vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Local access is any access to organizational information systems by users (or processes acting on behalf of users) where such access is obtained by direct connections without the use of networks. Network access is access to organizational information systems by users (or processes acting on behalf of users) where such access is obtained through network connections (i.e., nonlocal accesses). Remote access is a type of network access that involves communication through external networks (e.g., the Internet). Internal networks include local area networks and wide area networks. In addition, the use of encrypted virtual private networks (VPNs) for network connections between organization-controlled endpoints and non-organization controlled endpoints may be treated as internal networks from the perspective of protecting the confidentiality and integrity of information traversing the network. Organizations can satisfy the identification and authentication requirements in this control by complying with the requirements in Homeland Security Presidential Directive 12 consistent with the specific organizational implementation plans. Multifactor authentication requires the use of two or more different factors to achieve authentication. The factors are defined as: (i) something you know (e.g., password, personal identification number [PIN]); (ii) something you have (e.g., cryptographic identification device, token); or (iii) something you are (e.g., biometric). Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD common access card. In addition to identifying and authenticating users at the information system level (i.e., at logon), organizations also employ identification and authentication mechanisms at the application level, when necessary, to provide increased information security. Identification and authentication requirements for other than organizational users are described in IA-8.
With the PKCS #11 library, your applications can use the PKCS #11 API to access the Hyper Protect Crypto Services cloud HSM to perform cryptographic operations. To learn more about how to set up the library, see

[Performing cryptographic operations with the PKCS #11 API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-pkcs-api).





 Cryptoki token 

The logical view of a cryptographic device that is defined by Cryptoki. For more information, see

[PKCS #11 Cryptographic Token Interface Usage Guide Version 2.40 - Logical view of a token](http://docs.oasis-open.org/pkcs11/pkcs11-ug/v2.40/cn02/pkcs11-ug-v2.40-cn02.html_Toc406759983).





 Cryptoki session 

A logical connection between an application and a token. Cryptoki requires that an application open one or more sessions with a token to gain access to the objects and functions of the token. A session can be a read/write (R/W) session or a read-only (R/O) session. For more information, see

[Introducing PKCS #11 - Session](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-intropkcs11-session-intro).





 Cryptoki object 

An item that is stored on a token. An object can be data, a certificate, or a key. A data object is defined by an application. A certificate object stores a certificate. A key object stores a cryptographic key. Each characteristic of the object is defined in an attribute. For more information, see

[Introducing PKCS #11 - Key object](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-intropkcs11-object-intro).





 Mechanism 

A process for implementing a cryptographic operation.
For default service access roles that support viewing EP11 keys, see [service access roles](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-accessservice-access-roles). If you are to create custom roles, make sure to assign the following actions to the custom role:



* hs-crypto.keystore.listkeystoresbyids
* hs-crypto.keystore.listkeysbyids



For instructions on creating custom roles, see [Creating custom roles](https://cloud.ibm.com/docs/account?topic=account-custom-roles).

On the Hyper Protect Crypto Services dashboard, do the following to view EP11 key details:



1. To view a list of created EP11 keys, select the EP11 keys tab in the side menu.

An EP11 key table is displayed with the following details.



Table 1. Describes the EP11 keys table

 Property Description 

 ID The unique identifier that is assigned when the key is created. 
 Name A human-readable alias for easy identification of your key. The value of the CKA_LABEL key attribute is displayed in this field. The key name might not be unique. You can assign multiple keys with the same name. However, it is suggested to assign a unique name to each key in the same keystore for easy identification. 
 Class The class of the key. Possible values are Public, Private, and Secret. The value is determined by the CKA_CLASS key attribute. Public indicates that the key is the public key of an asymmetric key pair. Private indicates that the key is the private key of an asymmetric key pair. Secret indicates that the key is a symmetric key. 
 Version The version number of the key. When the key is first created, version 0 is assigned. The version number is increased by 1 sequentially upon each update, such as using the C_SetAttributeValue function to update a key attribute value. 
 Keystore The unique identifier of the keystore the key is stored in.
DB20000I The CREATE DATABASE command completed successfully.
7. To test the encrypted database, run the following commands:

db2 connect to cryptdb1
db2 "create table test (id int not null, data varchar(100))"
db2 "insert into test values (1, 'This is a secret text')"
db2 "select * from test"

This command prints the following information:

ID DATA
----------- ----------------------------------------------------------------------------------------------------
1 This is a secret text

1 record(s) selected.







