vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* Encryption of backup files is available as follows:



* When configured in a backup job, Veeam Backup and Replication can use 256-bit AES block cypher encryption.
* For data in transit, a global network traffic rule can be configured to enable all traffic to be encrypted through 256-bit AES encryption. When enable and two backup infrastructure components need to communicate, a dynamic key is generated by the backup server and communicated to each node over a secure channel. The two components establish an encrypted connection between each other using this key. All communications between these two components for that session are encrypted by using this key. The key has a one-time use and it is discarded when the session is completed.









 Related links 



* [Hardened repository](https://helpcenter.veeam.com/docs/backup/vsphere/hardened_repository.html?ver=120)
In this kind of a system, known as "envelope encryption", the process of decrypting the data means first "unwrapping" the encrypted DEK (opening its envelope, in other words) and then using the DEK to decrypt the data.

For more information about envelope encryption works, check out [Protecting data with envelope encryption](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryption).



 What Key Protect offers 



* Fully managed key management system: Create or import both root and standard keys (the latter is generally used to encrypt secrets, for example a password) with Key Protect that can be used to encrypt your application data. Manage your user roles, key states, and set a rotation schedule that works for your use case using the UI, CLI, or API. Leverage the power of IBM master keys stored inside an HSM shared across IBM Cloud multi-zone regions for the best in cost, performance, and security. Run multiple instances of Key Protect on shared clusters and a shared container that processes API requests within a security context that is user-based and unique to each customer.
* Integration with IBM products: Key Protect integrates easily with a variety of IBM database, storage, container, and ingestion services. For more information, check out [Integrating services](https://cloud.ibm.com/docs/key-protect?topic=key-protect-integrate-services). Chief among these is the native integration with IBM Cloud Object Storage (COS). For more information about this integration, check out [Server-Side Encryption with IBM Key Protect (SSE-KP)](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-kp) in the COS documentation.
* Security, compliance, and auditing: In addition to the FIPS 140-2 Level 3 certified cloud-based hardware security modules (HSMs), Key Protect leverages IBM Cloud [Identity and Access Management (IAM) roles](https://cloud.ibm.com/docs/account?topic=account-userroles) to provide fine-grain access control to your keys.
Application-level encryption using the PKCS 11 API 

Hyper Protect Crypto Services allows application programmers to design and develop applications with a standard PKCS #11 API to request encryption or to sign the application data. It means that you can invoke security without having programmers to become encryption experts. Now you can enable and improve data integrity through digital signing and confidentiality through data encryption. Applications can use the Hyper Protect Crypto Services PKCS #11 library to perform cryptographic operations. This capability helps you to modernize business processes through building applications that have a digital workflow with private data and digital reviews, approvals, and signatures that are secure and trustworthy.

You can use the PKCS #11 API to encrypt applications between clouds. With the support of PKCS #11, you have access to a full range of advanced cryptographic operations, such as signing, signature validation, message authentication codes, and more advanced encryption schemes.

Zoom

![Application encryption by using PKCS #11](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/hs-crypto//images/application-encryption-pkcs11.svg)

Figure 4. Application encryption by using PKCS #11





 Databases encryption by using the PKCS 11 API 

With Hyper Protect Crypto Services, you can encrypt Oracle® Database by using Transparent Data Encryption (TDE) and encrypt IBM Db2® Database by using Db2 default encryption.



* With TDE, you can encrypt sensitive data on database storage media, such as table spaces and files, and on backup media. Transparent Data Encryption ensures that sensitive data is encrypted, meets compliance, and provides functionality that streamlines encryption operations. The database system automatically and transparently encrypts and decrypts data when it is used by authorized users and applications. Database users do not need to be aware of TDE and database applications do not need to be adapted specifically for TDE.
[Unwrap a data encryption key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-unwrap-keys) using a root key that is stored in your Key Protect instance.

ibmcloud kp key unwrap KEY_ID_OR_ALIAS CIPHERTEXT_FROM_WRAP
-i, --instance-id INSTANCE_ID
[-a, --aad ADDITIONAL_DATA]
[--key-ring KEY_RING_ID]
[-o, --output OUTPUT]



 Examples 

These are examples of kp key unwrap.



