Fortanix Data Security Manager with Double Key Encryption for Microsoft 365

1.0 Introduction

This article describes how to integrate Fortanix-Data-Security-Manager (DSM) with Microsoft 365 Double Key Encryption (DKE).

It also contains the information that a user needs to:

• Create an Encryption Key in Fortanix DSM.

• Configure and deploy the DKE Service in Microsoft Azure/IIS.

• Create a Sensitivity label with DKE encryption enabled in Microsoft 365 account.

• Use Double Key Encryption labels to protect data.

2.0 Infrastructure Requirements

• DSM service must be accessible from DKE services.

• DKE service SSL certificate must be signed by Public CA.

• Microsoft office 365 users must install Microsoft Unified Labelling Client in their machines.

• Connectivity between DKE service and Microsoft o365 service must exist.

3.0 Prerequisites

Ensure the following:

• Fortanix DSM must be accessible. For more information, refer to Section 6.1: Signing Up and Section 6.2: Creating an Account.

• Windows Server configured with IIS Server if deploying DKE service on premises. The minimum configuration required is 4vcpu and 16 GB memory.

• Admin user access to Microsoft Compliance Centre https://compliance.microsoft.com/ for creating labels.

• For Microsoft (MS) Office end-user: Microsoft 365 Apps for enterprise version 2009 or later installed on your Windows Desktop.

  • Ensure Microsoft Active Directory Rights Management Services Client file msipc.dll is installed at one of these locations.

    • C:\Program Files (x86)\Microsoft Office\root\Office16\MSIPC

    • C:\Program Files\Microsoft Office\root\Office16\MSIPC

  • If not present, try reinstalling MS Office.

• Install Azure Information Protection unified labeling client on Microsoft (MS) Office end-user machines. For more information, refer to the
  Microsoft Purview Information Protection client.

• On each client, open the Registry Editor and check that the following registry values are defined:

  [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\MSIPC\flighting]
  "DoubleKeyProtection"=dword:00000001
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSIPC\flighting]
  "DoubleKeyProtection"=dword:00000001

  NOTE

  Some registry keys may also need to be created.

• Public CA-signed certificate for DKE Service.

 4.0 DKE Best Practices

• Avoid creating multiple labels for similar data classification categories. Publish the label to only the required group of people.

• Create a rotation policy for the keys and do not delete the old keys until all the documents are relabelled.

• Create a group quorum policy so that no changes are made at the group level without approval.

• Restrict the exposure of the DKE service to your client machines and Azure AD.

• While troubleshooting any DKE related issue, look for errors/clues in the:

  • DKE server event viewer logs

  • Fortanix DSM backend logs

  • Azure information protection logs in the client machine

5.0 Key Management Support with DKE

• DKE service currently supports RSA 2048 keys.

• Key rotation supported today with Fortanix provided DKE service.

• Once the key is rotated, don’t perform the key delete/destroy operation until documents are relabeled with the rotated key.

• Set an expiry to the rotated key which will expire after a few days of key rotations. (1-2 weeks)

• You can choose to create different data classification labels like Classified, Confidential, and Private with different encryption keys. All Fortanix DSM keys for labels must exist in the same group.

• Each label in the Azure compliance center maps to a key in Fortanix DSM. You can create multiple labels and each label will have a different key from Fortanix DSM.

• Key Created in Fortanix DSM policy must have padding policy with:

  • Encryption - OAEP Hashing Algorithm SHA256

  • Signature - PKCS1v15, PSS Hashing Algorithm SHA256

• Keys created in Fortanix DSM must have Encrypt, Decrypt, Wrap, Unwrap, and APPMangeable permissions. It can have EXPORT permission for future migrations.

• Define Quorum policy on the group to restrict any unwarranted key modifications.

6.0 Configure Fortanix DSM

A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections:

6.1 Signing Up

To get started with the Fortanix DSM cloud service, you must register an account at <Your_DSM_Service_URL>. For example,https://eu.smartkey.io.

