vania-janet/multiturn-rag-retrieval-data huggingface dataset:
(https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![Checkmark icon.](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![Checkmark icon.](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![Checkmark icon.](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![Checkmark icon.](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 
 [Data-At-Rest Encryption](https://cloud.ibm.com/docs/BlockStorage?topic=BlockStorage-mng-data) ![Checkmark icon.](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![Checkmark icon.](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![Checkmark icon.](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![Checkmark icon.](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![Checkmark icon.](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![Checkmark icon.](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![Checkmark icon.]
Bring your own key (BYOK): When you [enable a key management service (KMS) provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkeyprotect) for your cluster, you bring your own root key. The root key is used to encrypt the data encryption keys (DEKs) which are then used to encrypt the secrets in your cluster. The root key is stored in the KMS provider instance that you control. The encrypted DEKs are stored in etcd and can only be unencrypted using the root key from the KMS provider. For more information about how key encryption works, see [Envelope encryption](https://cloud.ibm.com/docs/key-protect/concepts?topic=key-protect-envelope-encryptionenvelope-encryption).
3. Worker node disks: Attached disks are used to boot your worker node, host the container file system, and store locally pulled images. The encryption and number of disks varies by infrastructure provider.



* VPC: See [VPC worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-encryptionworker-encryption-vpc).
* Classic: See [Classic worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-encryptionworker-encryption-classic).



4. Cluster secrets: When you deploy your app, don't store confidential information, such as credentials or keys, in the YAML configuration file, configmaps, or scripts. Instead, use [Kubernetes secrets](https://kubernetes.io/docs/concepts/configuration/secret/), which are base64 encoded by default. To enable encryption of your Kubernetes secrets, [enable a key management service (KMS) provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkeyprotect) for your cluster.
5.
[Decrypting Portworx volumes](https://cloud.ibm.com/docs-content/v1/content/bce0f0917a9eea684d1b4b704ac6343a1f65f446/openshift/images/cs_px_volume_decryption.png)

Figure 2. Decrypting Portworx volumes



1. Kubernetes sends a request to decrypt an encrypted volume.
2. Portworx requests the DEK for the volume from the Portworx etcd database.
3. The Portworx etcd looks up the DEK and returns the DEK to the Portworx cluster.
4. The Portworx cluster calls the IBM Key Protect or Hyper Protect Crypto Services API UnWrapDEK by providing the DEK and the root key (CRK) that is stored in the Portworx secret.
5. IBM Key Protect or Hyper Protect Crypto Services unwraps the DEK to extract the passphrase and returns the passphrase to the Portworx cluster.
6. The Portworx cluster uses the passphrase to decrypt the volume. After the volume is decrypted, the passphrase is removed from the Portworx cluster.







 Setting up volume encryption 

To protect your data in a Portworx volume, you can create an instance of a KMS provider such as IBM Key Protect or Hyper Protect Crypto Services.

If you don't want to use IBM Key Protect or Hyper Protect Crypto Services root keys to encrypt your volumes, you can select Kubernetes Secret as your Portworx secret store type during the Portworx installation. This setting gives you the option to store your own custom encryption key in a Kubernetes secret after you install Portworx.
[Creating virtual server instances with customer-managed encryption volumes](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-instances-byok) 
 [Key Management Interoperability Protocol (KMIP) for VMware® on IBM Cloud](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip_standalone_considerations) KMIP for VMware® works together with VMware native vSphere encryption and vSAN encryption to provide simplified storage encryption management. By integrating with Hyper Protect Crypto Services, you can use Hyper Protect Crypto Services to manage encryption keys that are used by VMware® solutions on IBM Cloud. <br><br> * Overview: [KMIP for VMware® on IBM Cloud](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip_standalone_considerations)<br> * Tutorial: [Use IBM Cloud Hyper Protect Crypto Services to encrypt VMware disks](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-kmip-vmware)<br> * Overview video: [IBM Cloud Hyper Protect Crypto Services and VMware® on IBM Cloud solutions](https://mediacenter.ibm.com/media/0_4wm4bq4s)<br> * Demo video: [Configuring KMIP in Hyper Protect Crypto Services for key management and distribution](https://mediacenter.ibm.com/media/1_e5gk6ktn)<br><br><br> 
 [Entrust DataControl for IBM Cloud](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-entrust-dc_considerations) - formerly known as HyTrust CloudControl The Entrust DataControl service integrates with Hyper Protect Crypto Services to protect your data with strong encryption and scalable key management.
[Decrypting Portworx volumes](https://cloud.ibm.com/docs-content/v1/content/4d497aff9e27b92fbbc2ee4e343a9ec4549cb1d7/containers/images/cs_px_volume_decryption.png)