 Example 1 

Unwrap a ciphertext to reveal the plaintext data encryption key (DEK).

 create a root key
$ ibmcloud kp key create my-root-key

Creating key: 'my-root-key', in instance: '390086ac-76fa-4094-8cf3-c0829bd69526'...
OK
Key ID Key Name
807eb0a6-cc10-4bfe-8331-41a6f712c4ea my-root-key

 create a data encryption key (DEK), wrapped with the root key
$ ibmcloud kp key wrap 807eb0a6-cc10-4bfe-8331-41a6f712c4ea

Wrapping key...
OK
Ciphertext
eyJjaXBoZXJ0ZXh0IjoiKzhjbHVqcUNP ...<redacted>... NmY3MTJjNGViIn0=

 capture the ciphertext
$ CIPHERTEXT=eyJjaXBoZXJ0ZXh0IjoiKzhjbHVqcUNP ...<redacted>... NmY3MTJjNGViIn0=

 unwrap the ciphertext to reveal the plaintext data encryption key (DEK)
Securing your data with encryption 

Review what data is stored and encrypted when you use IBM Cloud Schematics, and how you can delete any stored user data.

To ensure that you can securely manage your data when you use Schematics, it is important to know what data is stored and encrypted and how you can delete any stored data. Data encryption is performed with keys managed by Key Protect or Hyper Protect Crypto Services.



 How your data is stored and encrypted in Schematics 

All data, user inputs and the data generated at runtime during execution of Terraform or Ansible automation code is stored in IBM Cloud Object Storage. Data is encrypted at rest with AES GCM 256 encryption using an [envelope encryption](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryption) technique with IBM Cloud managed root keys. Key Protect managed root keys are secured by FIPS 140-2 Level 3 certified cloud-based

hardware security modules (HSMs).

Schematics supports three types of root key management:



1. Schematics owned root key managed by Key Protect. (The default)
2. Bring your own key (BYOK), managed by Key Protect.
3. Keep your own key (KYOK), managed by Hyper Protect Crypto Services (HPCS)



Refer to [KMS integration for BYOK or KYOK](https://cloud.ibm.com/docs/schematics?topic=schematics-kms-integration) for details on using user managed keys.

Key protect offers manual and automatic key rotation. When you rotate a root key, the registered key is used to re-encrypted Schematics resources with a new key version. You can access the Schematics resources metadata such as details until the rotation completes.



 Key deletion or disable 

Key Deletion is a destructive action. When you disable or delete a root key that is used to encrypt your Schematics resources, you cannot access transactional data such as activity or job logs, resource list, variable store. However, you can access the metadata details.
The WDEK does not refer to the data encryption key that is protecting data in the virtual disk. Rather, it encrypts the LUKS passphrase.

The new version of the root key is used to unwrap the newly rewrapped LUKS passphrase the next time the resource is decrypted. For example, it is used when you decrypt a volume upon restarting an instance.

The service retires the old root key version but it remains available for decrypting existing resources. You can list the key versions to see how many times the key was rotated and see the latest version. Older versions of the root key continue to work until they expire or until no resources are available to decrypt. If you manually [disable](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-disable-root-keys) or [delete](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-delete-root-keys) the root key or reboot the instance, the old key no longer functions.

After your root keys are rotated, the new root key version becomes available for encrypting new resources.

