vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Introducing service instance initialization approaches - Unified Key Orchestrator Plan 

Depending on your business needs and security requirements, Hyper Protect Crypto Services provides you with the following three approaches to initializing your service instance.



* [Initializing service instances by using smart cards and the Hyper Protect Crypto Services Management Utilities](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-initialize-instance-modeuko-instance-initialization-management-utilities)
* [Initializing service instances by using recovery crypto units](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-initialize-instance-modeuko-instance-initialization-recovery-crypto-unit)
* [Initializing service instances by using key part files](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-initialize-instance-modeuko-instance-initialization-key-files)



The following table compares the three approaches:



Table 1. Comparing three approaches to initializing service instances

 Approaches Tool Master key storage Master key backup Master key rotation 

 Using smart cards and the Hyper Protect Crypto Services Management Utilities The Management Utilities The master key is composed of two or three master key parts that are stored on smart cards. You are responsible for backing up the master key using smart cards. You need to prepare new master key parts on your smart card before you can rotate the master key for your service instance. 
 Using recovery crypto units IBM Cloud TKE CLI plug-in The master key is automatically generated and stored within the recovery crypto units of your service instance. The master key is automatically backed up in recovery crypto units. You can recover your master key from the backups if the master key is lost or destroyed. You don't need to prepare a new master key for the rotation. The new master key is automatically generated in a recovery crypto unit and then propagated to the operational crypto units and other recovery crypto units. 
 Using key part files IBM Cloud TKE CLI plug-in The master key is composed of two or three master key parts that are stored on your local workstation files.
{signature} The hash created using the secret key, location, and date ffe2b6e18f9dcc41f593f4dbb39882a6bb4d26a73a04326e62a8d344e07c1a3e 
 {timestamp} The formatted date and time of your request 20180614T001804Z 







 Upload an object 

A PUT given a path to an object uploads the request body as an object. All objects uploaded in a single thread should be smaller than 500 MB to minimize the risk of network disruptions. (objects that are [uploaded in multiple parts](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-large-objects) can be as large as 10 TB).

Personally Identifiable Information (PII): When naming buckets or objects, do not use any information that can identify any user (natural person) by name, location, or any other means.

Not all operations are supported in Satellite environments. For details, see [supported Satellite APIs](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-apis-cos-satellite)

It is possible to stream objects as large as 5 GB using a single PUT request. Multipart uploads are more reliable and can upload more efficiently by using multiple threads to upload parts in parallel. Uploading larger objects in a single PUT request results in the performance limitations of a single thread, and in the event of any failures single-threaded uploads will need to be retried in their entirety (whereas with MPU only the specific part(s) that failed need to be retried). The precise throughput that can be achieved by a single thread varies depending on the network bandwidth from the client to the IBM Cloud endpoint, the rate of packet loss (if any) on that connection, the use of HTTP vs HTTPS, the specific ciphers used in the connection and specific TCP connection parameters (such as window size), as well as other factors.
The device now appears as an encrypted volume:

 blkid | grep LUKS
/dev/mapper/3600a0980383034685624466470446564: UUID="46301dd4-035a-4649-9d56-ec970ceebe01" TYPE="crypto_LUKS"



5. Open the volume, and create a mapping.

 cryptsetup luksOpen /dev/mapper/3600a0980383034685624466470446564 cryptData
6. Enter the passphrase.
7. Verify the mapping, and view status of the encrypted volume.

 cryptsetup -v status cryptData
/dev/mapper/cryptData is active.
type: LUKS1
cipher: aes-cbc-essiv:sha256
keysize: 256 bits
device: /dev/mapper/3600a0980383034685624466470446564
offset: 4096 sectors
size: 41938944 sectors
mode: read/write
Command successful
8. Write random data to /dev/mapper/cryptData on the encrypted device. This action ensures that outside world sees this as random data, which means it is protected against disclosure of usage patterns. This step can take a while.

 shred -v -n1 /dev/mapper/cryptData
9. Format the volume.

