#cloudkms

Cloud KMS

A cloud-based key management system called Google Cloud Key Management Service (KMS) lets you generate, utilize, and maintain cryptographic keys as well as carry out cryptographic activities safely. Your data is safeguarded both in transit and at rest thanks to its unified platform for handling encryption keys.

Advantages

Expand your security worldwide

Expand your application to take advantage of Google’s worldwide reach while delegating to Google the burden of handling important management issues, such as handling redundancy, latency, and data residency.

Assist in fulfilling your compliance obligations

Utilize software-backed encryption keys, FIPS 140-2 Level 3 verified HSMs, customer-supplied keys, or an external key manager to simply encrypt your data in the cloud.

Benefit from Google Cloud product integration

Gain access to extra security features like Google Cloud IAM and audit logs while managing the encryption of data across all Google Cloud products using customer-managed encryption keys (CMEK).

Important characteristics of Cloud KMS

Handle encryption keys centrally

Cloud-based key management that lets you handle symmetric and asymmetric cryptographic keys for your cloud services as on-premises. EC P256, EC P384, AES256, RSA 2048, RSA 3072, and RSA 4096 may be produced, used, rotated, and destroyed.

Use HSM to provide hardware key security

Host encryption keys and carry out cryptographic functions in HSMs verified to FIPS 140-2 Level 3. You can safeguard your most sensitive workloads with this fully managed solution without having to worry about the administrative burden of running an HSM cluster.

Offer EKM support for external keys

Utilize encryption keys that are kept and controlled in an external key management system to encrypt data in Google services that are integrated. You may use the cloud computing and analytics capabilities while keeping your encryption keys and data at rest separate using External Key Manager.

Be the final judge of who may access your data

Key Access Justifications enhances your control over your data significantly when used in conjunction with Cloud EKM. It’s the only solution that allows you to see each request for an encryption key along with the reason behind it and a way to accept or reject decryption inside that request. The integrity promises made by Google extend to these measures.

Cloud KMS Google Use cases

Encourage adherence to regulations

Along with Cloud HSM and Cloud EKM, Cloud KMS Google supports a variety of compliance regulations that need certain key management practices and technology. It does this in a cloud-native, scalable manner without compromising the implementation’s agility. Hardware encryption (HSM), separating keys from data (EKM), and handling keys safely Cloud KMS are all required by various standards. Key management complies with FIPS 140-2 requirements.

Utilize safe hardware to manage encryption keys

Customers may need to store their keys and conduct crypto operations on a device approved by FIPS 140-2 Level 3 if they are subject to compliance rules. Customers may satisfy their regulator’s requirements and maintain compliance in the cloud by letting their keys be stored in an HSM that has undergone FIPS validation. Customers who want a certain degree of security that their important data cannot be seen or exported by the cloud provider must also be aware of this.

Control encryption keys off-cloud

Clients that must adhere to local or regulatory security regulations must use cloud computing while keeping ownership of the encryption keys. They may still use the cloud’s computing and analytics capabilities while keeping data at rest and encryption keys separate thanks to External Key Manager. Complete transparency on who has access to the keys, when they have been used, and where they are stored is maintained throughout this process.

Important Access Reasons and EKM Data Flow

Customers of Google Cloud may see every request for an encryption key, the reasoning behind it, and a way to accept or reject decryption in relation to that request via Key Access Justifications. The use cases center on data access visibility and enforcement.

Pervasive data encryption

Using your external key management system, securely encrypt data as it is transmitted to the cloud so that only a private virtual machine VMs service is able to decode and process it.

The ability to digitally sign code and certify that the software their clients are downloading is authentic and hasn’t been maliciously altered is essential for developers to establish confidence in the software industry. For many companies, keys used to sign code are the crown jewels of cryptography, thus keeping them safe is crucial.

Security features for creating, managing, and limiting access to cryptographic keys are offered by Google Cloud‘s Cloud Key Management System (KMS). Create, store, and carry out cryptographic activities like code signing using keys in its tamper-resistant Cloud hardware security modules (Cloud HSM) with the intuitive interface provided by Cloud KMS.

Cloud HSM Google

What is Cloud HSM?

Hosting encryption keys and conducting cryptographic operations in a cluster of FIPS 140-2 Level 3 certified HSMs is possible with Cloud HSM, a cloud-hosted Hardware Security Module (HSM) service. Clustering, scaling, and patching are not concerns for you because Google looks after the HSM cluster. All the capabilities and advantages that Cloud KMS offers are yours to utilize because Cloud HSM leverages Cloud KMS as its front end.

