Key features
This integration has the following features:- Enhanced Data Protection: Encrypts email content on the client device before it is sent to Google servers, maintaining data confidentiality as Google does not possess the decryption keys.
- Seamless User Experience: Operates entirely within the browser without requiring additional desktop applications or browser extensions, preserving the native Gmail user interface and functionalities.
- Advanced Key Management: Uses the Key Access Control List Service (KACLS), a proprietary Google service that supports cryptographic operations across all essential Workspace applications. This service verifies user authentication and authorization before performing any cryptographic operations.
Technical implementation
The technical implementation of this integration includes the following elements:- Encryption methodology: Uses envelope encryption, where you encrypt data by using a Data Encryption Key (DEK) that is further secured by KACLS.
- Authentication and authorization: Integrates with the customer’s OpenID Connect (OIDC) Identity Provider (IdP) to authenticate end-users and manage access through JSON Web Tokens (JWT) that authorize specific operations.
- S/MIME standard: Employs S/MIME, an open standard for email encryption, ensuring compatibility with most enterprise email clients and allowing secure communications across different providers without proprietary restrictions.
Operational workflow
The following steps comprise the operational workflow:- Email Composition: When a user composes an email, the Gmail client encrypts the message with a DEK, which is then encrypted by using the recipient’s public key. The DEK and the encrypted message are wrapped in an S/MIME format.
- Digital Signing and Encryption: The encrypted message is digitally signed by using keys managed by KACLS, ensuring that the sender’s identity is verifiable and the content has not been tampered with during transit.
- Receiving and Decrypting Emails: Upon receiving an encrypted email, Gmail verifies the digital signature against the sender’s S/MIME certificate, decrypts the DEK using KACLS, and renders the email content to the user.
Security and compliance
The integration conforms to standard security and compliance requirements with respect to the following aspects:- High Security Standards: Besides standard TLS encryption for data in transit, Gmail CSE uses multiple security controls, including iframe origin isolation and Content Security Policy, to secure sensitive data within a secure container in the browser.
- Regulatory Compliance: Meets high compliance standards required by various industries, ensuring that sensitive information remains protected under rigorous data protection regulations.
Basic setup steps for Google Workspace CSE
The following high-level steps illustrate the setup process for Google Workspace CSE:- Set up your external encryption key service.
- Connect Google Workspace to your external key service.
- Connect Google Workspace to your identity provider.
- Turn on CSE for users.
Set up your external encryption key service
First, set up an encryption key service through one of the Google partner services (such as CryptoHub). This service controls the top-level encryption keys that protect your data.Connect Google Workspace to your external key service
Next, specify the location of your external key service, so Google Workspace can connect CSE for supported apps to it.Connect Google Workspace to your identity provider
For this step, you must connect to either a third-party IdP or Google identity by using either the Admin console or a.well-known file hosted on your server. Your IdP verifies the identity of users before allowing them to encrypt content or access encrypted content.
Learn more
This integration guide demonstrates using VirtuCrypt as the identity provider.