For detailed steps on how to set up the Fortanix DSM, refer to the User's Guide: Sign Up for Fortanix Data Security Manager SaaS documentation.

6.2 Creating an Account

Access <Your_DSM_Service_URL> in a web browser and enter your credentials to log in to Fortanix DSM.

For more information on how to set up an account in Fortanix DSM, refer to the User's Guide: Getting Started with Fortanix Data Security Manager - UI.

7.0 Using SaaS Deployment

7.1 Creating a Microsoft Instance

Perform the following steps:

1. Log into the Fortanix DSM user interface (UI). On-premises customers use KMS URL and the SaaS customers can use the URLs as listed here based on the application region.

2. In the DSM left navigation panel, click the Instances menu item, and then select the Cloud Key Management/BYOK check box. Click ADD INSTANCE on the Microsoft wizard.

   

3. On the Add Instance page, do the following:

   1. Title: Enter a name for your instance.

4. Click SAVE INSTANCE.

   

   With creating an instance, a new group and app are created within the Fortanix DSM.

7.2 Microsoft Instance Detailed View

Navigate to the Integrations menu item → Microsoft wizard → Microsoft instances table. In the instance detailed view page, the following information is represented:

• API KEY: Click VIEW API KEY DETAILS to view the details of API key, such as username and password.

• RSA KEYS: Click MANAGE to oversee the keys created.

• INSTANCE STATUS: To disable the created instance, toggle the Disabled option.

• DELETE: To delete the instance, click the overflow menu and select the DELETE option. Note that deleting an instance will result in the removal of the app, group, and all security objects associated with the instance, rendering all key material inaccessible.

8.0 Using On-premises Deployment

8.1 Creating a Group

Perform the following steps to create a group in the Fortanix DSM:

1. In the DSM left navigation panel, click the Groups menu item, and then click the + button to create a new group.

   

2. On the Adding new group page, do the following:

   1. Title: Enter a name for your group.

   2. Description (optional): Enter a short description of the group.

3. Click SAVE to create the new group.

The new group is added to the Fortanix DSM successfully.

8.2 Creating an Application

Perform the following steps to create an application (app) in the Fortanix DSM:

1. In the DSM left navigation panel, click the Apps menu item, and then click the + button to create a new app.

   

2. On the Adding new app page, do the following:

   1. App name: Enter the name of your application.

   2. ADD DESCRIPTION (optional): Enter a short description of the application.

   3. Authentication method: Select the default API Key as the authentication method from the drop down menu. For more information on these authentication methods, refer to the User's Guide: Authentication.

   4. Assigning the new app to groups: Select the group created in Section 8.1: Creating a Group from the list.

3. Click SAVE to add the new application.

The new application is added to the Fortanix DSM successfully.

8.3 Copying the API Key

Perform the following steps to copy the API key from the Fortanix DSM:

1. In the DSM left navigation panel, click the Apps menu item, and then click the app created in Section 8.2: Creating an Application to go to the detailed view of the app.

2. On the INFO tab, click VIEW API KEY DETAILS.

3. From the API Key Details dialog box, copy the API Key of the app to use it in Section 7.2.4: DSM API Key.

8.4 Creating a Security Object

Perform the following steps to generate an AES key in the Fortanix DSM:

1. In the DSM left navigation panel, click the Security Objects menu item, and then click the + button to create a new security object.

   

2. On the Add new Security Object page, do the following:

   1. Security Object name: Enter the name for your security object. For example, MicrosoftDKEServiceKey.

   2. Group: Select the group as created in Section 8.1: Creating a Group.

   3. Select the GENERATE radio button.

   4. In the Choose a type section, select the AES key type.

   5. In the Key Size section, select the size of the key in bits.

   6. In the Key operations permitted section, select the required operations to define the actions that can be performed with the cryptographic keys, such as encryption, decryption, signing, and verifying.

3. Click GENERATE to create the new security object.

4. You must modify the Padding Policy. Click SAVE.

   

9.0 Deploy DKE Service

A Double Key Encryption Service is required to be deployed, which exposes the external key for use by Microsoft 365 services. Microsoft provides a sample DKE Service code which works with a local encryption key file https://github.com/Azure-Samples/DoubleKeyEncryptionService.