Create a key ring

In a specific Google Cloud location, you add a key that you have created to a key ring. A new key ring can be made, or an old one can be used.

In a Google Cloud location that is compatible with Cloud HSM, create a key chain.

Navigate to the Key Management section within the Google Cloud dashboard.

Press the Generate key ring button.

Enter your key ring’s name in the “Key ring name” field.

Choose an address such as “us-east1” for the Key Ring location.

Click “Create.”

Create a key

For the designated key ring and location, follow these steps to produce a Cloud HSM key.

Navigate to the Key Management section within the Google Cloud dashboard.

In order to create a key, click the name of the key ring.

To create a key, click Create.

Select Generated key under the What kind of key do you want to create? field.

Name your key by entering its name in the Key name field.

To select HSM, click the dropdown menu for Protection level.

Choose “Symmetric encrypt/decrypt” from the drop-down menu.

Take the Rotation period and Starting on as given by default.

Click “Create.”

Bare Metal Rack HSM

Additional HSM features, such single-tenancy, are available through Google Cloud. Customers can host their own HSMs in the space given by Google with the help of Bare Metal Rack HSM. If you need further details, ask your account representative.

Provider for Microsoft Cryptography API: Next Generation (CNG)

An application programming interface called Microsoft Cryptography API: Next Generation (CNG) enables programmers to include encryption, encoding, and authentication into Windows-based applications. With CNG providers installed on the system, you may also use tools like Windows signtool to conduct crypto operations. To work with current apps that make use of the CNG API, Cloud KMS provides a provider that complies with this standard.

The provider is licensed under the Apache 2.0 license and is run as an open source project on GitHub. The Google Cloud Terms of Service apply to release binaries obtained from the GitHub releases page, and Cloud Customer Care offers support.

For Microsoft’s Cryptography API: Next Generation (CNG) provider, Google Cloud just released support for Cloud KMS signing. This feature allows you to secure your keys using Cloud HSM and SignTool to sign code on Microsoft assets.

As to the Cyber Safety Review Board of the U.S. government, hardware security modules are regarded as an optimal approach for cloud security since they keep keys in isolated and segmented systems. Threat actors have been observed to compromise and use legitimate signing keys to access data and systems inside the key’s domain when HSMs and other recommended practices are not followed.

In Cloud HSM, the servers housing the HSM hardware are shielded from illegal operations, the signature keys are designated as non-extractable, and the hardware is not directly connected to any network. It is more difficult to unintentionally reveal or steal the signing keys thanks to these security hardening methods.

In the past, you had to lock the keys to your Windows artifacts using hardware that wasn’t hosted by Google Cloud. With FIPS 140-2 Level 3 guarantees, cloud HSM safeguards your signature keys. Additionally, by only charging for the keys you use, it can lower your infrastructure and operating expenses. To suit your workload needs, Cloud HSM is offered in many locations.

You may distribute your software to your clients more quickly by using Google Cloud KMS CNG provider to expedite the signing procedure and save significant time.

Starting a Cloud KMS CNG provider: A Guide

Its cloud-based KMS CNG provider has four primary purposes. Apply it as necessary:

Verify firmware using a private key secured by a FIPS 140-2 Level 3 HSM.

Use the standard SignTool executable on Windows to sign Microsoft Windows artifacts.

transfer the burden of managing keys, which includes access control, rotation, and creation;

Use logging and auditing capabilities to gain visibility and attribution.

These crucial results can be attained by following these steps:

Install the CNG provider

Create your signing key

Get your certificate

Sign your artifact

Install the CNG provider 

In the Google Cloud GitHub repository, it has uploaded the CNG provider’s released binaries. The.msi installer that is given can be used to install these on your Windows PC. Once that’s done, setup your provider according to the user manual.

Use Cloud HSM to generate your signing key

Make a signature key that is Cloud HSM hardware protected when you’ve finished making your key ring. Depending on your security needs, choose the asymmetric signature algorithm.

Install your signing certificate

Access Cloud HSM by importing your signing certificate. This provides robust hardware-based protection for your signing key.

Create a signature key that is encrypted using Cloud HSM and generate a certificate signing request (CSR) if you don’t already have one. Next, give the certificate authority the CSR to obtain a fresh code signing certificate.

Sign your artifacts

SignTool can be used to cryptographically sign your artifact once you have installed your CNG provider, generated a key in Cloud HSM, and obtained your certificate. Ascertain that the appropriate flags are provided, such as the key URI from Cloud HSM and the provider name Google Cloud KMS Provider.