 mkfs.ext4 /dev/mapper/cryptData
10. Mount the volume.



 mkdir /cryptData

 mount /dev/mapper/cryptData /cryptData

 df -H /cryptData



 Unmounting and closing the encrypted volume securely 

 umount /cryptData
 cryptsetup luksClose cryptData





 Remounting and mounting an existing LUKS encrypted partition
* [31 August 2020](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newhs-crypto-august2020)



* [Added: Support for import tokens to securely upload encryption keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newadded-import-tokens)



* [31 July 2020](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newhs-crypto-july2020)



* [Added: Hyper Protect Crypto Services aligns the key management functions with Key Protect](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newadded-key-protect-concurrency)
* [Added: Hyper Protect Crypto Services expands into the Washington DC region](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newadded-wdc-region)



* [30 June 2020](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newhs-crypto-june2020)



* [Added: Support for quorum authentication](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newadded-quorum-authentication-202006)



* [30 April 2020](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newhs-crypto-april2020)



* [Added: Hyper Protect Crypto Services adds support for EP11 private endpoints](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newadded-private-endpoints-202004)
For more information about gRPC, see [the gRPC documentation](https://grpc.io/docs/guides/index.html).





 Enterprise PKCS 11 over gRPC 

IBM Cloud® Hyper Protect Crypto Services provides a set of the Enterprise PKCS #11 (EP11) over [gRPC](https://grpc.io) API calls (also referred to as GREP11), with which all the Crypto functions are executed in a cloud HSM. EP11 over gRPC is a stateless interface for cryptographic operations on cloud. For more information about the GREP11 API, see [Introducing EP11 over gRPC](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grep11-intro) and [GREP11 API reference](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grep11-api-ref).
[Using IBM Db2 default encryption with Hyper Protect Crypto Services PKCS #11](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-db2-pkcs11).







 Protecting data in transit with TLS/SSL offloading 

Transport Layer Security (TLS) and Secure Sockets Layer (SSL) are cryptographic protocols that are designed to provide communication security over a computer network. The TLS/SSL protocol aims primarily to provide privacy and data integrity between two or more communicating computer applications.

In the context of web servers, the TLS/SSL protocol allows a website to establish the identity. Users of the website can be sure that no one else is masquerading as the website. It is done through a public-private key pair.

Hyper Protect Crypto Services provides a way to offload the cryptographic operations that are done during the TLS handshake to establish a secure connection to the web server, while it keeps the TLS/SSL private key securely stored in the dedicated HSM. In this way, you have control over your TLS/SSL keys and processing. As a result, security is improved and reputational risk is decreased.

TLS/SSL offloading to the Hyper Protect Crypto Services HSM enables data in transit protection for web, API, and mobile transactions by using the standard PKCS #11 API. With Hyper Protect Crypto Services, you can integrate TLS/SSL offloading with other cloud proxies.

For a tutorial on how to offload the SSL workload to a load balancer such as NGINX while managing keys by using Hyper Protect Crypto Services, see [Using IBM Cloud Hyper Protect Crypto Services to offload NGINX TLS](https://developer.ibm.com/components/ibmz/tutorials/use-hyper-protect-crypto-services-to-offload-nginx-tls/).

Zoom

!
If you are concerned on data security and compliance in the cloud, you are able to maintain complete control over data encryption and

signature keysin a cloud consumable HSM. The HSM is backed by industry-leading security for cloud data and digital assets. With the security and regulatory compliance support, your data is encrypted and privileged access is controlled. Even IBM Cloud administrators have no access to the keys.

With Hyper Protect Crypto Services, you can ensure regulatory compliance and strengthen data security. Your data is protected with encryption keys in a fully managed, dedicated key management system and cloud HSM service that supports Keep Your Own Key. Keep your own keys for cloud data encryption protected by a dedicated cloud HSM. If you are running regulation intensive applications or applications with sensitive data, this solution is right for you.

