Dulmar
Enterprise Key Management (EKM) wuxuu kuu oggolaanayaa inaad ku sirayso waxyaabaha macmiilkaaga ee OpenAI adigoo adeegsanaya furayaal uu maamulo nidaamkaaga dibadda ee Key Management System (KMS), waxaana loo heli karaa ChatGPT Enterprise iyo API labadaba.
OpenAI waxay taageertaa siraynta Bring Your Own Key (BYOK) oo leh akoonno dibadeed gudaha AWS KMS, Google Cloud (GCP), iyo Azure Key Vault.
Waqtigan xaadirka ah, hirgelinta EKM waxay ku xaddidan tahay goobaha shaqada Enterprise iyo Edu ee leh wakiil akoon OpenAI oo magacaaban.
Sida siraynta OpenAI EKM u shaqeyso
Socodka Heerka Sare
Waxaan u sameynaa Data Encryption Key (DEK) bixiyahaaga cloud-ka.
Cloud KMS-gaagu wuxuu maamulaa Key Encryption Key (KEK) aasaasi ah, kaas oo ku kaydsan gudaha cloud-kaaga ama dibadda. Hirgelintu adiga ayay kugu xiran tahay.
Waxaan cloud-kaaga ka codsannaa siraynta DEK si aan u helno encrypted DEK (eDEK). Haddii KEK-gaaga dibadda lagu kaydiyo, cloud-kaagu wuxuu keliya sameeyaa tallaabo dheeraad ah oo ugu gudba kaydkaaga dibadda, taas oo aan u muuqan OpenAI.
Sirayn
Marka la sirayo, xogtaada waxaa lagu siraa DEK, eDEK-na waxaa loo kaydiyaa metadata ahaan faylka.
Furfurid
Marka la furfurayo, waxaan codsannaa in eDEK-ga uu KMS-gaaga cloud-ku u furfuro DEK, kadibna xogta ayaan ku furfurnaa DEK-ga.
Ereyada Muhiimka ah
Data Encryption Key (DEK) - furaha sira xogtaada.
Encrypted Data Encryption Key (eDEK) - DEK-ga la siray, oo uu sameeyo KMS-gaagu
Key Encryption Key (KEK) - furaha aasaasiga ah ee aad maamusho kaas oo sira DEK -> eDEK isla markaana furfura eDEK -> DEK. Furahani mar walba wuxuu ka baxsan yahay nidaamyada OpenAI.
Shuruudaha heer-sare ee hirgelinta
Gudaha bixiyahaaga cloud-ka
Ku samee fure cusub cloud-kaaga KMS (Azure, AWS, ama GCP)
Samee policy gaar ah oo xaddidan oo leh oggolaanshaha Encrypt/Decrypt ee KMS-ka
U samee OpenAI trust policy (AWS), workload identity (GCP) ama service principal (Azure)
Sii OpenAI door leh policy-ga xaddidan si ay u gasho KMS-gaaga
Gudaha madallada OpenAI
ChatGPT Enterprise
U samee goob shaqo ChatGPT sandbox ah ujeeddooyin tijaabo.
API
Gudaha dashboard-kaaga OpenAI, ku samee mashruuc cusub halkaas oo siraynta lagu dabaqi doono.
Hawlaha u gaarka ah bixiyaha
Dhanka AWS, OpenAI waxay:
wici doontaa AssumeRole iyadoo wadata ExternalID
Dhanka GCP, OpenAI waxay:
ka wici doontaa STS endpoint-kaaga akoon GCP oo OpenAI ah
u adeegsan doontaa GCP access token si ay ugu wacdo encrypt/decrypt gudaha KMS-gaaga.
Dhanka Azure, OpenAI waxay:
codsan doontaa access token loogu talagalay vault-ka tenant-kaaga Azure
u adeegsan doontaa access token-kaas si ay ugu wacdo encrypt/decrypt gudaha Key Vault-kaaga.
