1.0 Introduction
This article describes how to integrate Fortanix-Data-Security-Manager (DSM) with Google Cloud Platform (GCP) services. It also contains the information that a user needs to:
Enable the Cloud Key Management Service (KMS) API in your GCP project.
Obtain the GCP service account email address.
Import the Google Advanced Encryption Standard (AES) Key in Fortanix DSM.
Complete the GCP setup.
Fortanix DSM supports the following customer-managed encryption keys (CMEK) integration services on the Google Cloud:
Cloud Logging: Log Router
Google Kubernetes Engine: Data on VM disks or Application-layer Secrets
Refer to the Cloud EKM documentation for the complete list.
1.1 Why Use Fortanix Data Security Manager With Google Cloud EKM
Google Cloud’s External Key Manager allows services running on the Google Cloud Platform (GCP), namely Big Query and Google Compute Engine (GCE), to use an encryption key managed by an external key management service and controlled entirely by the customer.
To read more about the announcement of Google Cloud External Key Manager (EKM) and the Fortanix DSM integration, read the Google and Fortanix announcement blogs.
Fortanix DSM protects all your data on-premises as well as in the cloud. It provides end-to-end security for keys and data (at rest, in transit, and in use) protected with layers of defense, including Fortanix Runtime Encryption®, Intel® SGX, and FIPS-validated hardware. Only authorized users can access keys.
2.0 Terminology References
Fortanix Data Security Manager (DSM)
Fortanix DSM is a cloud solution secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as secrets, such as passwords, API keys, tokens, or any blob of data.
GCP - Google Cloud Platform
The Google Cloud Platform is a suite of public cloud computing services offered by Google. The platform includes a range of hosted services for compute, storage, and application development that run on Google hardware. Google Cloud Platform services can be accessed by software developers, cloud administrators, and other enterprise IT professionals over the public internet or through a dedicated network connection.
Google KMS - Google Key Management Service
Google Cloud Key Management Service (KMS) is a cloud service for managing encryption keys for other Google cloud services that enterprises can use to implement cryptographic functions. For more information, see Google Cloud Key Management Service.
AES - Advanced Encryption Standard
Google uses the Advanced Encryption Standard (AES) algorithm to encrypt data at rest. The reason for AES's wide usage is:
The National Institute of Standards and Technology (NIST) recommends both AES256 and AES128 for long-term storage use (as of November 2015)
Customer compliance requirements often include AES. For more information, please see the Advanced Encryption Standard.
SGX - Software Guard Extensions
Intel’s Software Guard Extensions (SGX) are a set of extensions to the Intel architecture that aim to provide integrity and confidentiality guarantees to security-sensitive computation performed on a computer where all the privileged software (kernel, hypervisor, and so on) is potentially malicious.
FIPS - Federal Information Processing Standards
FIPS is a set of standards that describe document processing, encryption algorithms, and other information technology standards for use within non-military government agencies and by government contractors and vendors who work with the agencies.
3.0 Prerequisites
Fortanix Data Security Manager
GCP Services
Google Cloud Project
AES key
The GCP Project Owner must enable the Cloud Key Management Service (KMS) API in your GCP Project. Refer to the Google documentation for steps to enable the Cloud KMS API in your GCP project.
The user trying to add the EKM key to the GCP keyring must have a Cloud KMS admin role.
The GCP project owner must enable BigQuery API access in your GCP Project.
The user using BigQuery must have permission to use BigQuery and permission to access the EKM key that Fortanix creates.
NOTE
The AES key can either be imported or created in Fortanix DSM, or it can be automatically created using the Google EKM easy wizard integration in Fortanix DSM.
4.0 Using Fortanix Data Security Manager with GCP Service
4.1 Overview
With Google Cloud Platform (GCP) External Key Manager, administrators use Fortanix DSM to store cryptographic keys for encrypting and decrypting GCP workloads, including BigQuery and Google Compute Engine (GCE).
4.2 Enable KMS API in Your GCP project
See Google documentation for steps on how to enable Google External Key Manager API in your GCP project.
