PRODUCT OVERVIEW

Moving workloads to the cloud usually means using collaboration suites such as Google Workspace. The functions allow for information sharing, collaborative work, or access from any device which have an indisputable role in digital transformation projects within companies. 

From the sensitive data’s protection’s point of view, the keys providing access to this information have the same criticality level as the data they protect. When having sensitive data managed by a third party, it’s important to retain control of the keys, especially if that is in a cloud-based environment. 

Client Side Encryption (CSE) lets the user retain control over the encryption keys without interfering with the Google Workspace user experience. The CSE function enables the web browser to encrypt the information before sending it to Google, guaranteeing end-to-end protection of sensitive data. 

HOW IT WORKS?

CSE uses envelope encryption to protect data and it relies on web browsers for performing client-side operations. 

First, a data encryption key (DEK) is generated in a Google Workspace client. Then the DEK is handed over to the TRIDENT HSM to be encrypted symmetrically using a Key Encryption Key (KEK). 

These Key Encryption Keys (KEKs) are managed by the TRIDENT HSM to determine who can and cannot access your data. This keeps your cloud data private, even from Google, since they won’t have the keys to decrypt the data.

FEATURES

If you choose to buy your own physical TRIDENT HSM, you get flexible configuration options, full control over encryption keys, possession of a physical HSM in a tamper proof case. 

If you rather use our TRIDENT HSM as a service, it will be easy to configure and operate, secured by the applied Secure Multi-Party Computation (SMPC) technology combined with a multi-tenant environment, optimized for SMEs regarding the cost of operation. 

If you would like to introduce a new IT solution at your company, it’s important to limit both the disruption to existing functions and the impact on the user experience.  

i4p’s Client Side Encryption module offers you a convenient way to address all your data sovereignty and compliance requirements. It gives you control over your encryption keys while letting you leverage the processing capabilities and power of Google Workspace. Our natively-integrated virtual and physical HSMs offer streamlined deployment and operation with the highest level of security.

WITH ON-PREMISE HSM 

With i4p’s TRIDENT HSM, customers can bring a CC EAL4+ certified HSM for Google Workspace. The database encryption keys are managed outside of Google’s environment in the physical TRIDENT HSM deployed on the customer’s premises.

WITH HSM-AS-A-SERVICE 

TRIDENT HSM-as-a-Service provides a high level of security while keeping operating costs low. We use a highly secure multi-tenant environment with Secure Multi-Party Computation (SMPC) to protect the encryption keys.

SPECIFICATIONS

APIs AND STANDARDS USED

• Microsoft CSP/CNG-KSP
• OpenID Connect JWT identity tokens (RFC 7519)
• rsyslog (RFC 5424, 5425and 5426)
• SAMAPI (C++/Java,proprietary)

HOST INTERFACE 

• Triple gigabit Ethernet port
• Dual USB port
• VGA displayport
• Tamper detection I/O

CERTIFICATIONS 

• CC EAL4+ (May 2019)
• eIDAS listing (August 2019)

AUTHENTICATION

• Built-in multi-factor authentication module (RFC 6238)
• External authentication with JWT identity tokens (RFC 7519)

PHYSICAL CHARACTERISTIC* 

• Format: Standard 1.5U 19” rack mount chassis
• Dimensions: 19” x 21” x 2.58” (482.6mm x 533.4mm x 65.7mm)
• Weight: 19lb (8.5kg)
• Input Voltage: 24V DC (PSU 100–240V, 50–60Hz)
• Power Consumption: 120W maximum, 50W typical

* In the TRIDENT CSE the Client Side Encryption module resides within the secure perimeter of the CM