vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Activity Tracker hosted event search Activity Tracker Event Routing



* 1 hour
* 2022-05-16



[Using Hyper Protect Crypto Services with Unified Key Orchestrator to manage keys in Key Protect on Satellite](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-uko-satellite)Using Hyper Protect Crypto Services with Unified Key Orchestrator to manage keys in Key Protect on Satellite

IBM Cloud Satellite provides you with flexibility and scalability to bring your own infrastructures to IBM Cloud. You can run IBM Cloud services anywhere including on your on-prem data centers and other cloud providers. With IBM Cloud Satellite, you can connect your multiple environments to implement distributed cloud solutions to help your enterprise hybrid cloud transformation. Key Protect on Satellite allows you to fully control your encryption keys by using your on-prem hardware security module (HSM). Hyper Protect Crypto Services with Unified Key Orchestrator enables you to manage keys in various key management systems, including Key Protect on Satellite, from a single pane of glass.

Hyper Protect Crypto Services Key Protect

+3

Satellite,IBM Cloud Databases,Activity Tracker hosted event search



* 2 hours
* 2023-06-27



[Enhance cloud security by applying context-based restrictions](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-cbr-enhanced-security)Enhance cloud security by applying context-based restrictions

This tutorial walks you through the process of implementing context-based restrictions (CBRs) in your IBM Cloud account. CBRs help you to secure the cloud environment further and move towards a zero trust security model.

Kubernetes service Object Storage

+7

Activity Tracker hosted event search,Container Registry,Secrets Manager,App ID,Cloudant,Key Protect,Log Analysis



* 2 hours
* 2023-06-28



[Apply end to end security to a cloud application](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-cloud-e2e-security)Apply end to end security to a cloud application

This tutorial walks you through key security services available in the IBM Cloud® catalog and how to use them together.
You generate key material by using an on-premises key management mechanism.
2. You encrypt the nonce value with the key material by using an AES-GCM encryption method that is compatible with your environment.
3. You encrypt the key material with the public key by using an RSA encryption method that is compatible with your environment.



4. You send a request to import the key.



1. You provide the encrypted key material, the encrypted nonce, and the initialization vector (IV) that was generated by the AES-GCM algorithm.
2. Hyper Protect Crypto Services verifies your request, decrypts the encrypted packet, and stores the key material as a root key in your service instance.





You can create only one import token per service instance at a time. To learn more about retrieval limits for import tokens, [see the Hyper Protect Crypto Services key management service API reference doc](https://cloud.ibm.com/apidocs/hs-cryptopostimporttoken).





 API methods 

Behind the scenes, the Hyper Protect Crypto Services key management service API drives the import token creation process.

The following table lists the API methods that set up an import token for your service instance.



Table 2. Describes the key management service API methods

 Method Description 

 POST api/v2/import_token Create an import token 
 GET api/v2/import_token Retrieve an import token 









 What's next 



* To learn how to create an import token for your service instance, see [Creating an import token](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-import-tokens).
* To find out more about importing keys to the service, see [Importing root keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-import-root-keys).
When you [create a Hyper Protect DBaaS for MongoDB service instance](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-mongodb?topic=hyper-protect-dbaas-for-mongodb-gettingstartedcreating-a-database-cluster-introduction), select your Hyper Protect Crypto Services instance and root key.

The new Hyper Protect DBaaS for MongoDB service instance uses your Hyper Protect Crypto Services root key to protect your data encryption key. To check and manage your root key, click the Hyper Protect Crypto Services service instance on the Overview page of your Hyper Protect DBaaS for MongoDB service dashboard.

You can select the Hyper Protect Crypto Services key only when you create the DBaaS instance. Otherwise, a randomly generated key is used by default.





 Step 4 (Optional). Remove keys and delete your data 

If you delete the key that is used to encrypt your service, you lose access to the data. You can't recover the data from the instance (see [Deleting keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-keys)). You might be able to recover your data by restoring a backup into a new service instance.

If you want to securely delete your data, you must delete both the service instance and the Hyper Protect Crypto Services key.
Once the encryption keys are deleted, you can be assured that your data that is protected by these keys is no longer retrievable. The service is built on FIPS 140-2 Level 4 certified HSM, which offers the highest level of protection in the cloud industry. Hyper Protect Crypto Services provides the same [key management service API](https://cloud.ibm.com/apidocs/hs-crypto) as IBM Key Protect for IBM Cloud for you to build your applications or leverage IBM Cloud data and infrastructure services.