4.3 Obtain Your Google Service Account Email Address
Fortanix DSM requires the identity of the GCP service account in your Google Cloud project. GCP automatically creates this service account once the KMS API is enabled. GCP creates this service account by default with unmodifiable appropriate permissions. This service account is not viewable from your IAM; it is a backend service account controlled by GCP. This is in the format of the following email address, using your own project-number, where specified:
service-[PROJECT-NUMBER]@gcp-sa-ekms.iam.gserviceaccount.com
In the example above, PROJECT-NUMBER is the project number of your Google Cloud Platform project.
You can look up your project number using the following instructions:
Creating and managing projects | Resource Manager Documentation | Google Cloud
4.4 Obtaining Access in Fortanix Data Security Manager
Create an account in Fortanix DSM if you do not have one already. See the Fortanix DSM Getting Started.
4.5 GCP EKM Configuration Using Fortanix DSM Easy Wizard
To create a GCP EKM app using the Google Cloud EKM wizard in Fortanix DSM SaaS:
Sign up at https://smartkey.io/. This opens DSM SaaS for the AMER region. DSM SaaS supports multiple regions, as listed here.
Log in to the Fortanix DSM UI.
Click the Integrations tab in the left panel.
On the Integrations page, click ADD INSTANCE on the Google Cloud EKM wizard.
Enter the details as shown in the screenshot below:
Add Instance: This name identifies the created instance.
Google service account email: Enter the name of the service account email you acquired before.
NOTE
The Google service account email must match the email address of an existing Google service account.
Select the key access justification reasons for wrapping or unwrapping the key.
Figure 1: Create instance
The user can allow access to wrap or unwrap keys for the following types of key access justification options:
NOTE
Selecting the allowed key justification reasons below defines an access policy for the app.
Accept All: Select Accept All to allow access for all the justification reasons provided below. You can also customize your selection and select specific justification criteria for access.
Customer-initiated support – Support initiated by the customer, for example, Case Number: ####.
Customer-initiated access – The customer or a third party authorized by the customer's IAM policy performs any access to the customer's data.
Google-initiated service – Google-initiated access, for example, to perform system management and troubleshooting, which includes:
Backup and recovery from outages and system failures.
An investigation will be conducted to confirm that the customer is not affected by suspected service issues.
Remediation of technical issues, such as storage failure or data corruption.
Google-initiated review – Google-initiated access for security, fraud, abuse, or compliance purposes including:
Ensuring the safety and security of customer accounts and content.
Confirming if an event, such as malware infections, has affected the content and may impact account security.
Confirming whether the customer is using Google services in compliance with the Google Terms of Service.
Investigating complaints by other users and customers or other signals of abusive activity.
Ensuring consistent use of Google services under relevant compliance regimes, such as anti-money laundering regulations.
Google-initiated system operation – Google-initiated access for security, fraud, abuse, or compliance purposes.
Third-party data request – Customer-initiated access by Google to respond to a legal request or legal process, including when responding to a legal process from the customer that requires Google to access the customer's content. Note that Access Transparency logs, in this case, may not be available if Google cannot legally inform the customer of such a request or process.
Unspecified reason – Indicates the actor accessing the data provided no access reason for the request. This may have been due to a transient error, a bug, or some other unexpected circumstance.
No justification reason expected – Indicates no reason is expected for this key request as the service in question has never integrated with Key Access Justification or is still in the pre-GA state and therefore may still have residual methods that call the External Key Manager but do not provide a justification.
Modified customer-initiated access – A customer uses their account to perform any access that is authorized by their own IAM policy; however, a Google administrator has reset the superuser account associated with the user’s organization within the last 7 days.
Modified Google-initiated system operation – Google initiated access to customer data to perform indexing, structuring, pre-computation, hashing, sharding, and caching to optimize the structure and quality of data for future uses by the customer.
Google responses to production alert – Google-initiated access to main system reliability.
Allow missing justification: Select this option to allow access even if a justification is not provided.
Click SAVE INSTANCE.
Saving the instance creates the following automatically for the Google Cloud EKM instance:
A GCP app with the name of the Google Service Account Email.
Figure 2: GCP EKM app
An AES key with “encrypt” and “decrypt” permissions.
Figure 3: AES key
4.6 Enable GCP Service to Access AES Key in Fortanix Data Security Manager
The GCP service needs to know a URL that allows it to access a key stored in Fortanix DSM. This is known as the external_key_uri.