Key features are as follows:



* Full control of the entire key hierarchy, including the master keys.
* Tamper-proof hardware device for sensitive data.
* Industry-leading security for cloud data and digital assets.
* Reduced data compromise risk because of in-built protection against privileged access threats.
* Regulatory compliance through data encryption and controls on privileged access.
* Keep Your Own Key (KYOK) that ensures your full control of the entire key hierarchy.







 How does Hyper Protect Crypto Services work? 

When you use Hyper Protect Crypto Services, you create a service instance with multiple crypto units that reside in different availability zones in a region. The service instance is built on [Secure Service Container (SSC)](https://www.ibm.com/marketplace/secure-service-container), which ensures isolated container runtime environment and provides the enterprise level of security and impregnability. The multiple crypto units in a service instance are automatically synchronized and load balanced across multiple availability zones. If one availability zone cannot be accessed, the crypto units in a service instance can be used interchangeably.

A crypto unit is a single unit that represents a hardware security module and the corresponding software stack that is dedicated to the hardware security module for cryptography. Encryption keys are generated in the crypto units and stored in the dedicated keystore for you to manage and use through the standard RESTful API.
Under Service, select Hyper Protect Crypto Services and click Next.
6. Under Resources, select resources that you want to assign access to and click Next.



* If you want to assign the user access to all the Hyper Protect Crypto Services instances under your account, select All resources.
* If you want to assign the user access to part of the Hyper Protect Crypto Services resources under you account, select Specific resources and add the corresponding conditions based on your needs. For example, select the Service Instance ID and specify the instance from the list.



7. Under Roles and actions, choose a combination of platform and service access roles to assign access for the user and click Next.



* Check the box for at least the Viewer role under Platform access. For more information about the IAM platform roles, see [Platform access roles](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-manage-accessuko-platform-mgmt-roles).
* Check the box for the corresponding custom role that you set up in [Step 1](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-role-best-practicesuko-step1-create-custom-roles-uko) based on your needs.



If you don't have any custom roles, you can select the existing IAM roles that cover the actions that you want to assign to the user. You can view the specific actions that correspond to the role by clicking the number.
8. (Optional) Under Conditions (optional), click Review to check the access policy.
9. After confirmation, click Add > Assign.







 What's next 



* To find out how to grant access to vaults, see [Granting access to vaults](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grant-access-vaults).
* UI
* API







 Managing key rings 

You can use Hyper Protect Crypto Services to create a group of keys for a target group of users that require the same Cloud Identity and Access Management (IAM) access permissions.

As an account admin, you can bundle the keys in your Hyper Protect Crypto Services instance into groups called key rings. A key ring is a collection of keys in your service instance that require the same IAM access permissions. For example, if you have a group of team members who need a particular type of access to a specific group of keys, you can create a key ring for those keys and assign the appropriate IAM access policy to the target user group. The users that are assigned access to the key ring can create and manage the resources that exist within the key ring.

Key rings are also useful in cases where it is important for one business unit to have access to a set of keys that another business unit cannot have. An account admin can create key rings for each business unit and [assign the appropriate level of access](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-managing-key-ringsgrant-access-key-ring) to the appropriate users. In the case where the account admin would like to delegate platform management of a specific key ring to someone else, they can assign a user a [platform administrator role at the key ring level](https://cloud.ibm.com/docs/account?topic=account-userrolesplatformroles). The sub administrator will then be able to manage the key ring and grant access to the appropriate users.

You can grant access to key rings within a Hyper Protect Crypto Services instance by using the IBM Cloud console, IAM API, or IAM CLI.

Before you create a key ring for your Hyper Protect Crypto Services instance, keep in mind the following considerations:



* Every Hyper Protect Crypto Services instance comes with a default key ring.

Each newly created Hyper Protect Crypto Services instance comes with a generated key ring with an ID of default. All keys that are not associated with a specified key ring exist within the default key ring.
* Key rings can hold root keys and standard keys, but not EP11 keys.
However, this role does not have permissions to manage EP11 keystores.