 What is Hardware Security Module? 

A Hardware Security Module (HSM) provides secure key storage and cryptographic operations within a tamper-resistant hardware device for sensitive data. HSMs use the key material without exposing it outside the cryptographic boundary of the hardware.





 What is a cloud HSM? 

A cloud HSM is a cloud-based hardware security module to manage your own encryption keys and to perform cryptographic operations in IBM Cloud. Hyper Protect Crypto Services is built on FIPS 140-2 Level 4 certified HSM, which offers the highest level of protection in the cloud industry. With the Keep Your Own Key (KYOK) support, customers can configure the

master keyand take the ownership of the cloud HSM. Customers have full control and authority over the entire key hierarchy, where no IBM Cloud administrators have access to your keys.





 How does Hyper Protect Crypto Services provide a single-tenant cloud service? 

Hyper Protect Crypto Services is a single-tenant cloud service because each customer has a dedicated software stack and a dedicated HSM domain for every crypto unit. As a customer, you are assured that you are interacting with a dedicated service stack that processes only your data. For more information about the service architecture, see [How does Hyper Protect Crypto Services work](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-overviewhow-hpcs-work).





 What are the responsibilities of users and IBM Cloud for Hyper Protect Crypto Services? 

Hyper Protect Crypto Services is a platform-as-a-service on IBM Cloud. IBM Cloud is responsible for management of servers, network, storage, virtualization, middleware, and runtime, which ensures good performance and high availability.
: If you choose to encrypt your key material by using an import token, you must also determine a method for running AES-GCM encryption on the nonce that is distributed by Hyper Protect Crypto Services. The nonce serves as a session token that checks the originality of a request to protect against malicious attacks and unauthorized calls. Review the capabilities of your internal key management system or on-premises HSM to determine your options.

Manage the lifecycle of imported key material
: After you import key material into the service, keep in mind that you are responsible for managing the complete lifecycle of your key. By using the Hyper Protect Crypto Services key management service API, you can set an expiration date for the key when you decide to upload it into the service. However, if you want to [rotate an imported root key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-keys), you must generate and provide new key material to retire and replace the existing key.





 Using import tokens 

If you want to encrypt your key material before you import it into Hyper Protect Crypto Services, you can create an import token for your service instance by using the Hyper Protect Crypto Services key management service API.

Import tokens are a resource type in Hyper Protect Crypto Services that enable the secure import of key material to your service instance. By using the contents of an import token to encrypt your key material on-premises, you protect root keys while they're in flight to Hyper Protect Crypto Services based on the policies that you specify. For example, you can set a policy on the import token that limits the use based on time and usage count.



 How it works 

When you [create an import token](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-import-tokens) for your service instance, Hyper Protect Crypto Services generates a 4096-bit RSA key-pair from the HSMs.
FAQs: Support and maintenance 

Read to get answers for support and maintenance related questions about IBM Cloud® Hyper Protect Crypto Services.



  How is routine maintenance performed on Hyper Protect Crypto Services? 

If one available zone that contains your provisioned service instance goes down, Hyper Protect Crypto Services has automatic in-region data failover in place if you have 2 or 3 crypto units provisioned. IBM also performs cross-region backup for your key resources. Your data is automatically backed up in another supported region daily. If a regional disaster that affects all available zones occurs, you need to open a support ticket so that IBM can restore your data in another supported [IBM Cloud regions](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regions) from the backup. And then, you need to manually load your master key to your new service instance. For more information, see [Restoring your data from another region](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-restore-data).





  How do I get support for Hyper Protect Crypto Services? 

If you have technical questions about Hyper Protect Crypto Services, post your question on [Stack Overflow](https://stackoverflow.com/questions/tagged/hyper-protect-crypto) and tag your question with ibm-cloud and hyper-protect-crypto.

For more information about opening an IBM support ticket, or about support levels and ticket severities, see [Using the Support Center](https://cloud.ibm.com/docs/get-support?topic=get-support-using-avatar).
Index encryption is modular and granular in the following way:



* Each index can either be encrypted (with a per-index key granularity) or left plaintext
* Footer + object name column:



* Footer column of the metadata object which in itself is a Parquet file contains, among other things:



* Schema of the metadata object, which reveals the types, parameters and column names for all indexes collected. For example, you can learn that a BloomFilter is defined on column city with a false-positive probability of 0.1.
* Full path to the original data set or a table name in case of a Hive metastore table.