The following is the format of the Google EKM URI.
https://<DSM_URL>/v0/gcp/key/key_id
Where<DSM_URL>is the domain of your DSM, for example:us.smartkey.io,eu.smartkey.io.<key_id>is the UUID of the AES key.
To obtain the
external_key_uriof the AES key, go to the Google Cloud EKM instance table. For the AES key that was automatically created using the easy wizard, click GET KEY URI under the Key URI column.
Figure 4: Get key URI
In the Get Key URI modal window, click the copy icon
to copy the Key URI.
Figure 5: Copy key URI
You now have the Google EKMS URL.
You can also get the Google EKMS URL from the DSM Security Objects table.
From the Fortanix DSM Security Objects table, click the AES key created using the Google Cloud EKM easy wizard.
In the detailed view of the AES key, click COPY GOOGLE EKMS URI in the COPY ID drop-down menu.
Figure 6: Get the Google EKMS URL
Use the resource URL above to complete the GCP setup.
5.0 Edit Authentication Method for an Existing App
To change the authentication method for an existing app to Google Service Account from the detailed view of the app.
In the detailed view of an app, click the INFO tab, and in the API Key section, click the Change authentication method drop-down menu.
Figure 7: Change Authentication Method
Select Google Service Account and click SAVE to save the setting.
Figure 8: Select Authentication Method
In the Configure authentication method window, select the key justification reasons and click UPDATE. Refer to Section 4.5 to learn about the justification policies.
NOTE
The app name must match the email address of an existing Google Service Account.
Figure 9: Select Key Justification Reason
The application is updated with the new authentication method.
Figure 10: Authentication Method Updated
6.0 Edit Key Access Justification Reason for an Existing App
You also have the option to edit the key justification reason for an existing app.
In the detailed view of an app, click the INFO tab, and in the Google Service Account section, click the SHOW INSTRUCTIONS button.
Figure 11: Edit Existing Key Justification Reason
In the Google Service Account window, click the EDIT button.
Figure 12: Edit Key Justification Reason
Edit the allowed justification reason and click SAVE AND CLOSE to save the new updates.
7.0 Add Key Access Justification Policy for an Existing Key (Optional)
You can also change the authentication method for an existing key from the Security Objects page.
NOTE
Fortanix DSM first checks the provided access reason against the app-level policy.
If the provided access reason passes at the app level, then Fortanix DSM checks it against the key-level policy.
If the provided access reason passes at both the app level and key level, Fortanix DSM executes the operation.
If the provided access reason passes at the app level but fails at the key level, Fortanix DSM throws an error: “Request violates Security-object's access reason policy.”
On the Security Objects page, select the key for which you want to change the key justification policy.
Figure 13: Select the Key
In the detailed view of the key, click the KEY ACCESS JUSTIFICATION tab, and then click ADD POLICY to add a new key access justification policy.
Figure 14: Change Key Authentication Method
The Accept All option is selected by default. Click Save to apply all the defined access justification policies to the key.
Figure 15: Change Key Authentication Method (Default Settings)
To change the applicable policies, clear the Accept All option, select the access justification policies that you want to apply to the key, and then click Save. Refer to Section 4.5 to learn about the justification policies.
Figure 16: Update Key Policies
The key is updated with the new justification policy.
8.0 Edit Key Level Justification Policy for an Existing Key
You can also edit and change the authentication method for an existing key from the detailed view of a security object. After you have applied the policies to a key, you will see the EDIT POLICY button.
On the Security Objects page, select the key for which you want to edit the key access justification reason. In the detailed view of the key, click the KEY ACCESS JUSTIFICATION tab, and then click EDIT POLICY.
Figure 17: Edit Key Authentication Method
Clear the default policies you want to remove, select the policies you want to add, and then click SAVE.
Figure 18: Update Key Policies
The key is updated with the new access justification policy.
9.0 References
Google Cloud Key Management Service
GCP Key Manager Service API
Fortanix DSM Getting started
users-guide-getting-started-with-fortanix-data-security-manager-ui
Advanced Encryption Standard
Enable Billing in GCP