Figure 2. Decrypting Portworx volumes



1. Kubernetes sends a request to decrypt an encrypted volume.
2. Portworx requests the DEK for the volume from the Portworx etcd database.
3. The Portworx etcd looks up the DEK and returns the DEK to the Portworx cluster.
4. The Portworx cluster calls the IBM Key Protect or Hyper Protect Crypto Services API UnWrapDEK by providing the DEK and the root key (CRK) that is stored in the Portworx secret.
5. IBM Key Protect or Hyper Protect Crypto Services unwraps the DEK to extract the passphrase and returns the passphrase to the Portworx cluster.
6. The Portworx cluster uses the passphrase to decrypt the volume. After the volume is decrypted, the passphrase is removed from the Portworx cluster.







 Setting up volume encryption 

To protect your data in a Portworx volume, you can create an instance of a KMS provider such as IBM Key Protect or Hyper Protect Crypto Services.

If you don't want to use IBM Key Protect or Hyper Protect Crypto Services root keys to encrypt your volumes, you can select Kubernetes Secret as your Portworx secret store type during the Portworx installation. This setting gives you the option to store your own custom encryption key in a Kubernetes secret after you install Portworx. For more information, see the [Portworx documentation](https://docs.portworx.com/key-management/kubernetes-secrets/configuring-kubernetes-secrets-with-portworx).
You don't need to perform the EncryptUpdate and EncryptFinal suboperations for a single-part encryption. Before you call this function, make sure to run EncryptInit first.

Enterprise PKCS #11 over gRPC

Enterprise PKCS #11

PKCS #11





 Description Binds to EP11 m_Encrypt, which is an implementation of PKCS #11 C_Encrypt. 
 Parameters message EncryptRequest { bytes State = 1; bytes Plain = 2; } message EncryptResponse { bytes Ciphered = 3; } 
 Return values Wraps EP11 error into message Grep11Error. 



Code snippets



* Golang code snippet

plainText := "Encrypt this message"

EncryptRequest := &pb.EncryptRequest {
State: EncryptInitResponse.State,
Plain: plainText,
}

EncryptResponse, err := cryptoClient.Encrypt(context.Background(), EncryptRequest)
* JavaScript code snippet

client.Encrypt({
State: state,
Plain: Buffer.from(message)
}, (err, response) => {
callback(err, response);
});







 EncryptUpdate 

The EncryptUpdate function continues a multiple-part encryption operation. Before you call this function, make sure to run EncryptInit first.

Enterprise PKCS #11 over gRPC

Enterprise PKCS #11

PKCS #11





 Description Binds to EP11 m_EncryptUpdate, which is an implementation of PKCS #11 C_EncryptUpdate. 
 Parameters message EncryptUpdateRequest { bytes State = 1; bytes Plain = 2; } message EncryptUpdateResponse { bytes State = 1; bytes Ciphered = 3; } 
 Return values Wraps EP11 error into message Grep11Error. 



Code snippets
Bring your own key (BYOK), for VPC and classic only: When you [enable a key management service (KMS) provider](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionkeyprotect) for your cluster, you bring your own root key. The root key is used to encrypt the data encryption keys (DEKs) which are then used to encrypt the secrets in your cluster. The root key is stored in the KMS provider instance that you control. The encrypted DEKs are stored in etcd and can only be unencrypted using the root key from the KMS provider. For more information about how key encryption works, see [Envelope encryption](https://cloud.ibm.com/docs/key-protect/concepts?topic=key-protect-envelope-encryptionenvelope-encryption).
3. Worker node disks: Attached disks are used to boot your worker node, host the container file system, and store locally pulled images. The encryption and number of disks varies by infrastructure provider.



* VPC: See [VPC worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionworker-encryption-vpc).
* Classic: See [Classic worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionworker-encryption-classic).
* Satellite: See [Satellite worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionworker-encryption-satellite).