* Object name column stores the names of all indexed objects.



* Footer + metadata column can either be:



* Both encrypted using the same key. This is the default. In this case, the plain text footer configuration for the Parquet objects comprising the metadata in encrypted footer mode, and the object name column is encrypted using the selected key.
* Both in plain text. In this case, the Parquet objects comprising the metadata are in plain text footer mode, and the object name column is not encrypted.

If at least one index is marked as encrypted, then a footer key must be configured regardless of whether plain text footer mode is enabled or not. If plain text footer is set then the footer key is used only for tamper-proofing. Note that in that case the object name column is not tamper proofed.

If a footer key is configured, then at least one index must be encrypted.





Before using index encryption, you should check the documentation on [PME](https://cloud.ibm.com/docs/AnalyticsEngine?topic=AnalyticsEngine-parquet-encryption) and make sure you are familiar with the concepts.

When using index encryption, whenever a key is configured in any Xskipper API, it's always the label NEVER the key itself.

To use index encryption:



1. Follow all the steps to make sure PME is enabled.
* [Deleting vaults with the IBM Cloud console](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-vaultsdelete-vaults-ui)
* [Deleting vaults with the API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-vaultsdelete-vaults-api)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-vaultsdelete-vaults-next)







 Managing keys - Unified Key Orchestrator Plan 

[Creating managed keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-managed-keyscreate-managed-keys)



* [Creating managed keys with the IBM Cloud console](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-managed-keyscreate-managed-keys-ui)
* [Creating managed keys with the API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-managed-keyscreate-managed-keys-api)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-managed-keyscreate-managed-keys-next)



[Viewing a list of keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-key-listview-key-list)



* [Viewing a list of keys with the IBM Cloud console](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-key-listview-key-list-ui)
* [Viewing a list of keys with the API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-key-listview-key-list-api)
For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Hyper Protect Crypto Services service instance. For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-instance-ID). 
 key_ring_ID Optional. The unique identifier of the key ring that the key belongs to. If unspecified, Hyper Protect Crypto Services will search for the key in every key ring that is associated with the specified instance. Therefore, it is suggested to specify the key ring ID for a more optimized request.<br><br>Note: The key ring ID of keys that are created without an x-kms-key-ring header is: default. For more information, see [Managing key rings](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-managing-key-rings). 
 correlation_ID Optional. The unique identifier that is used to track and correlate transactions. 
 data_key The key material of the DEK that you want to manage and protect. The plaintext value must be base64 encoded. For more information about encoding your key material, see [Encoding your key material](https://cloud.ibm.com/docs/key-protect?topic=key-protect-import-root-keysopen-ssl-encoding-root-new-key-material). To generate a new DEK, omit the plaintext attribute. The service generates a random plain text (32 bytes), wraps that value, and then returns both the generated and wrapped values in the response. The generated and wrapped values are base64 encoded and you will need to decode them in order to decrypt the keys. 



Your wrapped data encryption key, containing the base64 encoded key material, is returned in the response entity-body.
For a detailed description of the response parameters, see the Hyper Protect Crypto Services [REST API reference doc](https://cloud.ibm.com/apidocs/hs-crypto).
3. Optional: Verify that the key was created by running the following call to browse the keys in your Hyper Protect Crypto Services service instance.

curl -X GET 
https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/keys 
-H 'accept: application/vnd.ibm.collection+json' 
-H 'authorization: Bearer <IAM_token>' 
-H 'bluemix-instance: <instance_ID>' 
-H 'correlation-id: <correlation_ID>' 



After you create a root key with the service, the key stays within the bounds of Hyper Protect Crypto Services, and the key material cannot be retrieved.





 What's next 



* To find out more about protecting keys with envelope encryption, check out [Wrapping keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-wrap-keys).
* To find out instruction on importing your own key, check out [Importing root keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-import-root-keys) or [Importing standard keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-import-standard-keys).
* To find out more about programmatically managing your keys, [check out the Hyper Protect Crypto Services key management service API reference doc](https://cloud.ibm.com/apidocs/hs-crypto).
: You can now manually rotate a managed key in your Hyper Protect Crypto Services with Unified Key Orchestrator instance. Managed key rotation shortens the cryptoperiod of the keys and reduces the probability for a security breach. For more information about how managed key rotation works, see [Managed key rotation](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-managed-key-rotation-intro). For more information about the detailed instructions, see [Rotating managed keys manually](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-rotate-keys).