 Next steps 

Your sensitive data is now stored safely in encrypted storage. And the master key is kept in Hyper Protect Crypto Services in a highly secure and tamper-proof manner.

In this tutorial, you learned how to set up Db2 native encryption with Hyper Protect Crypto Services.



* Learn more about

[PKCS #11](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-intro).
* Learn more about the

[PKCS #11 API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-api-ref).

[Start to use the PKCS #11 API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-pkcs-api).
SERVICE INSTANCE: 96fe3f8d-9792-45bc-a9fb-2594222deaf2
CRYPTO UNIT NUM SELECTED TYPE LOCATION
5 false OPERATIONAL [us-south].[AZ1-CS4].[00].[03]
6 false OPERATIONAL [us-south].[AZ2-CS5].[03].[03]
* To add extra crypto units to the selected crypto unit list, use the following command:

ibmcloud tke cryptounit-add

A list of the crypto units in the target resource group under the current user account is displayed. When prompted, enter a list of crypto unit numbers to be added to the selected crypto unit list.

If you enable cross-region high availability with [failover crypto units](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-understand-conceptscrypto-unit-concept), make sure that you add all the failover crypto units to the selected list for instance initialization.

If you don't initialize and configure failover crypto units the same as the operational crypto units, you are not able to use the failover crypto units for automatic data restoration when a regional disaster happens. For more information about cross-region disaster recovery, see [High availability and disaster recovery](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-ha-dr).

If you are using a public network, crypto units that are associated with service instances with the network policy set to private-only are not to be listed. You can access private-only crypto units only through a private network. For more information about setting up a private-only connection, see [Target the private endpoint for the TKE plug-in](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-secure-connectiontarget-tke-private-endpoint).
* To remove crypto units from the selected crypto unit list, use the following command:
The enforce_token attribute affects imported keys during creation, rotation, and restoration. The create_root_key, import_root_key, create_standard_key, and import_standard_key attributes affect keys only at creation time. All other Hyper Protect Crypto Services actions, such as wrap and unwrap, are not affected and can be invoked on the key as usual.







 Enabling or updating the key create and import access policy for your service instance with the console 

As a security administrator, if you prefer to manage the key create and import access policy settings by using a graphical interface, you can use the IBM Cloud console.

After you create a Hyper Protect Crypto Services instance, complete the following steps to enable the key create and import access policy:



1. [Log in to the IBM Cloud console](https://cloud.ibm.com/).
2. Go to Menu > Resource list to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Hyper Protect Crypto Services.
4. In the UI of the selected service instance, select the Instance policies tab in the side menu.
5. In the Create and import key access section, check or clear the corresponding boxes to update the keyCreateImportAccess settings, and then click Save policy.



* Allow creation of root keys: Check the box to allow root keys to be created in your Hyper Protect Crypto Services instance.
* Allow creation of standard keys: Check the box to allow standard keys to be created in your Hyper Protect Crypto Services instance.
* Allow import of root keys: Check the box to allow root keys to be imported into your Hyper Protect Crypto Services instance.
* Allow import of standard keys: Check the box to allow standard keys to be imported into your Hyper Protect Crypto Services instance.
* Enable secure import: Check the box to prevent authorized users from importing key material into your Hyper Protect Crypto Services instance without using an import token.



After you check the box for Enable secure import, it is required that [secure import](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-import-tokens) is enabled for all key import actions.
For more information about how to retrieve your service instance ID, see [Retrieving your instance ID](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-instance-ID).



* To select extra crypto units to work with, click Add crypto units and enter the CRYPTO UNIT NUM (crypto unit numbers) of the extra crypto units you want to work with. You can enter multiple crypto unit numbers, which are separated by a space.
* To remove crypto units from the set you're going to work with, click Remove crypto units and enter the CRYPTO UNIT NUM of the crypto units you want to remove. You can enter multiple crypto unit numbers, which are separated by a space.



When the operations are done, true is displayed in the SELECTED column for each crypto unit that is to be affected by later commands. If more than one crypto unit is assigned to a service instance, all crypto units in the service instance must be configured the same.

If you enable cross-region high availability with [failover crypto units](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-understand-conceptscrypto-unit-concept), make sure that you add all the failover crypto units to the selected list for instance initialization.

If you don't initialize and configure failover crypto units the same as the operational crypto units, you are not able to use the failover crypto units for automatic data restoration when a regional disaster happens. For more information about cross-region disaster recovery, see [High availability and disaster recovery](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-ha-dr).





