IBM Cloud Hyper Protect Overview
Key Points
- Confidential computing in public clouds requires encrypting data **and** ensuring that cloud operators, even with physical access, cannot read your keys or information.
- IBM Cloud Hyper Protect Services tackles this by offering a tamper‑resistant hardware security module (NHSM) combined with a hardened software stack, providing an isolated “slice” of HSM for each tenant.
- Unlike typical BYOK models, Hyper Protect uses a “keep‑your‑own‑key” (KYOK) approach where IBM never sees the key material, so customers must run a **key ceremony** to initialize the HSM with their master key.
- The key ceremony can be performed via IBM’s trusted‑key‑entry CLI or by using smart cards that store portions of the master key, allowing the key to be split across multiple cards and custodians for added security.
- Once initialized, the HSM stores root and data‑encryption keys that feed into envelope‑encryption workflows, protecting object storage, databases, TLS certificates, and other workloads while keeping the keys under customer control.
Full Transcript
# IBM Cloud Hyper Protect Overview **Source:** [https://www.youtube.com/watch?v=RIcnXFZWrSI](https://www.youtube.com/watch?v=RIcnXFZWrSI) **Duration:** 00:06:52 ## Summary - Confidential computing in public clouds requires encrypting data **and** ensuring that cloud operators, even with physical access, cannot read your keys or information. - IBM Cloud Hyper Protect Services tackles this by offering a tamper‑resistant hardware security module (NHSM) combined with a hardened software stack, providing an isolated “slice” of HSM for each tenant. - Unlike typical BYOK models, Hyper Protect uses a “keep‑your‑own‑key” (KYOK) approach where IBM never sees the key material, so customers must run a **key ceremony** to initialize the HSM with their master key. - The key ceremony can be performed via IBM’s trusted‑key‑entry CLI or by using smart cards that store portions of the master key, allowing the key to be split across multiple cards and custodians for added security. - Once initialized, the HSM stores root and data‑encryption keys that feed into envelope‑encryption workflows, protecting object storage, databases, TLS certificates, and other workloads while keeping the keys under customer control. ## Sections - [00:00:00](https://www.youtube.com/watch?v=RIcnXFZWrSI&t=0s) **Securing Cloud Data with Hyper Protect** - The speaker outlines how IBM Cloud Hyper Protect services use tamper‑resistant hardware security modules and a secured software stack to keep encryption keys and confidential data hidden from cloud operators, even with physical data‑center access. ## Full Transcript
let's talk about confidential computing
you want to use public cloud services to
minimize upfront costs or maybe to
rapidly develop cloud native
applications
but these applications are going to deal
with confidential information
not only do you want to encrypt the
storage used but you also want to
prevent any cloud operations teams from
getting access to that data even if
they've got physical access to the data
centers themselves
one way that we enable this is with a
set of technologies that we call ibm
cloud hyper protect services
hi i'm chris poole i'm a senior
solutions architect in the ibm
hyperprotect team
in this video i'm going to talk a little
bit about what you can do to ensure your
customers data stays confidential and
then i'll introduce a simple application
that demonstrates a basic use case and
i'll show you how it works
now part of an overall solution to
protect your data is to encrypt it
but now you've transformed the problem
into the problem of how do i secure my
keys
one way to help resolve this issue is to
employ nhsm a hardware security module
this is a physical card a small lockdown
computer that's been engineered to be
tamper resistant
you can store your keys in there and
nobody even with physical access to the
system is going to have access to your
data or your keys
the hyper protect variant of this
your own discrete slice of an hsm
coupled with a secured software stack is
called the ibm cloud hyper protect
crypto services before making use of
hsms they have to be initialized with a
master key which has got ultimate trust
and power
once done the hsm is primed for use the
crypto service and the hsn it users is a
little different from others on the
market that it has the model of keep
your own key not just bring your own key
what this means is that we never see
your key data during the initialization
process
so you don't have to extend your trust
model but it also means that you have to
go through this initialization process
yourself that we call the key ceremony
once initialized the hsm can store root
keys or standard keys which in turn can
be used with technologies like envelope
encryption to be able to protect your
clients data in object storage in
databases or things like tls
certificates
let's do the key ceremony now one
popular way of doing this is with our
trusted key entry command line interface
but another way is to use smart cards
and a smart card reader
these cards in turn can be used to store
master key data in them across multiple
cards so that you can take the different
cards
and place them securely in different
locations and have them owned by
different trusted people within your
organization
let's use these smart cards and
initialize the hsm i'm going to use for
the demo first let's do the first card
for brevity i'm not showing the full
process here
once that's done i can repeat this whole
step with another card or another few
cards
to be able to split the master key
across these different devices
i don't need these cards for day-to-day
use of the hsm only for the
initialization process and for any
future administration
so i can take these cards give them to
different trusted people in my
organization and have them securely
store them at places like bank vaults
then later on if i want to do any
administration of the hsm i can bring
the people and the cards back together
so that we can perform these operations
so the initialization has been done now
let's talk about the demo in my
organization i've got different teams
who each own their own set of cloud
native applications
for cost reduction i want them to all be
able to write to a consolidated database
but i want to be able to isolate the
data between the different teams so one
team can't read the data from another
team
so what i'm going to do here in a very
simple way is to have some different
applications take some input data and
encrypt it with a different key one per
team before storing it in the shared
database
this database by the way is another of
the hyper protect services the
confidentiality requirements obviously
transfer across to the long term data
storage so we have database flavors that
also run within secure enclaves so the
data and the logs are encrypted and
there's no underlying machine access
so let's deploy the applications i've
containerized them into a virtual server
instance in you guessed it another
secure enclave that we call hyper
protect virtual servers
in this way the runtime data is also
protected and only i with the ssh key
injected at service creation time can
access the applications
let's stand up a database instance
on the back end then ssh into the
virtual server start up the applications
and connect it all together so the data
flow is simple the applications expose a
web ui they receive that information
make use of a key port from the crypto
service at runtime to encrypt the data
before storing it in the database on the
back end
let's add some data and use the
applications so i'm entering some data
here storing it in the database and then
i can go to another screen and confirm
that i can retrieve that data from the
database using the key it has in memory
to decrypt the data within the
application runtime
it's all end-to-end encrypted during
transport and at rest
let's switch teams meaning we'll pull a
different key from the crypto service a
different application and let's store
that data before checking we can read it
we can but now let's try to read the
data from the first teams application
it's encrypted we can't read it we've
consolidated our data pool but we've
still kept the teams isolated so these
are the ibm cloud hypertext services
helping my data to stay confidential
so let's summarize what we've just done
here we deployed a secured virtual
server we created a lockdown database
and we created an instance of the hyper
protect crypto service and then
initialized its hsn
using these three different services we
deployed an application that's able to
take data from the end user encrypt that
using different keys for different teams
from the crypto service before pushing
that encrypted data into a consolidated
database
in turn this creates a cohesive
confidential computing platform on ibm
cloud thank you for watching
if you've got any questions please drop
us a line below if you want to see more
videos like this in the future please
like and subscribe and don't forget if
you want to learn more about the ibm
cloud hyper protect services please
check out the links below