 21 November 2022 

Added: Management Utilities support for Red Hat Enterprise Linux 9.0 and Ubuntu 22.04.1 LTS
: To manage your master keys by using smart cards, you can now install the smart card reader driver Identiv SPR332 V2 on Red Hat Enterprise Linux 9.0 and Ubuntu 22.04.1 LTS besides the already supported Red Hat Enterprise Linux 8.0 operating system. For more detailed steps, see [Installing the smart card reader driver](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-prepare-management-utilitiesinstall-smart-card-reader-driver).

You can also find the latest Management Utilities installation files in [Github](https://github.com/IBM-Cloud/hpcs-management-utilities/releases/tag/v1.0.3.8).





 31 Octorber 2022 

Added: Google Cloud KMS support
: You can now use Hyper Protect Crypto Services with Unified Key Orchestrator to create and manage Google Cloud KMS keys. For more information, see [Connecting to external keystores](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-connect-external-keystores) and [Creating managed keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-managed-keys).





 20 Octorber 2022
* [Supported events](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-at-eventsat-supported-events)
* [Key Ring events](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-at-eventskeyring-actions)
* [Viewing events](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-at-eventsat-ui)
* [Analyzing successful events](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-at-eventsat-events-analyze)
* [Analyzing failed events](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-at-eventsat-events-analyze-failed)
* [Event severity](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-at-eventsevent-severity)



[Managing security and compliance with Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-security-compliancemanage-security-compliance)



* [Governing Hyper Protect Crypto Services resource configuration with config rules](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-security-compliancegovern-crypto)









 Enhancing security - Unified Key Orchestrator Plan only 

[Managing user access](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-manage-accessuko-manage-access)



* [Roles and permissions](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-manage-accessuko-roles)
Performing cryptographic operations with the GREP11 API 

IBM Cloud® Hyper Protect Crypto Services provides an Enterprise PKCS #11 (EP11) API over gRPC (also referred to as GREP11 API) to remotely access the Hyper Protect Crypto Services service instance for data encryption and management.



 Retrieving your IBM Cloud credentials 

To work with the API, you need to generate your service and authentication credentials. To gather your credentials:



1. [Generate an IBM Cloud IAM access token](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-access-token).
2. [Retrieve the instance ID that uniquely identifies your Hyper Protect Crypto Services service instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-instance-ID).







 Generating a GREP11 API request 

In order to remotely access cloud HSM on Hyper Protect Crypto Services to perform cryptographic operations, you need to generate a GREP11 API request, and pass the GREP11 API endpoint URL, service ID API key, and IAM endpoint through the API call.

For Hyper Protect Crypto Services Standard Plan, you can also enable mutual TLS for GREP11 API to add another layer of authentication. For more information, see [Enabling the second layer of authentication for EP11 connections](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-enable-authentication-ep11).



 Example: Generating random data using the GenerateRandomRequest() function 

GREP11 API supports programming languages with [gRPC libraries](https://grpc.io/docs/). Two sample GitHub repositories are provided for you to test the GREP11 API:



* [The sample GitHub repository for Golang](https://github.com/IBM-Cloud/hpcs-grep11-go)
* [The sample GitHub repository for JavaScript](https://github.com/IBM-Cloud/hpcs-grep11-js)
* [Added: Hyper Protect Crypto Services expands into the Frankfurt region](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newadded-frankfurt-region)
* [Added: IBM Cloud service integration](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newadded-service-integration)



* [30 June 2019](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newhs-crypto-June2019)



* [Added: Hyper Protect Crypto Services expands into Sydney region](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newadded-sydney-region)



* [31 March 2019](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newhs-crypto-March2019)



* [Hyper Protect Crypto Services is generally available](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newga-201903)
* [High availability and disaster recovery](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newha-dr-new)
* [Scalability](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newscalability-new)



* [28 February 2019](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newhs-crypto-Feb2019)



* [Hyper Protect Crypto Services Beta is available](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newbeta-201902)