Your suggested change has been received. Thank you.

close

Suggest A Change

https://thales.na.market.dpondemand.io/docs/dpod/services/kmo….

Thales Logo

All

  • All
back

Google External Key Manager Ubiquitous Data Encryption Resources

Managing Google EKM UDE endpoints

search

Please Note:

Managing Google EKM UDE endpoints

After meeting some prerequisites to allow Google Cloud External Key Manager Ubiquitous Data Encryption (EKM UDE) Service to access CipherTrust Manager, you can create and manage an endpoint in CipherTrust Cloud Key Manager(CCKM) for Google Cloud EKM UDE service to access a Key Encryption Key (KEK) using CCKM's GUI and REST API.

Caution

This feature is a technical preview for evaluation in non-production environments. A technical preview introduces new, incomplete functionality for customer feedback as we work on the feature. Details and functionality are subject to change. This includes API endpoints, UI elements, and CLI commands. We cannot guarantee that data created as part of a technical preview will be retained after the feature is finalized.

After you have created an endpoint, you can:

Prerequisites

To allow a connection between CipherTrust Manager and Google Cloud External Key Manager Service, some network and security configuration must be in place in both entities.

CipherTrust Manager Prerequisites

  • The web interface must have a TLS certificate signed by an external Certificate Authority (CA) trusted by Google Cloud Platform. Google Cloud trusts certificates issued by well-known public CAs such as Verisign. Alternatively, you can create a certificate chain with Google's Certificate Authority Service and upload the chain to CipherTrust Manager.

  • The CipherTrust Manager must have a public IP address with the 443 HTTPS port open. See Network Interface Configuration for details.

  • The CipherTrust Manager must be reachable through a Fully Qualified Domain Name (FQDN). Use the format ciphertrust.<your_domain>.com, for example ciphertrust.mycompany.com. Google Cloud recognizes the ciphertrust prefix and allows traffic to that domain.

  • A Google project must be added to the CipherTrust Cloud Key Manager before creating an endpoint. The steps to add the project are in the subsequent paragraphs below.

Google Cloud Platform Prerequisites

The default policy for endpoints does not require Key Access Justifications. If Key Access Justifications are required, these must be enabled in the Google account before Google services will provide these. After enabling these in the Google account, the default policy can be modified to un-comment the input.justificationReason section to apply Key Access Justification restrictions.

Add Google Project to CipherTrust Cloud Key Manager

Before creating an endpoint, a Google project must be added to CCKM. Below, we provide the steps to add a Google project to CCKM.

  1. Login to the CipherTrust Manager products page.

  2. Navigate to Cloud Key Manager > Containers > Google.

  3. Select Projects.

  4. Select Add Existing Project.

  5. Select Manually Enter Project ID.

  6. Enter your GCP Project ID.

Create an EKM UDE Endpoint

You create a Google EKM UDE endpoint in the CipherTrust Manager GUI and to make the endpoint available to Google Cloud EKM. You can also use the /v1/cckm/ekm-e2e/endpoints endpoint in the REST API to associate metadata information with the endpoint.

  1. Login to the CipherTrust Manager products page.

  2. Navigate to Cloud Key Manager > Services > Google Cloud EKM UDE

  3. Select Create Endpoint.

  4. Provide a Name and a Key URI Hostname for your endpoint. For the purpose of this tech preview kindly input “ciphertrust.thalescpl.io” in the textbox of the Key URI Hostname.

  5. Select which operations must enforce a requirement for confidential computing. The available operation enforcements are "Confidential computing required for encryption" and "Confidential computing required for decryption)". Consult the information box for further details on the implications of the selections.

    An AES-256 Key Encryption Key (KEK) is created, with a unique URI that acts as the Google EKM endpoint key. The hostname is applied to the URI, to create a path that Google Cloud can access. The endpoint is displayed in the Google Cloud EKM UDE Endpoints table.

    Caution

    The KEK should only be managed by the CipherTrust Cloud Key Manager (CCKM). Managing the keys directly via CipherTrust Manager Key management functions can result in the KEK becoming unavailable to the Google Cloud EKM service unexpectedly.

