Fortanix Data Security Manager with Google Control Plane Using Virtual Private Cloud

Last Updated: November 03, 2023 12:37

1.0 Introduction

This article describes integrating Fortanix Data Security Manager (DSM) with Google External Key Manager Control Plane using a Virtual Private Cloud (VPC) network. It also contains the information that a user needs to:

Enable the Cloud Key Management Service (KMS) API in your GCP project
Obtain the GCP service account email address
Configure a GCP External Key Manager (EKM) connection
Create a key ring in Google Cloud KMS
Create an external key in GCP EKM
Complete the GCP key setup

Fortanix DSM supports the following customer-managed encryption keys (CMEK) integration services on the Google Cloud:

Artifact Registry
BigQuery
Compute Engine
Cloud Logging: Log Router
Cloud Spanner
Cloud SQL
Cloud Storage
Dataflow Appliance and Dataflow shuffle
Dataproc
Google Kubernetes Engine: Data on VM disks or Application-layer Secrets
Pub/Sub
Secret Manager

Refer to the Cloud EKM documentation for the complete list.

1.1 Why Use Fortanix Data Security Manager With Google Cloud EKM Control Plane Using VPC

Google Cloud’s External Key Manager allows services running in the Google Cloud Platform (GCP), namely Big Query and Google Compute Engine (GCE) to use an encryption key managed in an external key management service and controlled entirely by the customer. A Cloud Deployment Architect for GCP can access an EKM through a Virtual Private Cloud (VPC) network to satisfy their data sovereignty requirements. Fortanix DSM implements the Cloud EKM control plane to allow customers to perform EKM management operations such as creating, rotating, or destroying keys from Cloud KMS, without having to access the DSM user interface or APIs directly. This eliminates the need for the customer to manually coordinate key maintenance between Cloud KMS and their EKM.

Fortanix DSM protects all your data on-premises as well as in the cloud. It provides end-to-end security for keys and data (at-rest, in-transit, and in-use) protected with layers of defense including Fortanix Runtime Encryption®, Intel® SGX , and FIPS-validated hardware; Only authorized users can access keys.

2.0 Terminology References

Fortanix Data Security Manager (DSM)

Fortanix DSM is the cloud solution secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as secrets, such as passwords, API keys, tokens, or any blob of data.

GCP - Google Cloud Platform

Google Cloud Platform is a suite of public cloud computing services offered by Google. The platform includes a range of hosted services for compute, storage, and application development that run on Google hardware. Google Cloud Platform services can be accessed by software developers, cloud administrators, and other enterprises IT professionals over the public internet or through a dedicated network connection.

Google KMS - Google Key Management Service

Google Cloud Key Management Service (KMS) is a cloud service for managing encryption keys for other Google cloud services that enterprises can use to implement cryptographic functions. For more information, see Google Cloud Key Management Service.

VPC – Virtual Private Cloud

A Virtual Private Cloud (VPC) network is a virtual version of a physical network that is implemented inside of Google's production network. For more information on what a VPC network does, refer to the Google documentation here.

Crypto space

A crypto space is a logical workspace that contains keys and in which new keys can be created. Crypto space is a combination of:

Fortanix DSM group
Fortanix DSM app with same name as Google service account:

SGX - Software Guard Extensions

Intel’s Software Guard Extensions (SGX) is a set of extensions to the Intel architecture that aims to provide integrity and confidentiality guarantees to security-sensitive computation performed on a computer where all the privileged software (kernel, hypervisor, and so on) is potentially malicious.

FIPS - Federal Information Processing Standards

FIPS is a set of standards that describe document processing, encryption algorithms, and other information technology standards for use within non-military government agencies and by government contractors and vendors who work with the agencies.

3.0 Prerequisites

Fortanix Data Security Manager
GCP Services
Google Cloud Project
The GCP Project Owner must enable the Cloud Key Management Service (KMS) API in your GCP Project. Refer to the Google documentation for steps to enable the Cloud KMS API in your GCP project.
The user trying to create the GCP key ring must have a Cloud KMS Admin role.
The GCP Project Owner must enable BigQuery API access in your GCP Project.
The user using BigQuery must have permission to use BigQuery and permission to access the EKM key that Fortanix creates.

NOTE

The AES key can either be imported or created in Fortanix DSM.

4.0 Fortanix Data Security Manager with GCP Service Using VPC

4.1 Overview

With Google Cloud Platform (GCP) External Key Manager Control Plane, users perform key lifecycle management operations like creation, rotation, and destruction of keys held in an EKM directly from Cloud Key Management Service to encrypt or decrypt GCP workloads including BigQuery and Google Compute Engine (GCE). An Administrator for GCP can deploy a VPC network to reverse proxy the EKM requests and can access an EKM through this Virtual Private Cloud (VPC) network to satisfy their data sovereignty requirements.

4.2 Enable KMS API in Your GCP Project

See Google documentation for steps to enable Google External Key Manager API in your GCP project.

4.3 Obtain Your Google Service Account Email Address

Fortanix DSM requires the identity of the GCP service account in your Google Cloud project. This service account is automatically created by GCP once the KMS API is enabled. This service account exists by default and has the appropriate permissions, which cannot be modified. This service account will also not be viewable from your IAM; it is a backend service account controlled by GCP. This is in the format of the following email address, using your own project-number, where specified:

service-[PROJECT-NUMBER]@gcp-sa-ekms.iam.gserviceaccount.com

In the example above, PROJECT-NUMBER is the project number of your Google Cloud Platform project.

