IBM Developer

Tutorial

Protect data at rest with Fortanix and IBM Hyper Protect Services

Boost the security of your keys to protect your organization

By Sandeep Batta, Faisal Faruqui

On this page

The Fortanix Data Security Manager (DSM) platform helps security, data, risk management, and DevOps teams work together and simplify cryptographic operations to secure sensitive data. Fortanix takes a data-centric approach to cybersecurity that minimizes expensive data breaches and accelerates regulatory compliance.

At the core of DSM is the Fortanix cluster master key (CMK), which is used to derive other keys generated by DSM to accomplish its data-security mission. The CMK is generated as one of the first steps when creating the DSM Cluster. When you use the Fortanix DSM Appliance, the CMK is protected using the keys built into the CPU, such as the SGX sealing key and the SGX attestation key.

For virtual platforms, you can opt in for the CMK protection using an external hardware security module (HSM). You can enable it during cluster creation so that Fortanix DSM derives the CMK from another key, the cluster deployment key (CDK), which is stored in an external hardware security module and connected through the HSM Gateway. The CMK is derived from two pieces of information: the CDK, generated by the external HSM, and the seed, generated by the Fortanix DSM. See the Fortanix DSM Architecture Guide for a detailed description of keys and key hierarchy.

Fortanix and IBM Hyper Protect Services

At the core of the IBM Hyper Protect Services for IBM LinuxONE is a hardware security module that is certified at FIPS 140-2 Level 4.

Hardware security module services are built on the IBM Crypto Express Card, combined with Secure Execution for Linux, to create a technically assured confidential computing platform called Hyper Protect Virtual Server. Before the HSM services can be consumed, the module must be initialized with a master key based on the Trusted Key Entry (TKE) process, which ensures the master key always stays in the HSM to provide "keep your own key" (KYOK) services. Once configured, IBM Z Encryption Services can be consumed using industry standard Enterprise PKCS#11 or through the native EP11 over gRPC (GREP11) API calls.

What you'll learn

This tutorial shows you how to protect the Fortanix DSM's cluster master key (CMK) using another key, the cluster deployment key (CDK), which is stored in an external HSM service, such as the IBM Hyper Protect Services, using PKCS 11, as shown in the following diagram:

Fortanix integration with Hyper Protect Encryption Services

At a high level, the process outlined in this tutorial will enable Fortanix DSM to install its "root of the trust" (the CDK) into IBM Hyper Protect Services. While IBM Hyper Protect Services is primarily an on-premises offering, a pay-as-you-go service is also available with IBM Cloud Hyper Protect Crypto Services. The steps outlined in this tutorial are applicable to both environments and will be referred to as "IBM HSM" in this tutorial.

Prerequisites

Before you begin this tutorial, ensure that you have the following:

  • A fully initialized instance of IBM HSM
  • An API key to access PKCS#11 services
  • A fully configured instance of Fortanix DSM
  • A fully configured Fortanix HSM Gateway
  • If you want to protect unstructured data at rest, you will need Fortanix Filesystem Encryption Agent
  • An understanding of PKCS#11 setup for IBM HSM
  • Access to pkcs11-tool to test connectivity to IBM HSM

Note: For a free trial of Fortanix DSM, see the Fortanix website.

Steps

Step 1: Configure PKCS11 services for IBM HSM

  1. Create a directory structure and files:
    touch /tmp/grep11client.log
mkdir -p /etc/ep11client
cd /etc/ep11client
  2. Download the latest supported version of the IBM-HSM-PKCS11-Library for your platform into /etc/ep11client:
    wget https://github.com/IBM-Cloud/hpcs-pkcs11/releases/download/v2.6.7/pkcs11-grep11-s390x.so.2.6.7
  3. Download the sample grep11client.yaml into /etc/ep11client/:
    • Update the [API-KEY]
    • Update the end-point address as required
  4. Ensure access to applications consuming PKCS11 services:
    ln -s <downloaded-version-of-hpcs-grep11.so> /etc/ep11client/hpcs-grep11.so
chmod a+rx /etc/ep11client/hpcs-grep11.so
chmod a+r /etc/ep11lcinet/grep11client.yaml
chmod a+rw /tmp/grep11client.log
chown <owner-id>:<owner-group>

Step 2: Check the setup

  1. Install the command-line utility OpenSC (pkcs11-tool).
  2. Check the library setup with the following commands:
    pkcs11-tool --module=/etc/ep11client/hpcs-grep11.so -I
pkcs11-tool --module=/etc/ep11client/hpcs-grep11.so  --generate-random 20 > random.txt
  3. Initialize the token:
    pkcs11-tool --module=/etc/ep11client/hpcs-grep11.so --init-token --so-pin=<API-KEY> --label "fortanix"

Step 3: Configure the Fortanix HSM Gateway

This step provides high-level instructions to configure the Fortanix HSM Gateway configuration. For detailed instructions, see the Fortanix HSM Gateway User Guide.

  1. Download the latest version of the HSM Gateway package, depending on your operating system.
  2. Install the HSM Gateway package and configure it with an appropriate TLS certificte file and private key, as described in the user guide.
  3. Edit the configuration file /etc/default/ftx-hmg to point to IBM HSM PKCS11 library file by setting the PKCS11_LIB_PATH as follows:
     PKCS11_LIB_PATH=/etc/ep11client/hpcs-grep11.so
  4. Run HSM Gateway and verify that it is running correctly using the following commands:
     sudo systemctl enable ftx-hmg
 sudo systemctl start ftx-hmg
 systemctl status ftx-hmg

Step 4: Configure Fortanix DSM

For detailed instructions on DSM setup and configuration with an external HSM, see the DSM Administration Guide.

See the Cluster Deployment Key Protection Guide for detailed instructions on using external HSM for CDK.

Step 5: Protection of data at rest with Fortanix DSM

Fortanix DSM can be used to protect data at rest for a variety of use cases, including both structured and unstructured data. Depending on the data type and use case, see the appropraite Fortanix user guide.

For a complete list of use cases, check Use-Case and Integration in the Fortanix docs.

Fortanix and IBM Hyper Protect Virtual Servers

When it comes to encryption, the root of trust is the most important aspect of the whole environment. Anything you can do to protect the authenticity of the root of trust will enhance the security profile of your entire enterprise.

To accomplish this, you can bring the Fortanix DSM into the same security perimeter as the HSM, which will require the DSM/HSM-Gateway services to run in an IBM Confidential Computing enclave provided by Hyper Protect Virtual Servers (HPVS), as shown in the following image:

Fortanix and Hyper Protect Virtual Server

IBM Hyper Protect Services leverage IBM Secure Execution for Linux capabilities available on IBM LinuxONE to create a hardware-based trusted execution environment, which can be used to run containerized workloads. See this IBM Hyper Protect Platform White Paper for more information.

Summary and next steps

In this short tutorial, you've learned how to protect a Fortanix DSM's cluster master key (CMK) using the cluster deployment key (CDK), which is stored in an external HSM service such as the planned IBM Encryption Platform, using the cryptographic token interface standard PKCS 11.

To deploy the solution described here, contact IBM Hyper Protect Servivces and Fortanix. You can also access a free trial of Fortanix DSM.