  6. Go to the Google Cloud Platform (GCP), copy the Service Account, and paste the service account details in the policies textbox. In CCKM, Cloud Key Manager>Services>Google Cloud EKM UDE, click the chevron icon to expand the details of the endpoint. Replace the text {"test1@fakeemail.com", "test2@fakeemail.com", "test3@fakeemail.com"} with your GCP service account.

    Note

    The service account is in the “Externally Managed Key” page of the Create Key flow in GCP. The Service Account is above the textbox where you will paste the external key URI in GCP.

  7. Copy the key URI by clicking the copy icon next to the key URI,return to the GCP console, and paste the key URI to complete the create key flow.

  8. Consult Google documentation on using the EKM UDE integration library and/or command-line utility for using the EKM UDE functionality either on premise or in a confidential VM.

Change the Base Hostname

You can patch the /v1/cckm/ekm-e2e/endpoints/{id} REST API endpoint, as described in the API Guide.

In the GUI:

  1. Login to the CipherTrust Manager Products page.

  2. Navigate to Cloud Key Manager > Services > Google Cloud EKM UDE.

  3. Find the endpoint in the list, and click the ellipsis icon (...) at the far right for options.

  4. Click View/Edit.

  5. In the Edit Endpoint window, enter a new Key URI hostname and click Save.

Enable or Disable Key Wrapping

You can post to the /v1/cckm/ekm-e2e/endpoints/{id}/enable and /v1/cckm/ekm-e2e/endpoints/{id}/disable REST API endpoints, as described in the API Guide. Disabling key wrapping temporarily suspends Google Cloud EKM UDE's ability to use the KEK.

In the GUI:

  1. Login to the CipherTrust Manager Products page.

  2. Navigate to Cloud Key Manager>Services>Google Cloud EKM UDE.

  3. Find the endpoint in the list, and click the ellipsis icon (...) at the far right for options.

  4. Click Enable or Disable.

Delete the Endpoint

Caution

Once the endpoint has been deleted, the key cannot be restored.

You can delete the /v1/cckm/ekm-e2e/endpoints/{id}/ REST API endpoint, as described in the API Guide.

In the GUI:

  1. Login to the CipherTrust Manager Products page.

  2. Navigate to Cloud Key Manager>Services>Google Cloud EKM UDE.

  3. Find the endpoint in the list, and click the ellipsis icon (...) at the far right for options.

  4. Click Delete.

View Activity for a (Confidential) Wrap or Unwrap Endpoint

These endpoints are called from either workloads, via the Google-provided integration tools.

This functionality is available with the /v1/cckm/ekm-e2e/endpoints/{id}:confidentialwrap and /v1/cckm/ekm/endpoints/{id}:confidentialunwrap REST API endpoints, as described in the API Guide.

Requests to these endpoints generate a record under Records> Server Records in the GUI, and the /v1/audit/records endpoint in the API. These records can be helpful to monitor CMEK activity or troubleshoot CMEK problems.

View Attestation Activity

In EKMS, using an EKM UDE endpoint for wrap or unwrap operations requires a three-step process:

  1. The establishment of a secure TLS 1.3 session between the Google-provided integration component and CipherTrust Manager.

  2. The optional provision of attestation information/proofs over this secure session, allowing CipherTrust Manager to assess the data-in-use protection capabilities of the requester.

  3. The submission and handling of (confidential) wrap and unwrap requests, over this secure session.

The TLS sessions which are established have a session lifetime of 600 seconds, allowing multiple confidential wrap/unwrap requests to be handled by any given session. Thus, any confidential wrap or unwrap request can be associated with a secure channel and any secure channel can be associated with a set of attestation proofs (or none in the case of an on premise, non-confidential environment).

All relevant details are captured in CipherTrust Manager's Server Records, allowing cross-referencing of confidential wrap/unwrap requests with sessions with attestations.

The EKM UDE API contains a set of ‘Session’ endpoints, namely: session/begin session; session/handshake; session/negotiate attestation; session/finalize and session/end session.
These endpoints allow the establishment of a secure TLS 1.3 session between the Google-provided integration component and CipherTrust Manager. Further details on these endpoints is beyond the scope of this document.

On this page