1
– Introduction
Google Cloud Platform Integration Guide
7
1
Introduction
Overview
This integration guide describes how to store the Customer Supplied Encryption Key (CSEK) on a SafeNet Luna
HSM partition. By default, Google Compute Engine uses encryption keys stored in the cloud to encrypt all data
at rest and manages this encryption for you without any additional actions on your part. Keeping the encryption
keys in the cloud, however, may not be in compliance with security standards. To avoid this issue, you can
control and manage this encryption yourself, by providing your own encryption keys.
If you provide your own encryption keys, Compute Engine uses your key to encrypt, and therefore protect the
Google-generated keys used to encrypt and decrypt your data. Only users who can provide the correct
encryption key can use resources protected by a customer-supplied encryption key.
Google does not store your encryption keys on their servers and cannot access your protected data unless you
provide the key. If you forget or lose your encryption key, there is no way for Google to recover the key or to
recover any data encrypted with the lost key. In this guide, we will cover the installation and configuration of
Google Cloud Platform on Windows Server 2012 R2 using SafeNet Luna HSM.
The benefits of using SafeNet Luna HSM with the Google Cloud Platform are:
Secure storage of the CSEK Keys
FIPS 140-2 level 3 validated hardware
Full life cycle management of the keys
Understanding the Customer Supplied Encryption Key
Server-side encryption refers to encryption that occurs after Cloud Storage receives your data, but before the
data is written to disk and stored.
As an alternative to a Google-managed server-side encryption key, you can choose to provide your own AES-
256 key, encoded in standard Base64. This key is known as a customer-supplied encryption key (CSEK). If you
provide a CSEK, Cloud Storage does not permanently store your key on Google's servers or otherwise manage
your key. Instead, you provide your key for each Cloud Storage operation, and your key is purged from Google's
servers after the operation is complete. Cloud Storage stores only a cryptographic hash of the key so that future
requests can be validated against the hash. Your key cannot be recovered from this hash, and the hash cannot
be used to decrypt your data.
Customer-supplied encryption keys can apply to operations on an object that read or write data. Operations
such as deleting or listing objects can be performed without providing the encryption key.