For more information about the key rotation process, see:



* Key Protect - [Understanding the key rotation process](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-rotationunderstand-key-rotation-process)
* Hyper Protect Crypto Services - [Root key rotation](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-root-key-rotation-intro)







 Benefits of key rotation 

Rotating your root keys provides these security benefits:



* You can limit how long your data is protected by a single root key. By shortening the time that your resources are encrypted with a particular root key, you decrease the probability of a security breach.
* You limit the number of resources encrypted with any one version of the root key because resources created after key rotation are encrypted with different key material.
[Application encryption by using PKCS #11](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/hs-crypto//images/application-encryption-pkcs11.svg)

Figure 3. Application encryption by using PKCS #11





 Databases encryption by using the PKCS 11 API 

With Hyper Protect Crypto Services, you can encrypt Oracle® Database by using Transparent Data Encryption (TDE) and encrypt IBM Db2® Database by using Db2 default encryption.



* With TDE, you can encrypt sensitive data on database storage media, such as table spaces and files, and on backup media. Transparent Data Encryption ensures that sensitive data is encrypted, meets compliance, and provides functionality that streamlines encryption operations. The database system automatically and transparently encrypts and decrypts data when it is used by authorized users and applications. Database users do not need to be aware of TDE and database applications do not need to be adapted specifically for TDE.

TDE uses a two-tiered key hierarchy that is composed of a TDE master encryption key and a TDE data encryption key. The TDE data encryption key is used to encrypt and decrypt data, while the TDE master encryption key is used to encrypt and decrypt the TDE data encryption key.

Zoom

![Transparent Database Encryption by using the standard PKCS #11 API](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/hs-crypto//images/pkcs-database.svg)

Figure 4. Transparent Database Encryption by using the standard PKCS #11 API
* IBM Db2 default encryption protects key database files and database backup images from inappropriate access while they are stored on external storage media. The database system automatically encrypts and decrypts data when it is used by authorized users and applications.
Your key material is protected in transit (when it's transported) and at rest (when it is stored).

Customer-managed encryption is available for custom images, boot volumes, and data volumes. When an instance is provisioned from an encrypted custom image, its boot volume is encrypted by using the image’s root key. You can also choose a different root key. Data volumes are encrypted by using root keys when you provision a virtual server instance or when you create a stand-alone volume.

Images and volumes are often referred to as being encrypted with a root key when, in fact,

envelope encryptionis used. Internally, each image or volume is encrypted with adata encryption key (DEK), which is an open source QEMU technology that is used by the IBM Cloud VPC Generation 2 infrastructure. A LUKS passphrase, also called a key encryption key, encrypts the DEK. The LUKS passphrase is then encrypted with a root key, creating what is called a wrapped DEK (WDEK). For more information about IBM Cloud VPC key encryption technology, see [IBM Cloud VPC Generation 2 encryption technology](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-aboutbyok-technologies).

For example, if you provision two volumes by using the same root key, unique passphrases are generated for each volume, which are then encrypted with the root key. Envelope encryption provides more protection for your data, and ensures that the root key can be rotated without having to reencrypt the data. For more information about envelope encryption, see [Protecting your sensitive data in VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-mng-datadata-encryption).

All your interaction with VPN for VPC is encrypted. For example, when you use an API or interact with the service through the User Interface to configure VPN gateways and VPN connections, all such interactions are encrypted end-to-end.
Understanding encryption for Portworx 



 Encryption overview 

The following image illustrates the encryption workflow in Portworx when you set up per-volume encryption.

Zoom

![Encrypting Portworx volumes](https://cloud.ibm.com/docs-content/v1/content/4d497aff9e27b92fbbc2ee4e343a9ec4549cb1d7/containers/images/cs_px_volume_encryption.png)

Figure 1. Encrypting Portworx volumes



1. The user creates a PVC with a Portworx storage class and requests the storage to be encrypted.
2. Portworx invokes the IBM Key Protect or Hyper Protect Crypto Services API WrapCreateDEK to create a passphrase by using the customer root key (CRK) that is stored in the Portworx secret.
3. The IBM Key Protect or Hyper Protect Crypto Services service instance generates a 256-bit passphrase and wraps the passphrase in the DEK. The DEK is returned to the Portworx cluster.
4. The Portworx cluster uses the passphrase to encrypt the volume.
5. The Portworx cluster stores the DEK in plain text in the Portworx etcd database, associates the volume ID with the DEK, and removes the passphrase from its memory.







