Stormshield KMaaS 4.6.0 new features and enhancements
Support for Google features
Google data loss prevention (DLP)
The KACLS module now supports the systemwrap API to enable the "Apply Client-side Encryption" action in the Google Drive DLP feature.
Microsoft Double Key Encryption
The Stormshield KMaaS now supports the Microsoft Double Key Encryption feature (DKE) securing the Microsoft Office environment.
You can write ABAC rules with a remote Policy Decision Point on the DKE module in order to manage access to encrypted data more finely.
Stormshield KMaaS database
A PostgreSQL database is now available to the Stormshield KMaaS for KEK storage. The KEKs are wrapped with an MKEK before they are inserted in the database.
KEKs are loaded on demand rather than at Stormshield KMaaS startup to optimize performance.
mTLS authentication to the database is supported.
Administration module
A new Administration module (Admin) is available to perform operations on KEKs for different Stormshield KMaaS modules, and to configure authentication and policy enforcement for the modules. The database mode is required to use the Admin module. The following operations are available through administration APIs:
-
Creating symmetric and asymmetric KEKs,
-
Retrieving non-sensitive information about the KEKs stored in the database,
-
Revoking KEKs. A revoked key cannot be reactivated.
You can write ABAC rules with a local or remote Policy Decision Point on the Admin module in order to manage access to encrypted data more finely.
Installation
The docker artifact is now compatible with NodeJS version 24 for enhanced security.
The Software Bill of Materials is now delivered as an artifact in the cycloneDX format.
Key Access Management
The Key Access Management module can now use symmetric KEKs imported from a KMS using the KMIP protocol.
The /rewrap route is not available in KMS mode.
Customized access rules (OPA)
The kacls_owner_domain parameter in authorization tokens can now be used when writing OPA rules if it is provided by Google.