Google Cloud External Key Manager (Cloud EKM) lets you protect your cloud data with encryption keys that are stored and managed in a third-party key management system outside Google Cloud’s infrastructure. This allows you to achieve full separation between your encryption keys and your data stored in the cloud, making you the ultimate arbiter of access to your data. We are continuously innovating and developing the functionality of Cloud EKM, so let’s explore some recent updates we’ve made.

New functionality

Available today, we have added several much-anticipated features to Cloud EKM to help meet customer requirements:

Cloud EKM over VPC

Many customers want to incorporate an additional layer of security and reliability when connecting their key manager to the cloud. To help meet this need, we are introducing Cloud EKM support for Virtual Private Cloud (VPC) networks. This support allows Cloud EKM to connect via a secured private network, giving customers stricter control over network access to their external key manager. For more information, see Using Cloud EKM with VPC.

Support for asymmetric keys

In addition to symmetric encryption keys, Cloud EKM now recognizes both RSA as well as Elliptic Curve asymmetric keys created in a supported external key manager. With support for asymmetric keys, you can sign approvals granted via Access Approval. Asymmetric keys can add a layer of assurance when granting administrative access to customer data. You can also use the external asymmetric keys to sign data just as you would a cloud native key. For more information, see Asymmetric signing keys.

Protection level organization policy

We’ve made a new organization policy available for Cloud KMS that allows for fine-grained control over what types of keys are used. By using this org policy, you can specify that only specified KMS key types, for example EXTERNAL or EXTERNAL_VPC, may be created. This function can help meet specific requirements for separation of data or data sovereignty, ensuring only externally-managed keys are used with certain workloads. For more information, see Organization policy constraints.

Cloud EKM supports the Google Cloud services which typically store customers’ most sensitive data assets, and we are constantly adding support for more services. For example, we recently added Cloud EKM support for Cloud Storage, allowing customers to leverage Google-scale storage while adhering to local regulations and holding their keys in their own key manager. For a complete list, see our currently supported services, and if you’re interested in using Cloud EKM with a GCP service that is not yet supported, you can make feature suggestions here.

Best practices for Cloud EKM

The newly published Reference architectures for reliable deployment of Cloud EKM services guide provides recommendations for running a highly available and reliable external key manager integrated with Cloud EKM. These recommendations answer some of the most common questions and concerns we’ve heard from customers. The recommendations are aimed at operators of an external key manager, meaning that if a supported partner operates your EKM, you might share some of these responsibilities with a partner, depending on the design of their product and how it integrates with Cloud EKM.

Take encryption into your own hands

Being deliberate about encryption is critical for securing your sensitive data on Google Cloud. We’re always evolving our encryption products to meet your needs and help you achieve your business goals, and we hope that the additional features mentioned in this blog will allow you to make better use of your key management infrastructure. To get started with Cloud EKM, check out our documentation to learn more or try it for yourself in the GCP console.

Climate scientists face a deluge of environmental data to analyze and interpret from real-time sensors and satellites across the globe. The stakes are as high as our planet’s long-term future, but rapidly changing conditions are already impacting communities through extreme events like floods and wildfires as well as management of everyday resources. In this context, detailed environmental maps are key sources for urgent global issues like food security, water quality, and vegetation levels.

Scientists, researchers, and developers rely on state-of-the-art cloud computing tools like Google Earth Engine (EE) to detect changes, map trends, and quantify differences on the Earth’s surface. EE leverages the compute power of Google Cloud to combine a multi-petabyte catalog of satellite imagery and geospatial datasets with planetary-scale analysis capabilities.

To find out more about how climate scientists address these complex research challenges, I spoke to Dr. Richard Fernandes, Research Scientist at Natural Resources Canada (NRCan). Dr. Fernandes is also a 2022-23 member of the Google Research Innovators Program, which provides technical and professional support to a global cohort of leading researchers. I asked him to describe how cloud computing and machine learning (ML) tools can support climate resilience research and drive awareness about climate sustainability.

Dr. Fernandes, can you give me an overview of your research in climate sciences?

