Encrypting Data Encryption Keys

When a user opens a blank encrypted document, a random Data Encryption Key (DEK) is generated and the document is encrypted with it. After the third-party identity provider user authentication is successful, an authentication token (3P JWT) is generated. The user is authenticated using a Google JWT and third-party JWT. KACLS wraps the DEK with the key associated with the KACLS endpoint URL and returns a wrapped key. The encrypted document with its wrapped key is uploaded to the Google Workspace server.

To create an encrypted Google Docs document:

1. Open the Google Drive console, http://drive.google.com.

2. Log on as an end user.

3. Click New > Google Docs > Blank encrypted document.

   

   A message prompting to sign in with your identity provider is displayed, as shown below.

   

4. Sign in with the configured third-party identity provider's user credentials.

5. Make your changes and save the document, as shown below.

   

The document is encrypted. KACLS’s wrap API is called to encrypt the document. The wrap requests are logged at KACLS (under Cloud Key Manager > Records), as shown below.

These requests are also visible at KACLS (under Records > Server Records).