 Step 3: Add administrators to the selected crypto units 

The command to load a master key must be signed by an administrator that is predefined to the crypto unit. This step predefines an administrator.



1. Select the Administrators tab. This tab displays a list of administrators that are allowed to sign commands to the crypto unit.
2. Click Add administrator.
3.
When you use IBM Cloud Hyper Protect Crypto Services (HPCS), your vCenter Server is connecting to a single-tenant KMIP service that is hosted within HPCS by using IBM Secure Service Containers running on IBM LinuxOne servers, and your keys are stored in an IBM Z HSM. The KMIP endpoint is exposed by using a single DNS name and port. If you have multiple HPCS crypto units, this DNS name is load balanced to separate availability zones.









 Related links 



* [Solution overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip-overview)
* [Implementation and management](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip-implementation)
* [High availability and disaster recovery](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip-hadr)
* [IBM Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-getting-started-tutorial)
With the PKCS #11 library, your applications can use the PKCS #11 API to access the Hyper Protect Crypto Services cloud HSM to perform cryptographic operations. To learn more about how to set up the library, see

[Performing cryptographic operations with the PKCS #11 API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-pkcs-api).





 Cryptoki token 

The logical view of a cryptographic device that is defined by Cryptoki. For more information, see

[PKCS #11 Cryptographic Token Interface Usage Guide Version 2.40 - Logical view of a token](http://docs.oasis-open.org/pkcs11/pkcs11-ug/v2.40/cn02/pkcs11-ug-v2.40-cn02.html_Toc406759983).





 Cryptoki session 

A logical connection between an application and a token. Cryptoki requires that an application open one or more sessions with a token to gain access to the objects and functions of the token. A session can be a read/write (R/W) session or a read-only (R/O) session. For more information, see

[Introducing PKCS #11 - Session](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-pkcs11-introuko-pkcs11-session-intro).





 Cryptoki object 

An item that is stored on a token. An object can be data, a certificate, or a key. A data object is defined by an application. A certificate object stores a certificate. A key object stores a cryptographic key. Each characteristic of the object is defined in an attribute. For more information, see

[Introducing PKCS #11 - Key object](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-pkcs11-introuko-pkcs11-object-intro).





 Mechanism
false 
 hpcsInstanceId Enter your Hyper Protect Crypto Services or Key Protect instance ID. For example: d11a1a43-aa0a-40a3-aaa9-5aaa63147aaa. false 
 hpcsSecretName Enter the name of the secret that you created by using your Hyper Protect Crypto Services or Key Protect credentials. For example: ibm-hpcs-secret. false 
 hpcsBaseUrl Enter the public or private endpoint of your Hyper Protect Crypto Services or Key Protect instance. For example: https://api.eu-gb.hs-crypto.cloud.ibm.com:8389. false 
 hpcsTokenUrl Enter https://iam.cloud.ibm.com/identity/token. false 
 ignore-noobaa Enter true if you do not want to deploy MultiCloud Object Gateway. false 







 Version 4.9 parameters 



ODF parameter reference

 Parameter Description Default value 

 osdStorageClassName Enter the name of the storage class that you want to use for your OSD devices. For multizone clusters, specify the metro storage class that you want to use. If you want to use a metro retain storage class, [create a custom WaitForFirstConsumer storage class](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-blockvpc-customize-storage-class) that's based off the tiered metro retain storage class that you want to use. Metro storage classes have the volume binding mode WaitForFirstConsumer, which is required for multizone ODF deployments. For single zone clusters, enter the name of the tiered storage class that you want to use. Example: ibmc-vpc-block-10iops-tier. For more information about VPC tiered storage classes, see the [Block Storage for VPC Storage class reference](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-blockvpc-block-reference). N/A 
 osdSize Enter a size for your storage devices.
[Hyper Protect Crypto Services workload isolation](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/hs-crypto//images/architecture-workload-isolation.svg)

Figure 2. Hyper Protect Crypto Services workload isolation





 Service dependencies 

Hyper Protect Crypto Services has dependencies on the following IBM Cloud services:



* [IBM Cloud® Identity and Access Management (IAM)](https://cloud.ibm.com/docs/account?topic=account-iamoverview)
* [IBM Cloud Databases for PostgreSQL](https://cloud.ibm.com/docs/databases-for-postgresql?topic=databases-for-postgresql-getting-started)
* [IBM Cloudant](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-getting-started-with-cloudant)
* [IBM Log Analysis](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-getting-started)
* [IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started)
* [IBM Cloud Monitoring](https://cloud.ibm.com/docs/Monitoring-with-Sysdig?topic=Monitoring-with-Sysdig-getting-started)
[vSphere encryption with Hyper Protect Crypto Services](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vrw-hpcs-mgmt.svg)