You can look up your project number using the following instructions:

Creating and managing projects | Resource Manager Documentation | Google Cloud

4.4 Obtaining Access in Fortanix Data Security Manager

Create an account in Fortanix DSM if you do not have one already. See the Fortanix DSM Getting Started.

4.5 Create an App in Fortanix Data Security Manager

To create an application (app) in Fortanix DSM, specify the Google service account email as the application name and the Google Service Account as the authentication method.

In the Fortanix DSM account, click the Apps tab.
Create a new Fortanix DSM app using the button .
In the Adding new app form, do the following:
1. In the App name field, type the name of the service account email you acquired before.
  
  NOTE
  
  The app name must match the email address of an existing Google Service Account.
2. In the Authentication method, click Google Service Account.
  
  The user can allow access to wrap/unwrap keys for the following types of key access justification options:
  
  NOTE
  
  Selecting the allowed key justification reasons below defines an access policy for the app.
  - Accept All: Select Accept All to allow access for all the justification reasons provided below. You can also customize your selection and select specific justification criteria for access.
    - Customer-initiated support – Support initiated from the customer, for example, Case Number: ####.
    - Customer-initiated access – Customer or a third-party authorized by customer's IAM policy perform any access to the customer's data.
    - Google-initiated service – Google-initiated access, for example, to perform system management and troubleshooting which includes:
      - Backup and recovery from outages and system failures
      - Investigation to confirm that the customer is not affected by suspected service issues
      - Remediation of technical issues, such as storage failure or data corruption
    - Google-initiated review – Google-initiated access for security, fraud, abuse, or compliance purposes including:
      - Ensuring the safety and security of customer accounts and content
      - Confirming whether the content is affected by an event that may impact account security (for example, malware infections)
      - Confirming whether the customer is using Google services in compliance with Google Terms of Service
      - Investigating complaints by other users and customers, or other signals of abusive activity
      - Checking that Google services are being used consistently with relevant compliance regimes (for example, anti-money laundering regulations)
    - Google-initiated system operation – Google-initiated access for security, fraud, abuse, or compliance purposes.
    - Third-party data request – Customer-initiated access by Google to respond to a legal request or legal process, including when responding to a legal process from the customer that requires Google to access the customer's own content. Note that Access Transparency logs, in this case, may not be available if Google cannot legally inform the customer of such a request or process.
    - Unspecified reason – Indicates the actor accessing the data provided no access reason for the request. This may have been due to a transient error, a bug, or some other unexpected circumstance.
    - No justification reason expected – Indicates no reason is expected for this key request as the service in question has never integrated with Key Access Justification or is still in the pre-GA state and therefore may still have residual methods that call the External Key Manager but does not provide a justification.
    - Modified customer-initiated access – A customer uses their account to perform any access which is authorized by their own IAM policy; however, a Google administrator has reset the superuser account associated with the user’s organization within the last 7 days.
    - Modified Google-initiated system operation – Google initiated access of customer data to perform indexing, structuring, precomputation, hashing, sharding and caching to optimize the structure and quality of data for future uses by the customer.
    - Google responses to production alert – indicates Google-initiated access to main system reliability.
  - Allow missing justification: Select this option to allow access even if a justification reason is not provided.
3. Assign the app to the group created in Section 4.4: Obtaining Access in Fortanix Data Security Manager.
4. Edit the app permissions by clicking the dotted square on the right. For the Google Cloud EKM Control Plane implementation, the following permissions must be selected for the GCP app for objects in the group. These permissions map to the corresponding GCP crypto space permissions.
  - Manage → Create – Create security object
  - Manage → Destroy – Destroy security object
  - Encrypt
  - Decrypt
  - Get Public Key
  - Get Info
  NOTE
  
  In the DSM 4.23 version, the Get Public Key and Get Info permissions are not visible in the create GCP EKM application workflow. To edit or update these permissions, you must first create the application, and then from the detailed view of the application you can access the Get Public Key and Get Info permissions by clicking the Edit Permissions icon.

4.6 Configure GCP External Key Manager Connection

Set up a Cloud External Key Manager (Cloud EKM) to connect to your external key management (EKM) provider over a Virtual Private Cloud (VPC) network. See Google documentation for steps to Create an EKM Connection.

4.7 Create a GCP Key Ring

A key ring is the root resource for Cloud KMS keys and key versions. To create a key ring in Cloud KMS, refer to Google’s Documentation – Create a Key Ring.

4.8 Create an External Key with EKM Connection Type as VPC

To create a Cloud EKM key on a key ring in Cloud KMS, refer to Google’s Documentation: Create a Coordinated External Key. After the required configuration is done to create an external key, the Cloud EKM sends a request to Fortanix DSM to create a new key. The key shows as “Pending generation” until the key path is returned by DSM and the Cloud EKM key is available.

5.0 References

1. Google Cloud Key Management Service

https://cloud.google.com/kms/ekm/docs/

2. GCP Key Manager Service API

https://cloud.google.com/kms/docs/reference/rest/

3. Fortanix DSM Getting started

https://support.fortanix.com/hc/en-us/articles/360015809372-Getting-Started-with-Fortanix-Data-Security-Manager

4. Advanced Encryption Standard

https://www.researchgate.net/publication/317615794_Advanced_Encryption_Standard_AES_Algorithm_to_Encrypt_and_Decrypt_Data

5. Enable Billing in GCP

https://cloud.google.com/billing/docs/how-to/modify-project