart upload 

curl -X "POST" "https://(endpoint)/(bucket-name)/(object-key)?uploadId=(upload-id)"
-H "Authorization: bearer (token)"
-H "Content-Type: text/plain; charset=utf-8"
-d "<CompleteMultipartUpload>
<Part>
<PartNumber>1</PartNumber>
<ETag>(etag)</ETag>
</Part>
<Part>
<PartNumber>2</PartNumber>
<ETag>(etag)</ETag>
</Part>
</CompleteMultipartUpload>"







 Get incomplete multipart uploads 

curl "https://(endpoint)/(bucket-name)/?uploads"
-H "Authorization: bearer (token)"







 Stop incomplete multipart uploads 

curl -X "DELETE" "https://(endpoint)/(bucket-name)/(object-key)?uploadId"
-H "Authorization: bearer (token)"







 Configure a Static Website
General FAQs 

Read to get answers for general questions about IBM Cloud® Hyper Protect Crypto Services.



 What's IBM Cloud Hyper Protect Crypto Services? 

IBM Cloud Hyper Protect Crypto Services is a dedicated key management service and cloud

Hardware Security Module (HSM)service that provides the following features:



* Keep Your Own Key (KYOK) with the FIPS 140-2 Level 4 certified HSM that ensures your full control of the entire key hierarchy where no IBM Cloud administrators have access to your keys.
* Single-tenant key management system to create, import, rotate, and manage keys with the standardized API.
* Data-at-rest encryption with customer-owned keys with seamless [integration with other IBM Cloud data and storage services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-integrate-services).
* PKCS #11 library and Enterprise PKCS #11 (EP11) library for cryptographic operations, which is enabled by the Hyper Protect Crypto Services HSMs with the highest security level in the cloud.







 What is Unified Key Orchestrator? 

Unified Key Orchestrator provides the only cloud native single-point-of-control of encryption keys across hybrid multicloud environments of your enterprise.



* Unified Key Orchestrator enables you with both Keep Your Own Key and Bring Your Own Key capabilities from across hybrid multicloud environments that include on-premises environments.
* Unified Key Orchestrator manages and orchestrates all keys from the multicloud environments on IBM Cloud.







 What is a key management service? 

Hyper Protect Crypto Services provides a single-tenant key management service to create, import, rotate, and manage keys. Once the encryption keys are deleted, you can be assured that your data that is protected by these keys is no longer retrievable. The service is built on FIPS 140-2 Level 4 certified HSM, which offers the highest level of protection in the cloud industry. Hyper Protect Crypto Services provides the same [key management service API](https://cloud.ibm.com/apidocs/hs-crypto) as IBM Key Protect for IBM Cloud for you to build your applications or leverage IBM Cloud data and infrastructure services.





 What is Hardware Security Module?
A crypto unit is a single unit that represents a hardware security module and the corresponding software stack that is dedicated to the hardware security module for cryptography. Encryption keys are generated in the crypto units and stored in the dedicated keystore for you to manage and use through the standard RESTful API. WithHyper Protect Crypto Services, you take the ownership of the crypto units by loading the master key and assigning your own administrators through CLI or the Management Utilities applications. In this way, you have an exclusive control over your encryption keys.

Hyper Protect Crypto Services built on FIPS 140-2 Level 4 HSM supports Enterprise PKCS #11 for cryptographic operations. The functions can be accessed through gRPC API calls.
* What crypto card does Hyper Protect Crypto Services use?

If you create your instance in [regions](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regions) that are based on Virtual Private Cloud (VPC) infrastructure, Hyper Protect Crypto Services uses the [IBM 4769 crypto card](https://www.ibm.com/security/cryptocards/pciecc4/overview), also referred to as Crypto Express 7S (CEX7S). If you create your instance in other non-VPC regions, Hyper Protect Crypto Services uses the [IBM 4768 crypto card](https://www.ibm.com/security/cryptocards/pciecc3/overview), also referred to as Crypto Express 6S (CEX6S). Both IBM CEX6S and IBM CEX7S are certified at FIPS 140-2 Level 4, the highest level of certification achievable for commercial cryptographic devices. You can check the certificates at the following sites:



* [IBM 4769-001 Cryptographic Coprocessor Security Module](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4079)
* [IBM 4768 Cryptographic Coprocessor Security Module](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3410)
"authExpiration": "YYYY-MM-DDTHH:MM:SSZ"
},
"deleted": true,
"deletionDate": "YYYY-MM-DDTHH:MM:SSZ",
"deletedBy": "...",
"purgeAllowed": true,
"purgeAllowedFrom": "YYYY-MM-DDTHH:MM:SSZ",
"purgeScheduledOn": "YYYY-MM-DDTHH:MM:SSZ"
}
]
}

For a detailed description of the available parameters, see the Hyper Protect Crypto Services [key management service API reference doc](https://cloud.ibm.com/apidocs/hs-crypto).







 What's next 



* To learn more about deleting and purging keys, see [About deleting and purging keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-purge-keys).
* Hyper Protect Crypto Services - IBM Cloud Hyper Protect Crypto Services is a dedicated key management service and hardware security module that enables the user to take the ownership of the hardware security module to fully manage your encryption keys and to perform cryptographic operations. Hyper Protect Crypto Services is built on FIPS 140-2 Level 4-certified hardware. For more information, see [Getting started with IBM Cloud Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-started).
* KMIP service - The Key Management Interoperability Protocol (KMIP) for VMware service uses either the IBM Key Protect service or the Hyper Protect Crypto Services (HPCS) service to create, encrypt, and decrypt encryption keys. The KMIP service interfaces the Key Protect or HPCS service to VMware vSphere.







 Internet repositories and services 

The internet repositories and services are resources that are used by the solution architecture or customer cyber-recovery toolsets, for example:



* Anti-virus virus definitions are used by malware scanning software to find malware and are downloaded from the vendor public repositories.
* Two factor authentication is a security process in which users provide two different authentication factors to verify themselves. The authentication server is provided by a service provider and is publicly connected.







 Related links 



* [What's in an account?](https://cloud.ibm.com/docs/account?topic=account-overview)
* [Best practices for organizing resources and assigning access](https://cloud.ibm.com/docs/account?topic=account-account_setup)
* [Overview of VMware Solutions](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-solution_overview)
* [Veeam on bare metal server introduction](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-veeam-bms-archi-intro)
"ciphertext": "<encrypted_data_key>"
}'

Replace the variables in the example request according to the following table.



Table 1. Describes the variables needed to rewrap keys in Hyper Protect Crypto Services.

 Variable Description 

 region Required. The region abbreviation, such as us-south or eu-de, that represents the geographic area where your Hyper Protect Crypto Services service instance resides. For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regionsservice-endpoints). 
 port Required. The port number of the API endpoint. 
 key_ID Required. The unique identifier for the root key that you used for the initial wrap request. 
 IAM_token Required. Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the cURL request. For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Hyper Protect Crypto Services service instance. For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-instance-ID). 
 key_ring_ID Optional. The unique identifier of the key ring that the key belongs to. If unspecified, Hyper Protect Crypto Services will search for the key in every key ring that is associated with the specified instance. Therefore, it is suggested to specify the key ring ID for a more optimized request.<br><br>Note: The key ring ID of keys that are created without an x-kms-key-ring header is: default. For more information, see [Managing key rings](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-managing-key-rings).