Figure 2. vSphere encryption with Hyper Protect Crypto Services for SaaS providers

The SaaS provider is responsible for deploying and managing both Hyper Protect Crypto Services and the KMIP for VMware instance for their IBM Cloud for VMware Regulated Workloads instance. The virtualization administrator creates the KMS cluster configuration in the vCenter. To protect the regulated data of the SaaS consumer and the SaaS provider, it is recommended that they use independent HPCS instances and root keys. The two-key approach balances both the stake holders rights and responsibilities.

Zoom

![Dual HPCS overview](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vrw-dual-hpcs.svg)

Figure 3. Dual HPCS overview



 HPCS - independent software vendor (ISV) view 

The SaaS provider initializes their root key material into the HPCS provisioned as part of the IBM Cloud for VMware Regulated Workloads deployment. This key integrates with the management platform and is used with vSphere encryption or vSAN encryption or any other tool that is used to encrypt any of the platform components.





 HPCS - financial institution view 

The SaaS consumer manages their own independent HPCS instance and introduces their own root key material. This key is critical to the security of the regulated data of the SaaS consumer and they would generate "descendant" keys for each individual SaaS provider they engage with.

The keys that are provided by the SaaS consumer are used to protect any regulated data from the SaaS consumer.







 HPCS flows 

Review the following information for the step-by-step process to order and initialize KMIP:
Application migration If your applications use the standard PKCS #11 API, you do not need to modify your existing applications specifically for EP11 or gRPC. In order to use the GREP11 API, you need to make sure that your applications are developed based on the EP11 requirements and gRPC specifications. 
 Authentication and access management The PKCS #11 library has a set of standard user types for authentication. You need to define these user types in an independent configuration file and assign different user types the corresponding IBM Cloud Identity and Access Management (IAM) roles for access management. For more information, see <br><br>[Best practices for setting up PKCS #11 user types](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-best-practice-pkcs11-access). The GREP11 API uses the standard IAM roles to define the corresponding access. For more information, see [Managing user access](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-access). 
 Additional configuration file Required. You need to configure all of the parameters that include user roles in this file to ensure the successful deployment of the PKCS #11 library. For more information, see the [configuration file template](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-pkcs-apistep3-setup-configuration-file). Not required. The parameters that are needed to connect the Hyper Protect Crypto Services cloud HSM can be set up along with the application code. 
 Keystore Provided by Hyper Protect Crypto Services. The keys that are generated with the PKCS #11 API are protected by the master key and are stored in cloud databases. Not provided by Hyper Protect Crypto Services. You need to store keys that are generated by the GREP11 API on the local workstation or other devices.
With Unified Key Orchestrator, you can push your keys to third-party cloud keystores, such as Azure Key Vault, AWS Key Management Service (KMS), Google Cloud KMS, or IBM Key Protect for IBM Cloud, distribute keys across keystores, and manage keys and keystores through both the UI and REST API.
* Unified key backup and management system

Unified Key Orchestrator enables you to back up all keys in IBM Cloud with your Hyper Protect Crypto Services instance. You can redistribute keys through your Hyper Protect Crypto Services instance to quickly recover from fatal cloud errors. And at the same time, you own the root trust of your key hierarchy.
* Key orchestration across multiple clouds

You can orchestrate keys through a single and unified user experience across multiple clouds with an auditable key lifecycle orchestration mechanism. For more information, see [Monitoring the lifecycle of encryption keys in Unified Key Orchestrator](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-key-states) and [Auditing events for Hyper Protect Crypto Services Hyper Protect Crypto Services with Unified Key Orchestrator](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-at-events).



For more information about Unified Key Orchestrator, see [Introducing Unified Key Orchestrator](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-introduce-uko).





 Key management service 

In the Hyper Protect Crypto Services with Unified Key Orchestrator plan, currently you can manage key management service (KMS) root keys and standard keys only through the API. For more information about the KMS API, see the [KMS API reference](https://cloud.ibm.com/apidocs/hs-crypto).



* Key lifecycle management

Hyper Protect Crypto Services provides a single-tenant key management service to create, import, rotate, and manage keys with the standardized API. After the encryption keys are deleted, you can be assured that your data is no longer retrievable.
* Encryption for IBM Cloud data and workload services