1. In the IBM Cloud console, go to Manage > Access (IAM), and select Roles.
2. Click Create.
3. Enter a name for your role; for example, key operator. This name must be unique within the account. Users see this role name in the console when they assign access to the service.
4. Enter an ID for the role. This ID is used in the CRN, which is used when you assign access by using the API. The role ID must begin with a capital letter and use alphanumeric characters only; for example, KeyOperator
5. Optional: Enter a succinct and helpful description that helps the users who are assigning access know what level of access this role assignment gives a user. This description also shows in the console when a user assigns access to the service.
6. From the list of services, select Hyper Protect Crypto Services.
7. Select Add for the following actions:



* hs-crypto.crypto.decrypt
* hs-crypto.crypto.derivekey
* hs-crypto.crypto.digest
* hs-crypto.crypto.digestkey
* hs-crypto.crypto.encrypt
* hs-crypto.crypto.generatekey
* hs-crypto.crypto.generatekeypair
* hs-crypto.crypto.generaterandom
* hs-crypto.crypto.getattributevalue
* hs-crypto.crypto.getmechanisminfo
* hs-crypto.crypto.getmechanismlist
* hs-crypto.crypto.rewrapkeyblob
* hs-crypto.crypto.setattributevalue
* hs-crypto.crypto.sign
* hs-crypto.crypto.unwrapkey
* hs-crypto.crypto.verify
* hs-crypto.crypto.wrapkey
* hs-crypto.ep11.use
If you want to encrypt the volumes used by the ODF system pods, select Enable cluster encryption.
14. If you want to enable encryption on the OSD volumes (app storage), select Enable volume encryption.



1. In the Instance name field, enter the name of your Hyper Protect Crypto Services or Key Protect instance. For example: Hyper-Protect-Crypto-Services-eugb.
2. In the Instance ID field, enter your Hyper Protect Crypto Services or Key Protect instance ID. For example: d11a1a43-aa0a-40a3-aaa9-5aaa63147aaa.
3. In the Secret name field, enter the name of the secret that you created using your Hyper Protect Crypto Services or Key Protect credentials. For example: ibm-hpcs-secret.
4. In the Base URL field, enter the public endpoint of your Hyper Protect Crypto Services or Key Protect instance. For example: https://api.eu-gb.hs-crypto.cloud.ibm.com:8389.
5. In the Token URL field, enter https://iam.cloud.ibm.com/identity/token.









 Creating your storage cluster 

To deploy ODF in your classic cluster, you can create a custom resource definition to specify your storage device details.

If you want to use an IBM Cloud Object Storage service instance as your default backing store, make sure that you [created the service instance](https://cloud.ibm.com/docs/openshift?topic=openshift-deploy-odf-classicodf-create-cos-classic), and created the Kubernetes secret in your cluster. When you create the ODF CRD in your cluster, ODF looks for a secret named ibm-cloud-cos-creds to set up the default backing store by using your Object Storage HMAC credentials.



1. Create a custom resource called OcsCluster.
* [Rewrapping keys by using the API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rewrap-keysrewrap-key-api)



[Rotating root keys based on the rotation policy](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-rotation-policyset-rotation-policy)



* [Managing rotation policies in the console](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-rotation-policymanage-policies-gui)
* [Managing rotation policies with the API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-rotation-policymanage-rotation-policies-api)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-rotation-policyset-rotation-policy-next)



[Rotating root keys manually](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-keysrotate-keys)



* [Rotating root keys in the console](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-keysrotate-root-key-gui)
* [Rotating root keys with the API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-keysrotate-root-key-api)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-keysrotate-key-next)