4. Cluster secrets: When you deploy your app, don't store confidential information, such as credentials or keys, in the YAML configuration file, configmaps, or scripts. Instead, use [Kubernetes secrets](https://kubernetes.io/docs/concepts/configuration/secret/), which are base64 encoded by default.
Save, or persist to storage, the ciphertext to make sure you can retrieve the DEK with the kp key unwrap command.

It is recommended that you never save, or persist to storage, the plaintext DEK. In your application, load the ciphertext from storage, call Key Protect to get the plaintext DEK, and use the DEK to encrypt, or wrap, "other" pieces of information.

Do not save the DEK to persistent storage. Exposing the DEK may allow others to decrypt your data.

A new ciphertext is create each time the root key is wrapped.





 Examples 

These are examples of kp key wrap.



 Example 1 

Key Protect creates a new base64-encoded data encryption key (DEK) and wraps it with the root key.

 create a root key
$ ibmcloud kp key create my-root-key

Creating key: 'my-root-key', in instance: '390086ac-76fa-4094-8cf3-c0829bd69526'...
OK
Key ID Key Name
807eb0a6-cc10-4bfe-8331-41a6f712c4ea my-root-key

 create a new key and wrap it with the root key, creating a DEK (this is the ciphertext)
$ ibmcloud kp key wrap 807eb0a6-cc10-4bfe-8331-41a6f712c4ea

Wrapping key...
OK
Ciphertext
eyJjaXBoZXJ0ZXh0IjoiKzhjbHVqcUNP ...<redacted>... NmY3MTJjNGViIn0=

 capture the ciphertext
$ CIPHERTEXT=eyJjaXBoZXJ0ZXh0IjoiKzhjbHVqcUNP ...<redacted>... NmY3MTJjNGViIn0=

 unwrap the ciphertext to reveal the plaintext (DEK)
The following [IBM Cloud Framework for Financial Services controls](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-aboutframework-control-requirements) are most related to this guidance. However, in addition to following the guidance here, do your own due diligence to ensure you meet the requirements.



Table 1. Related controls in IBM Cloud Framework for Financial Services

 Family Control 

 Contingency Planning (CP) [CP-2 (3) Contingency Plan | Resume Essential Missions / Business Functions](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-2.3) <br>[CP-6 Alternate Storage Site](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-6) <br>[CP-7 Alternate Processing Site](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-7) <br>[CP-10 Information System Recovery and Reconstitution](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-10) 







 Next steps 



* [Data encryption at rest](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-encryption-at-rest)
CP-9 - Information System Backup 



 Control requirements 

The organization:

CP-9 (a)
: Conducts backups of user-level information contained in the information system [IBM Assignment: daily incremental; weekly full];

CP-9 (b)
: Conducts backups of system-level information contained in the information system [IBM Assignment: daily incremental; weekly full];

CP-9 (c)
: Conducts backups of information system documentation including security-related documentation [IBM Assignment: daily incremental; weekly full]; and

CP-9 (d)
: Protects the confidentiality, integrity, and availability of backup information at storage locations.





 Implementation guidance 

See the resources that follow to learn more about how to implement this control.



* [Business continuity and disaster recovery overview](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-bcdr)







 IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



Rules for CP-9 in IBM Cloud for Financial Services v1.2.0 profile

 Requirement ID Rules 

 CP-9 (b) <br><br> * Check that any Cloud Object Storage buckets used by Activity Tracker Event Routing are configured as cross-region<br> * Check that Hyper Protect Crypto Services has failover units in at least 2 different regions that are Financial Services Validated<br><br><br> 
 CP-9 (d) <br><br> * Check that any Cloud Object Storage buckets used by Activity Tracker Event Routing are configured as cross-region<br> * Check that Hyper Protect Crypto Services has failover units in at least 2 different regions that are Financial Services Validated<br><br><br> 







 NIST supplemental guidance 

System-level information includes, for example, system-state information, operating system and application software, and licenses. User-level information includes any information other than system-level information.
Event Streams is a highly available Kafka as a service. Given the nature of eventing systems, point in time backups are likely of little value. However, [mirroring to a second region](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-mirroring_setup) is recommended for disaster recovery.





 Other services 

For more information on backups, see service-specific documentation.