 Decryption overview 

The following image illustrates the decryption workflow in Portworx when you set up per-volume encryption.

Zoom

![Decrypting Portworx volumes](https://cloud.ibm.com/docs-content/v1/content/4d497aff9e27b92fbbc2ee4e343a9ec4549cb1d7/containers/images/cs_px_volume_decryption.png)

Figure 2. Decrypting Portworx volumes



1. Kubernetes sends a request to decrypt an encrypted volume.
About IBM Cloud Data Security Broker 

Data Security Broker is a software that makes data breaches irrelevant by ensuring data remains encrypted, not only when it is stored but also when it is being processed by databases and applications. Data Security Broker provides easy and feasible way to provide enhanced data protection for sensitive data in public or private cloud environments. The software includes dynamic management of customer-owned keys and the ability to protect databases at a column-level granularity.



 How it works 

Data Security Broker delivers an enterprise-level transparent data security platform that secures databases through a "no code" model at the field or file level. The software supports tokenization, format-preserving encryption (FPE), and role-based access control.

The encyrption is made simpler, faster, and seamless.

Zoom

![High level architecture of Data Security Broker Manager](https://cloud.ibm.com/docs-content/v1/content/57ab3ec034294d8a6de510b97bec3035d4654761/security-broker/images/deploy_architecture.png)

High level architecture of Data Security Broker Manager

The Data Security Broker supports data encryption by migrating the data from an existing SQL/NoSQL database into a secure database with the ability to encrypt fields at a column granularity, thereby enabling selective privacy.

This is accomplished by inserting the Data Security Broker Shield driver layer proxy between the application and the database. The Shield is used to intercept SQL or its NoSQL equivalent generated by the application to access data records in the database by encrypting on writes and decrypting on reads.

The encryption process manages keys that are generated by a commercially available key management service such as IBM® Key Protect and Hyper Protect Crypto Services.

Application performance is minimally impacted allowing for enterprise workflows to continue to operate in a secure environment. The Data Security Broker Manager is the cloud-based management console providing scalability, fault tolerance, and manageability of the software.





 Encryption Technology Configuration Overview: 

Data Security Broker supports data protection services that can be configured in four main modes.



 Data Encryption:
correlation_ID Optional. The unique identifier that is used to track and correlate transactions. 
 encrypted_data_key The ciphertext value that was returned during a wrap operation. 



The original key material is returned in the response entity-body. The response body also contains the ID of the key version that was used to unwrap the supplied ciphertext. The following JSON object shows a sample returned value.

{
"plaintext": "Rm91ciBzY29yZSBhbmQgc2V2ZW4geWVhcnMgYWdv",
"keyVersion": {
"id": "02fd6835-6001-4482-a892-13bd2085f75d"
}
}

If Hyper Protect Crypto Services detects that you rotated the root key that is used to unwrap and access your data, the service also returns a newly wrapped data encryption key (ciphertext) in the unwrap response body. The latest key version (rewrappedKeyVersion) that is associated with the new ciphertext is also returned. Store and use the new ciphertext value for future envelope encryption operations so that your data is protected by the latest root key.







 Decoding your key material 

When you unwrap a data encryption key, the key material is returned in base64 encoding. You need to decode the key before you encrypt it.



 Using OpenSSL to decode key material 



1. Download and install [OpenSSL](https://github.com/openssl/opensslfor-production-use).
2. Base64 encode your key material string by running the following command:

$ openssl base64 -d -in <infile> -out <outfile>

Replace the variables in the example request according to the following table.