Fortanix provided DKE Service is enhanced to add support for Fortanix DSM Keys. This now serves keys and offloads decryption operations to Fortanix DSM, instead of operating on local key files.

The DKE service can be easily installed as Azure App Service or on your on-premises IIS Server.

9.1 Deploy on IIS

1. Download the DKE Service deployment bundle from here.

2. Unzip this zip file into the IIS wwwroot folder. For example: C:\inetpub\wwwroot\AspnetCore46

   1. Edit the appsettings.json file and add configurations as per Section 4.3.

   2. Load your application.

3. Install Microsoft .NET Core SDK 3.1.416 (x64) and Microsoft .NET 6.0.2 - Windows Server Hosting for AspNetCoreModuleV2 dependencies.

4. Create IIS site using the path. Install SSL certificate on the site so that DKE can communicate with Azure AD.

   

9.2 Configure DKE Service

The DKE service requires a few configurations to be set up as explained in the sections below. Set the deployment configuration in the file appsettings.json as following:

9.2.1 Tenant ID

Edit the section ValidIssuers and update the value: https://sts.windows.net/<tenantid>/ .

Where, <tenantid> is the Azure Active Directory tenant ID.

For example:

"AzureAd": {
       "Instance": "https://login.microsoftonline.com/",
       "ClientId": "[Client_id-of-web-api-eg-2ec40e65-ba09-4853-bcde-bcb60029e596]",
       "TenantId": "common",
       "Authority": "https://login.microsoftonline.com/common/v2.0",
       "TokenValidationParameters": {
               "ValidIssuers": [
                        "https://sts.windows.net/9c99431e-b513-44be- a7d9-e7b500002d4b/"
               ]
       }
}

9.2.2 JWT Audience

Edit the section JwtAudience with the endpoint of the IIS server or Azure App Service endpoint.

For example:

"JwtAudience" : "https://dkeservice.mycompanydomain.com"

9.2.3 DSM API Endpoint

Edit the section FortanixDSMConfig:ApiEndpoint with the endpoint of the Fortanix DSM cluster.

For example:

"FortanixDSMConfig": {
     "ApiEndpoint": "https://<fortanix_dsm_url>"
}

9.2.4 DSM API Key

Edit the section FortanixDSMConfig:ApiKey with the authentication Fortanix DSM API key as copied in Section 8.3: Copying the API Key.

For example:

"FortanixDSMConfig": {
"ApiKey": "BJ0oijJYHYU78h6g...05KGkh84GJLK"
}

9.2.5 Authorized Email Addresses

Add section AuthorizedEmailAddress with the list of specific users allowed to use Fortanix DSM Keys for decryption. If this is empty or not present, then all the users from your Azure AD tenant are allowed access.

For example:

"AuthorizedEmailAddress": ["[email protected]", "[email protected]"]

9.2.6 Final Configuration

The following is an example of the final appsettings.json file:

{ 
     "AzureAd": {
              "Instance": "https://login.microsoftonline.com/",
              "ClientId": "[Client_id-of-web-api-eg-2ec40e65-ba09-4853-bcde-bcb60029e596]",
              "TenantId": "common",
              "Authority": "https://login.microsoftonline.com/common/v2.0",
              "TokenValidationParameters": {
                       "ValidIssuers": ["https://sts.windows.net/9c99431e-b513-44be-a7d9-e7b500002d4b/"]
              }
     },
     "Logging": {
             "LogLevel": {
                      "Default": "Information"
             },
             "EventLog": {
                      "LogLevel": {
                               "Default": "Information"
                       }
             }
     },
     "AllowedHosts": "*",
     "JwtAuthorization": "https://login.windows.net/common/oauth2/authorize",
     "JwtAudience" : "https://dkeservice.mycompanydomain.com",
     "AuthorizedEmailAddress": ["[email protected]", "[email protected]"],
     "FortanixDSMConfig": {
              "ApiEndpoint": "https://<fortanix_dsm_url>",
              "ApiKey": "BJ0oijJY...0kh84GJLK"
     }
}

9.3 Register DKE App in Azure AD

The deployed DKE Service must be registered for Microsoft 365 access. This registration allows Microsoft apps to generate authentication tokens for the DKE service.

