Fortanix External Key Control and Management for Google Cloud Platform (GCP)

Fortanix External Key Manager generates and stores encryption keys outside of Google Cloud (GCP) and within customer datacenters.

Download Datasheet

hero image

Most organizations are looking to move their data and workloads into the public cloud. But they are held back because of compliance reasons or regulatory reasons and they are not comfortable with the cloud holding onto their keys. Organizations need greater control and security over their cloud keys. Fortanix integrates with Google Cloud Platform’s External Key Manager service to enable organizations to move the data to the cloud and get the same level of security for keys that they’re used to in their own on-prem environments. Protect your BigQuery and other cloud native services data by doing server-side encryption. Keys for the encryption are never stored at GCP. They are always under your control, away from the cloud. At a click of a button, in real time, enable and disable access to your data from specific instances and locations.

paypal-gcp-generic

Key Benefits

icon

COMPLETE CONTROL OF KEYS

Fortanix allows customers to stop decryption of data-at-rest with a kill switch and the key material never leaves the Fortanix Key Management Service. Customer gets complete control of how to authorize the use of the Google Cloud’s External Key Manager keys.
icon

MEET COMPLIANCE REQUIREMENTS

Fortanix offers a FIPS 140-2 Level 3 certified Fortanix Runtime Encryption® Appliance, to store cloud keys on-premises enabling financial services, healthcare, and other regulated industries to meet their compliance requirements.
icon

SIMPLIFIED AND CENTRALIZED ENCRYPTION

Fortanix with Google Cloud’s External Key Manager provides a single, simple, and centralized encryption platform that accelerates moving applications to public cloud, while also providing a single set of cryptographic services to on-premises, hybrid, and cloud workloads.
icon

UNIFIED DATA PROTECTION PLATFORM

Fortanix delivers HSM, Key Management, Encryption and Tokenization for your hybrid and cloud native apps, all from a single integrated solution.

Key Features

EXTERNAL KEY MANAGEMENT

Encrypt data in the google cloud using encryption keys stored outside the cloud. Enforce access to data at rest for BigQuery and Compute Engine.

CONTROL FULL KEY LIFECYCLE

Maintain full control and visibility into key creation, location, and distribution of cloud keys.

SECURE DATA IN USE

Runtime Encryption® Technology plugin uses Intel® SGX Secure Enclave technology to protect data always.

FIPS 140-2 LEVEL 3 CERTIFIED

Store and protect encryption keys on-premises with FIPS 140-2 Level 3 certified HSMs

DISTRIBUTED AND SCALABLE ARCHITECTURE

Distributed architecture allows for key replication and scales depending on changing requirements of the organization.

How does Google Cloud’s External Key Manager work?

Services running on GCP, such as Big Query and GCE, currently can use an encryption key hosted by Google Cloud KMS or Cloud HSM to secure their data at rest. An envelope encryption scheme is followed where the data is encrypted using a local data encryption key (DEK), which in turn is encrypted using a key encryption key (KEK) in Cloud KMS or Cloud HSM. Google allays the concerns of customers who don’t want to trust the public cloud by extending the envelope encryption scheme to allow the KEK to be encrypted using an externally managed key encryption key (EKEK).

how-it-works

Ready to test Fortanix Runtime Encryption?

Request a demo
thumbnail