Using the KACLS with Drive, Meet and Calendar
The Stormshield KMaaS allows users to encrypt data for the following Google applications:
| Application | Encryption perimeter | Availability | Use |
|---|---|---|---|
| Google Drive | Encrypting Google Drive confidential documents. |
|
|
| Google Meet | Encryption of video conferences and calls created with Google Meet |
|
|
| Google Calendar | Encrypting a meeting created with Google Calendar: related description, attachments, and Meet conference. |
|
|
Importing sensitive external files to Google Drive (Beta)
The KACLS supports the bulk importing of sensitive data into Google Drive. Data imported from third-party storage are encrypted by the KACLS in Google Drive.
For more information, see the Google documentation.
This Beta feature is currently under development at Google.
Using data loss prevention rules for Google Drive (Beta)
Using Google data loss prevention (DLP), you can create and apply rules to control the content that users can share in Google Drive files outside the organization. DLP gives you control over what users can share, and prevents unintended exposure of sensitive information.
From the Google Admin console, you can set up policy-based actions and KACLS automatically encrypts Drive files when sensitive content is detected.
A Google Workspace Assured Controls license is required to use a DLP rule for each user.
To set up a rule that automatically encrypts files, please follow Google's procedure, described in the Google documentation. This Beta feature is currently under development at Google.
Whenever a DLP rule is triggered on an unencrypted file, the /systemwrap route is directly called by Google and encrypts the file without any user action.
For more information on the /systemwrap route, refer to section Inputs specific to the digest and systemwrap API routes.
Enabling Google Meet hardware use
To attend an encrypted Google Meet conference from a room equipped with Meet hardware, the user must delegate authentication to the Meet hardware device.
Whenever the users try to connect to an encrypted Google Meet, they are asked to scan the meeting QR code with their phone, using only the Google Lens application. Once authenticated via their phone, they are connected to the encrypted meeting.
To enable delegation:
-
In the local configuration file config.json, declare your authentication information in the section tenantid - delegate.
For more information, refer to section delegate parameter.
Enabling external user access for Google Drive and Google Meet
You can share encrypted content with external users in Google Drive and invite external participants to encrypted Google Meet conferences.
This feature will be available on mobile applications in a future release of the Stormshield KMaaS.
To enable the Guest Access feature:
-
Create a dedicated identity provider for Google Drive and declare all desired external users so that they can authenticate. Only declared users will be able to access shared encrypted content. For more information, see Configuring the identity provider.
-
In the same way, create a dedicated identity provider for Google Meet.
-
In the Google Workspace administration interface, add the identity providers specific to external users. For more information, refer to the Google documentation on configuring a guest IdP for all external users. In the Configure guest IdP section, select the Drive and Doc and/or the Meet options.
Once the Guest Access feature has been enabled:
-
When a document is shared via Google Drive to external users, they receive emails enabling them to connect to the dedicated identity provider and view the document.
If the external users do not have a Google account, they must also validate their email addresses with Google every 7 days. -
When you invite external users to an encrypted Google Meet conference, they receive emails containing a link to join the encrypted conference directly. To do this, they must authenticate to the dedicated identity provider.
If using the Guest Access feature, it is not yet possible to share data between participants using a well-known file.
Enabling the use of a Google application via a remote file
-
Configure your identity provider as described in the Google documentation Connect to your identity provider for client-side encryption.
Enabling the use of a Google application in the local configuration
-
In the config.json local configuration file, declare the client_id of your applications in the user_authentication - idps section.
For example, if you use the Google Identity provider, this section of the config.json file should be as follows for drivefs, drive-android, and drive-ios:
Copy"user_authentication": {
"idps": [
{
"discovery_uri": "https://accounts.google.com/.well-known/openid-configuration",
"client_id": "947318989803-k88lapdik9bledfml8rr69ic6d3rdv57.apps.googleusercontent.com"
},
{
"discovery_uri": "https://accounts.google.com/.well-known/openid-configuration",
"client_id": "378076965553-g44pde5vvf113hdd8j84a32kl4e7hqa0.apps.googleusercontent.com"
},
{
"discovery_uri": "https://accounts.google.com/.well-known/openid-configuration",
"client_id": "640853332981-r48oo8ht2kl9v029vsgtatkh4gtue0pn.apps.googleusercontent.com"
}
]
},
For more information, refer to the user_authentication parameters section.
Currently, sharing encrypted content with external users is only available on web applications. This feature will be available on mobile applications in a future release.