1. In your browser, open the Microsoft Azure portal, and go to All Services → Other → App registrations.

2. Select New registration and enter a meaningful name.

3. Select an account type from the options displayed (usually the value to be selected is “Single tenant”).

   

4. At the bottom of the page, select Register to create the new App Registration.

5. In your new App Registration, in the left pane, under Manage, select Authentication.

6. In the Platform configurations, click Add a platform.

   

7. On the Configure platforms popup, select Web.

   

8. In the Configure Web form:

   1. Under Redirect URIs, enter the URI of your double key encryption service. Enter the DKE Service Endpoint URL, For example: https://dkeservice.fortanix.com

   2. Under Implicit grant and hybrid flows, select the ID tokens check box.

   3. Click Configure to save your changes.

9. On the left pane, select Expose an API, then next to Application ID URI, and click Set.

10. Enter the DKE Service endpoint URL, For example: https://dkeservice.fortanix.com. Click Save.

11. On the Expose an API page, in the Scopes defined by this API section, and select Add a scope.

12. In the Add a scope form:

    1. Define the Scope name as user_impersonation.

    2. Select the administrators and users who can consent.

    3. Define any remaining values required.

    4. Click Add scope to save your changes.

       

13. On the Expose an API page, in the Authorized client applications section, select Add a client application. In the new client application:

    1. Define the Client ID as d3590ed6-52b3-4102-aeff-aad2292ab01c (Please use this exact value). This value is the Microsoft Office client ID, which enables Office to obtain an access token against the DKE Service.

    2. Under Authorized scopes, select the user_impersonation

    3. Click Add application to save your changes.

       

    4. Repeat the above steps for another Client ID as c00e9d32-3c8d-4a7d-832b-029040e7db99 (Please use this exact value). This value is the client ID for Microsoft Azure Information Protection Client.

Your DKE service is now registered. Continue by testing connectivity and creating sensitivity labels using DKE.

9.3.1 Test Connectivity between DKE and Fortanix DSM

1. Run the curl command to check DKE connectivity with Fortanix DSM-

2. curl -v https://<dkeserviceurl>/<RSAKeyName>>

3. It should return a 200 response code with RSA public key.

9.3.2 Create Sensitivity Labels using DKE

In the Microsoft 365 compliance center:

1. Create a new sensitivity label and apply encryption as you would otherwise.

2. Select Use Double Key Encryption and enter the endpoint URL for your key. For example: https://mycompanydomain.com/MicrosoftDKEServiceKey.
   Where, MicrosoftDKEServiceKey is the name of the Fortanix DSM key as created in Section 8.4: Creating a Security Object.

   

3. Publish the label using the label Policy.

Any DKE labels that you add will start appearing for users in the latest versions of Microsoft 365 Apps for the enterprise.

Now you can apply these labels to the Microsoft Documents. After these labels are applied, the document is kept encrypted using Fortanix DSM Keys.

NOTE:

• You can create multiple labels with different DSM keys. However, DSM keys need to exist in the same app.

• DKE key can be rotated without impact on existing labeled documents.

• You can define a quorum policy on the DKE group to restrict any modifications to the DKE key.

10.0 References

1. Double Key Encryption for Microsoft 365: https://docs.microsoft.com/en-us/microsoft-365/compliance/double-key-encryption

2. Double Key Encryption Troubleshooting Guide by Microsoft: https://techcommunity.microsoft.com/t5/security-compliance-and-identity/dke-troubleshooting/ba-p/2234252

3. Fortanix DSM Getting Started: https://support.fortanix.com/hc/en-us/articles/360015809372-Getting-Started-with-DSM