Cloud computing is globally recognized as the single most effective, agile and scalable path to digitally transform and drive value creation. It has been a critical catalyst for growth, allowing private organizations and governments to support consumers and citizens alike, delivering services quickly without prohibitive capital investment. European organizations—in both the public and private sectors—want a provider to deliver a cloud on their terms, one that meets their requirements for security, privacy, and digital sovereignty, without compromising on functionality or innovation.

Last year, we set out an ambitious vision of sovereignty along three distinct pillars: data sovereignty (including control over encryption and data access), operational sovereignty (visibility and control over provider operations), and software sovereignty (providing the ability to run and move cloud workloads without being locked-in to a particular provider, including in extraordinary situations such as stressed exits). After extensive dialogue with customers and policymakers, we are today unveiling ‘Cloud. On Europe’s Terms’. As part of  this initiative, we will continue to demonstrate our commitment to deliver cloud services that provide the highest levels of digital sovereignty, all while enabling the next wave of growth and transformation for Europe’s businesses and organizations.

Google Cloud’s baseline controls and security features offer strong protections, meet current robust security and privacy requirements, and address many customer needs. Yet each country in Europe has its own characteristics and expectations. Certain customers in Europe may require more flexibility than current public and private cloud offerings may provide. We want to deliver a platform that allows customers to deploy workloads with the desired local control, without losing the transformational benefits of the public cloud.

We are now delivering on this new vision collaboratively with trusted local technology providers in Europe, starting with T-Systems in Germany. Today, together with T-Systems, we announced a partnership to build a Sovereign Cloud offering in Germany for private and public sector organizations. The offering will become available in mid 2022 with additional features being added over time.  

In this new joint offering, T-Systems will manage sovereignty controls and measures, including encryption and identity management of the Google Cloud Platform. In addition, as part of their offering, T-Systems will operate and independently control key parts of the Google Cloud infrastructure for T-Systems Sovereign Cloud customers in Germany.

We are committed to building trust with European governments and enterprises with a cloud that meets their digital sovereignty, sustainability and economic objectives. We are starting with T-Systems today and will continue by partnering with trusted technology providers in selected markets across the region. 

Customers in other markets across Europe will be able to use these trusted partner offerings or use Google Cloud’s controls to exercise autonomous control over data access and use; exercise choice over the infrastructure that is used to process that data; and avoid cloud vendor lock-in. 

With Google Cloud, our customers also automatically benefit from sustainable business transformation on the cleanest cloud in the industry. Today, we are the largest annual corporate purchaser of renewable energy globally, and by 2030, we aim to operate entirely on 24/7 carbon-free energy in all of our cloud regions worldwide. 

We’ll continue to listen to our customers and key stakeholders across Europe who are setting policy and helping shape requirements for customer control of data. Our goal is to make Google Cloud the best possible place for sustainable, digital transformation for European organizations on their terms—and there is much more to come.

Whether driven by government policy, industry regulation, or geo-political considerations, the evolution of cloud computing has led organizations to want even more control over their data and more transparency from their cloud services. At Google Cloud, one of the best tools for achieving that level of control and transparency is a bit of technological magic we call Cloud External Key Manager (EKM).

Cloud EKM can help you protect your cloud data at rest with encryption keys which are stored and managed in a third-party key management system that’s outside Google Cloud’s infrastructure, and ultimately outside Google’s control. This can help you achieve full separation between your encryption keys and your data stored in the cloud. Cloud EKM works with symmetric and asymmetric encryption keys, and offers organization policies that allow for fine-grained control over what types of keys are used. Via Key Access Justification (KAJ) it also offers a way for clients to control each key use.

At their core, many cloud security and cloud computing discussions are about the kinds of trust that Cloud EKM specifically and encryption more broadly can help create. While the concept of digital trust is much bigger than cybersecurity and its tripartite components of security, privacy, and compliance, one of the most crucial themes of cloud computing is the cloud trust paradox. In order to trust the cloud more, you must be able to trust it less, and external control of keys and their use can help reduce concerns over unauthorized access to sensitive data.

How it works

From our Cloud EKM documentation, you can use keys that you manage within a supported external key management partner to protect data within Google Cloud. You can protect data at rest in services that support CMEK, or by calling the Cloud Key Management Service API directly.