Table 2. Describes the variables needed to decode your key material

 Variable Description 

 infile The name of the file where your base64 encoded key material string resides. 
 outfile The name of the file where your decoded key material is outputted after the command is run.
root@classic-byok-poc01:/mnt/filestor gocryptfs -passwd cipher





 IBM Cloud Object Storage server-side encryption 

IBM Cloud Object Storage provides the following methods of customer-managed encryption:



* [Server-Side Encryption based on SSE-C headers](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-sse-c)
* [Server-Side Encryption with IBM Key Protect](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-kp)
Encrypting your data 

IBM Cloud® Object Storage provides several options to encrypt your data.

By default, all objects that are stored in IBM Cloud Object Storage are encrypted by using randomly generated keys and an all-or-nothing-transform (AONT). While this default encryption model provides at-rest security, some workloads need full control over the data encryption keys used. You can manage your keys manually on a per-object basis by providing your own encryption keys - referred to as [Server-Side Encryption with Customer-Provided Keys (SSE-C)](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-sse-c).

With Object Storage you also have a choice to use our integration capabilities with IBM Cloud® Key Management Services like IBM® Key Protect and Hyper Protect Crypto Services. Depending on the security requirements, you can decide whether to use IBM Key Protect or IBM Hyper Protect Crypto Services for your IBM Cloud Object Storage buckets.

[IBM® Key Protect for IBM Cloud®](https://cloud.ibm.com/docs/services/key-protect?topic=key-protect-about) helps you provision encrypted keys for apps across IBM Cloud® services. As you manage the lifecycle of your keys, you can benefit from knowing that your keys are secured by FIPS 140-2 Level 3 certified cloud-based hardware security modules (HSMs) that protect against the theft of information.

[Hyper Protect Crypto Services](https://cloud.ibm.com/docs/services/hs-crypto?topic=hs-crypto-overview) is a single-tenant, dedicated HSM that is controlled by you. The service is built on FIPS 140-2 Level 4-certified hardware, the highest offered by any cloud provider in the industry.

Refer to product documentation on [IBM® Key Protect for IBM Cloud®](https://cloud.ibm.com/docs/services/key-protect?topic=key-protect-about) and [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/services/hs-crypto?topic=hs-crypto-overview) for a detailed overview of the two services.
You cannot access the data in the persistent storage instance.
* Backup: See 2 and 3 to see how data is backed up.
* Encryption: Data is encrypted at rest with a customer root key from an IBM-owned IBM Key Protect service instance.



(2) TLS certificate, TLS secret, and Certificate Authority to encrypt the Satellite control plane domain
: Review the location, access, backup and encryption details for TLS secret and CA information.



* Location: Data is backed up from the Satellite persistent storage instance to an IBM-owned IBM Cloud Object Storage instance.
* Access and data management: Access to the IBM-owned IBM Cloud Object Storage service instance is controlled by Cloud Identity and Access Management (IAM) and granted to the Satellite service team and IBM Site Reliability Engineers (SRE) only.
* Backup: Every hour
* Encryption: All backup data is protected in transit and at rest by a root key that IBM creates and stores in an IBM-owned IBM Key Protect service instance.



(3) All Satellite control plane and cluster data
: Review the location, access, backup and encryption details for control plane and cluster data.



* Location: Cluster data such as etcd data is backed up from the Satellite persistent storage instance to a customer-owned IBM Cloud Object Storage instance. Control plane data such as location data is sent to the IBM Cloud Object Storage. You must have an existing IBM Cloud Object Storage instance when you create the location. You can specify an existing bucket in the IBM Cloud Object Storage instance that you want Satellite to use. Otherwise, a new bucket is automatically created in your Object Storage instance on your behalf. Control plane master data is backed up by IBM and stored in an IBM-owned Object Storage instance. Satellite cluster master data is backed up to the Object Storage instance that you own.
* Access and data management: Access to the customer-owned IBM Cloud Object Storage service instance is controlled by IAM.
* etcd Backup: Every 8 hours
* Location control plane Backup: Every hour
* Encryption: Data is automatically encrypted by using the default built-in encryption mechanisms in IBM Cloud Object Storage. You can further choose to protect your data by using a root key in IBM Key Protect and use the key to encrypt the data in your bucket.