[Viewing root key versions](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-key-versionsview-key-versions)
Check that Hyper Protect Crypto Services has failover units in at least 2 different regions that are Financial Services Validated SI-12(0) The rule was removed. 
 Check whether App ID customer-provided email service is used CM-6(a) The rule was removed. 
 Check whether Container Registry image pushes and pulls take place only over private endpoints SA-3(a) and SA-3(d) The rule was removed. 
 Check whether App ID email verification is enabled for Cloud Directory users CM-6(a) The rule was removed. 
 Check whether Container Registry Vulnerability Advisor scans for critical or high vulnerabilities in the system at least every # day(s) CM-3(2)(0), CM-4(0), CM-4(1)(0), CM-7(1)(a), RA-5(c), RA-5(d), SA-3(a), SA-3(d), SA-8(0), SA-10(e), SA-15(a), SI-2(b), SI-2(c) and SI-2(d) The rule was added. 
 Check whether Cloud Object Storage bucket resiliency is set to cross region CP-6(1)(0), CP-10(0), CP-7(a), CP-7(b), CP-7(c), CP-7(1)(0), CP-9(b), CP-9(d), and SC-6(0)<br><br>CP-6(a), CP-6(b)CP-10(0) The rule was added.<br><br>The rule was updated. 
 Check whether any Cloud Object Storage buckets used by Activity Tracker Event Routing are configured as cross-region AU-9(2)(0), CP-6(a), CP6(b), CP-6(1)(0), CP-7(a), CP-7(b), CP-7(c), CP-7(1)(0), CP-9(b), CP-9(d), CP-10(0), and SC-6(0) The rule was removed.
For more information, see [Post-quantum cryptography support in GREP11](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grep11-introgrep11-support-post-quantum) and

[Post-quantum cryptography support in PKCS #11](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-introgrep11-support-post-quantum).





 3 June 2022 

Added: Hyper Protect Crypto Services Unified Key Orchestrator CLI plug-in
: With the command-line interface (CLI) support for Hyper Protect Crypto Services with the Unified Key Orchestrator plan, you can now manage vaults, keystores, and keys by using CLI commands. For more information about these commands, see [Unified Key Orchestrator CLI plug-in reference](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-cli-plugin-hpcs-cli-pluginuko-cli-plugin).





 1 April 2022 

Updated: Pricing model of the Hyper Protect Crypto Services standard plan
: The pricing model of the Hyper Protect Crypto Services standard plan is now changed from monthly billing to hourly billing with each crypto unit charged $2.13 USD per hour.

The first five keystores, including KMS key rings and EP11 keystores, are free of charge. Each additional key ring or EP11 keystore is charged with a tiered pricing starting at $225 USD per month. For keystores that are created or connected less than a month, the cost is prorated based on actual days within the month.

For more information, see the [pricing plan](https://cloud.ibm.com/catalog/services/hyper-protect-crypto-services). A [billing example](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-pricingfaq-how-charge-hpcs) is also available for your reference.

Updated: Process of ordering smart cards and smart card readers
Creating and importing encryption keys 

Learn how to create, encrypt, and bring your encryption keys to the cloud by using Hyper Protect Crypto Services.



 Objectives 

This tutorial walks you through creating and securely importing encryption keys into the Hyper Protect Crypto Services service. It's intended for users who are new to the key management function of Hyper Protect Crypto Services, but who might have some familiarity with key management systems. The following steps need to take about 20 minutes to complete.



* Setting up the key management service API
* Preparing your Hyper Protect Crypto Services service instance to begin importing keys
* Creating and encrypting keys using the OpenSSL cryptography toolkit
* Importing an encrypted key to your Hyper Protect Crypto Services service instance



This tutorial won't incur any charges to your IBM Cloud account.





 Task flow 

The following flow chart gives you an overview on how to create and import encryption keys. You can click each step on the chart to view details of the step.

Zoom

![Click each step to get more details on the flow](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/hs-crypto/images/create-import-keys.svg)

Task flow of creating and importing an encryption key


[1. Create an import token](/docs/hs-crypto?topic=hs-crypto-tutorial-import-keystutorial-import-create-token)

[2. Retrieve the import token](/docs/hs-crypto?topic=hs-crypto-tutorial-import-keystutorial-import-retrieve-token)

[3. Create an encryption key](/docs/hs-crypto?topic=hs-crypto-tutorial-import-keystutorial-import-create-key)

[4.