 Related controls in IBM Cloud Framework for Financial Services 

The following [IBM Cloud Framework for Financial Services controls](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-aboutframework-control-requirements) are most related to this guidance. However, in addition to following the guidance here, do your own due diligence to ensure that you meet the requirements.



Table 1. IBM Cloud Framework for Financial Services controls

 Family Control 

 Contingency Planning (CP) [CP-2 Contingency Plan](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-2) 
 [CP-6 Alternate Storage Site](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-6) 
 [CP-7 Alternate Processing Site](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-7) 
 [CP-9 Information System Backup](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-9) 
 [CP-10 Information System Recovery and Reconstitution](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-10)
[Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/icons/checkmark-icon.svg) 
 RAID-5/6 erasure coding ![Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/icons/checkmark-icon.svg) 
 Data at rest encryption ![Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/icons/checkmark-icon.svg) 
 Stretched cluster with local failure protection ![Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/icons/checkmark-icon.svg) 







 Related links 



* [Overview of VMware Solutions](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-solution_overview)
* [Design overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-design_overview)
* [Backing up components](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-solution_backingup)
Satellite Config <br><br> * Back up information about saved Satellite configurations in etcd.<br> * When service is restored, automatically deploy configuration files to available clusters.<br><br><br> <br><br> * Design, implement and test a disaster recovery plan for your [highly available apps](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_deployhighly_available_apps).<br><br><br> 
 Satellite Link N/A <br><br> * Reinstate any necessary [endpoints](https://cloud.ibm.com/docs/satellite?topic=satellite-link-location-cloud) to your resources after recovering from a disaster.<br><br><br> 
 Satellite Storage <br><br> * Back up information about storage configurations and assigned clusters.<br><br><br> <br><br> * Ensure that your data is stored highly available by using snapshots, data replication, data synchronization, or other high availability mechanisms.<br> * Back up your data to meet compliance and regulatory requirements for data retention.<br> * Use the provided tools from your storage provider or in your on-prem data center to monitor physical storage instances and replace defective instances as necessary.<br><br><br> 
 Satellite-enabled services <br><br> * Review each service's documentation for additional responsibilities that IBM maintains.<br><br><br> <br><br> * Review each service's documentation for additional responsibilities that you fulfill when you use these services.<br><br><br>
In addition, a geographically separate region should be used as an [alternative storage site](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-bcdryour-workloads-requirements-alternate-storage-site). This means you should use [cross region resiliency](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-endpointsendpoints-geo) for all of your Object Storage buckets.

To start working with Object Storage, see the following instructions:



* [Getting started with Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-getting-started-cloud-object-storage)
* [Connecting to Object Storage from VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-connecting-vpc-cos)
* [Encrypting your data](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-encryption)







 Related controls in IBM Cloud Framework for Financial Services 

More details on some of the major IBM Cloud Framework for Financial Services controls related to storage can be found in the following articles:



* [Encryption at rest](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-encryption-at-rest)
* [Backup and recovery](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-bcdr)







 Next steps 



* [Audit logging of IBM Cloud events](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-logging-audit)
Offers the rich features of an on-premises InfoSphere® Master Data Management deployment without the cost, complexity, and risk of managing your own infrastructure. 
 [IBM Cloud® Backup](https://cloud.ibm.com/docs/Backup?topic=Backup-getting-started) An automated agent-based backup system that is managed through a browser-based management utility. You can back up data between servers in one or more data centers on the IBM Cloud network. 







 Next steps 

To continue, see [Managing your infrastructure](https://cloud.ibm.com/docs/cloud-infrastructure?topic=cloud-infrastructure-managing).
[Setting up disaster recovery with Portworx](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_recoverystorage_portworx_recovery)

[Backing up and restoring apps and data with PX-Backup](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_backupstorage_portworx_backup)



* [Installing PX-Backup on a Red Hat OpenShift on IBM Cloud cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_backuppx-backup-install)
* [Verifying your PX-Backup installation](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_backuppx-backup-verify)
* [Logging in to the PX-Backup console](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_backuppx-backup-ui)
* [Adding a backup location to your PX-Backup service](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_backuppx-backup-storage)
* [Adding a Red Hat OpenShift on IBM Cloud cluster to your PX-Backup service](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_backuppx-backup-cluster)
* [Installing Stork on a non-Portworx cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_backuppx-backup-stork)
* [Creating a backup with the kmpd command](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_backuppx-kdmp)