Cloud EKM provides several benefits:

• Key provenance: You control the location and distribution of your externally-managed keys. Externally-managed keys are never cached or stored within Google Cloud. Google cannot see them. Instead, Cloud EKM communicates directly with the external key management device for each request.
• Access control: You manage access to your externally-managed keys. Before you can use an externally-managed key to encrypt or decrypt data in Google Cloud, you must grant the Google Cloud project access to use the key. You can revoke this access at any time.
• Centralized key management: You can manage your keys and access policies from a single location and user interface, whether the data they protect resides in the cloud or on your premises. The system that managed the keys is entirely outside Google control.

In all cases, the key resides on the external system, and is never sent to Google.

Here’s how it works:

1. Create or use an existing key in a supported external key management partner system. This key has a unique URI.
2. Grant your Google Cloud project access to use the key, in the external key management partner system.
3. Create a Cloud EKM key in your Google Cloud project, using the URI for the externally-managed key.

The Cloud EKM key and the external key management partner key work together to protect your data. The external key is never exposed to Google and cannot be accessed by Google employees. Furthermore, Cloud EKM can be combined with Key Access Justifications (KAJ) to establish cryptographic control over data access.

KAJ with Cloud EKM can give customers the ability to deny Google Cloud administrators access to their data at rest for any reason, even in situations typically exempted from customer control, such as outages or responses to third-party data requests. KAJ does this by providing customers a clear reason why data is being decrypted, which they can use to programmatically decide whether to permit decryption and thus allow access to their data.

Previously, we’ve discussed three patterns where keeping the keys off the cloud may in fact be truly necessary or outweighs the benefits of cloud-based key management. Here’s a brief summary of those three scenarios where Cloud EKM can help solve these Hold Your Own Key dilemmas.

Scenario 1: The last data to go to the cloud

As organizations complete their digital transformations by migrating data processing workloads to the cloud, there is often a pool of data that can not be moved to the cloud. Perhaps it’s the most sensitive data, the most regulated data, or the data with the toughest internal security control requirements.

Finance, healthcare, manufacturing and other heavily-regulated organizations face myriad risk, compliance, and policy reasons that may make it challenging to send some of their data to a public cloud provider. However, the organization may be willing to migrate this data set to the cloud as long as it is encrypted and they have sole possession of the encryption keys.

Scenario 2: Regional regulations and concerns

Regional requirements are playing a larger role in how organizations migrate to and operate workloads in the public cloud.

Some organizations are already facing situations where they are based in one country and want to use a cloud provider based in a different country, but they aren’t comfortable with or legally allowed to give the provider access to encryption keys for their stored data. Here the situations are more varied, and can include an organization’s desire to stay ahead of evolving regulatory demands or industry-specific mandates.

Ultimately, this scenario allows organizations to utilize Google Cloud while keeping their encryption keys in the location of their choice, and under their physical and administrative control.

Scenario 3: Centralized encryption key control

The focus here is on operational efficiency. Keeping all the keys within one system to cover multiple cloud and on-premise environments can help reduce overhead and attack surface, thus helping to improve security. As Gartner researchers concluded in their report, “Develop an Enterprisewide Encryption Key Management Strategy or Lose the Data1,” organizations are motivated to reduce the number of key management tools.

“By minimizing the number of third-party encryption solutions being deployed within an environment, organizations can focus on establishing a cryptographic center of excellence,” Gartner researchers said

Given that few organizations are 100% cloud-based today for workloads that require encryption, keeping keys on-prem can streamline key management. Centralizing key management can give the cloud user a central location to enforce policies around access to keys and access to data-at-rest, while a single set of keys can help reduce management complexity. A properly implemented system with adequate security and redundancy outweighs the need to have multiple systems.

Do I need Cloud EKM?

Whether protecting highly sensitive data, retaining key control to address geopolitical and regional concerns, or supporting hybrid and multi-cloud architectures, Cloud EKM is best suited for those Google Cloud customers who must keep their encryption keys off of the cloud and always under their full control.

To learn more about Cloud EKM, please review these resources:

• Our research explaining why Google Cloud users can benefit from Cloud EKM
• The most recent updates to Cloud EKM
• Take a deeper dive into the cloud trust paradox

1. Gartner, Develop an Enterprisewide Encryption Key Management Strategy or Lose the Data, David Mahdi, Brian Lowans, March 2022.