My research focuses on mapping the status and trends of vegetation over Canada. Every month we generate maps of vegetation parameters, such as canopy cover at 20m resolution, to support environmental monitoring and assessment. These maps contribute to global datasets that are used to reduce uncertainty in weather and climate forecasts.

Canada has approximately 10 million square kilometers of land and the annual data volume of these maps is equivalent to streaming HD movies for over 750 hours non-stop. And that’s only the tip of the iceberg: the volume of input data we need to generate those maps is typically 100 times more. Unlike movie streaming services, we have to independently process each input pixel to locate it accurately, screen for clouds (and even the shadows of clouds), and then transform it into a vegetation parameter value like canopy cover using ML algorithms.

The volume of high-resolution data and the amount of compute we need are challenging and ever-increasing. Rather than dedicating servers 24/7 for constant monitoring, we rely on cloud computing and ML. Cloud computing allows us to manage all this data in a useful and accessible way. We have also been able to successfully use the Google Artificial Intelligence (AI) Platform to calibrate new ML models for third-party datasets.

How did you start working with Google Cloud?

I started using EE together with open source APIs for integration with Google Drive about four years ago. With the pandemic my research group has transitioned to using EE, Google Cloud, and Google Drive for both our Canada-wide mapping as well as for R&D activities. In January we developed and released the LEAF toolbox, which builds on EE satellite data to create customizable maps of foliage density in near real-time. We do all of the pixel processing in EE and leverage the ability to integrate our own functions using their APIs. We combine EE with Google Cloud to handle and manage output datasets. Fortunately, EE has most of the input data already at hand so we don’t need to deal with that 100x larger volume.

What impact do you expect LEAF will have now–and down the road?

Both the Canadian federal government and provinces already use our data products as inputs to permafrost, crop status, and water resource models. Agriculture Canada had been using a conventional Geographic Information System (GIS) and approached us to ask how we manage our data. They want to use LEAF to assess how crops are progressing, which impacts local economies and the global food supply. We’re in a pilot with them to apply EE to their crop condition assessments.

Also exciting is that the Province of Alberta is integrating the LEAF toolbox within a system for monitoring the reclamation status of oil and gas wells and mines. They want to know how to rehabilitate sites that were developed for mineral and gas deposits. This is another great use case but many others are possible. The technology itself is cool, but that’s not even the point. ML algorithms are constantly evolving and improving. New ML algorithms use active learning that detects mistakes and makes updates on the fly. The technology will be different in five years — or five months! — so our priority is making these tools accessible and useful now.

Why is state-of-the-art technology for climate research so important?

Scientific research must be validated, transparent, and rigorous to drive the best solutions to our complex and changing ecosystem. Climate action needs greater public awareness, which requires more knowledge, which demands the best data. By democratizing information and decision-making, we can create an ecosystem of openness and public-private partnerships. We can lower the barrier to entry for advanced research and help scientists validate and reproduce their results. Also, scientists don’t want to have to become software engineers for these custom highly specific solutions. They want user-friendly tools that let them focus on their analyses and share their insights with the world. That’s one of the major appeals of the Google Research Innovators Program for me: I want to share LEAF with colleagues and collaborate with other researchers who are using new tools in new ways.

Do you have any parting words about your mission?

We’re so fortunate to have Canadian taxpayers and the Government of Canada funding our work. We have worked with many scientists over the past two decades to develop and validate the algorithms we use, especially Fred Baret and Marie Weiss at INRA France, who have championed the idea of free and open access to algorithms and knowledge, and data.

I really believe in democratic access to information. I like the fact that the terms of service of Google products allows us to offer not only maps but the actual processing system in a free and open manner to everyone. I also like that EE provides a simple-to-use user interface that works on mobile devices. We designed LEAF not just for experts, but for individuals. My mom was able to make maps of a nearby park in real time on her tablet. It is my hope that expanding access to critical environmental information will increase our collective awareness of how our actions impact both near and far places — and make us active in the cause of a sustainable future.

That’s an inspiring note to end on. Thank you for your time!

Thanks for having me!

Click here to learn more about Google’s commitment to renewable energy. Or try the LEAF toolbox for yourself!