Macluumaadka aad uga baahan tahay OpenAI
Xaqiijin
Waxaad u baahan doontaa inaad aqoonsato tokennada aqoonsiga mideysan ee OpenAI ee AWS iyo GCP. Dhanka Azure, waxaad u baahan doontaa inaad aqoonsato application id-ga OpenAI ee diiwaangelinta app-keeda.
Soo koobidda xuduudaha xaqiijinta
| Mabda’a AWS ee OpenAI | arn:aws:iam::790389265272:role/EnterpriseKeyManagement |
| Aqoonsiga service account-ka GCP ee OpenAI | 105900137572174660365 |
| Aqoonsiga application-ka Azure ee OpenAI | 20a14814-5ab7-4612-a671-1382b412bf93 |
Macluumaadka loo baahan yahay inta hirgelinta lagu jiro iyadoo lagu salaynayo bixiyahaaga daruurta
Marka la joogo AWS, waa inaad dejisaa siyaasad kalsooni aqoonsanaysa:
Principal-ka OpenAI (lambarka akoonka + doorka)
ExternalID oo ah aqoonsiga mashruucaaga OpenAI
Marka la joogo GCP, waa inaad dejisaa workload identity aqoonsanaya:
Aqoonsiga akoontiga adeegga ee OpenAI
Dhageyste ah aqoonsiga mashruucaaga OpenAI
Marka la joogo Azure, waa inaad u abuurtaa service principal tenant-kaaga Azure diiwaangelinta abka OpenAI
U samee mid aqoonsiga macmiilka codsiga ee OpenAI: 20a14814-5ab7-4612-a671-1382b412bf9
Waxaad tan ku samayn kartaa adigoo codsi POST u diraya https://graph.microsoft.com/v1.0/servicePrincipals bar-dhammaadka.
Oggolaansho
Waxaad u baahan doontaa inaad sameyso policy u oggolaanaysa aqoonsiga OpenAI inuu helo marin xaddidan oo uu ku galo KMS-gaaga.
| AWS | GCP | Azure |
| kms:Decryptkms:Encrypt | cloudkms.cryptoKeyVersions.useToDecryptcloudkms.cryptoKeyVersions.useToEncrypt | Microsoft.KeyVault/vaults/keys/encrypt/actionMicrosoft.KeyVault/vaults/keys/decrypt/action |
Kale
Gudaha Azure, nooca Key-ga (algorithm-ka siraynta furaha), ka dooro RSA, hana dooran EC.
Macluumaadka ay OpenAI kaaga baahan tahay
Raac tilmaamaha ku jira dukumeentigan si aad KMS-kaaga uga diiwaangeliso OpenAI. Halkan waxaa ku yaal soo koobidda xuduudaha aad u baahan doonto inaad bixiso.
La xidhiidha xaqiijinta
AWS
IAM Role ARN - doorka ay OpenAI qaadanayso (tusaale: arn:aws:iam::123456789:role/role-name)
ExternalID - aqoonsiga ururkaaga OpenAI
GCP
Lambarka Mashruuca Workload Identity (tusaale: 123456789)
Aqoonsiga Pool-ka Workload Identity
Aqoonsiga Bixiyaha Workload Identity
Dhageystaha la oggol yahay: aqoonsiga ururkaaga OpenAI
Azure
Tenant ID
| AWS | GCP | Azure | |
| La xidhiidha xaqiijinta | Tenant ID | ||
| La xidhiidha KMS | KMS ARN - (tusaale: arn:aws:kms:REGION:ACCOUNT_NUMBER:key:KEY_UUID) | KMS Project ID (tusaale: adjective-noun-12345)Magaca key ring-ka KMSMagaca furaha KMSGoobta furaha KMS (tusaale: us-east1) | URI-ga Vault (tusaale: https://your-vault-name.vault.azure.net/)Magaca Furaha |
Kadib markaad KMS-kaaga ka diiwaangeliso OpenAI, sii wad raacitaanka tilmaamaha dukumeentiga si aad ugu hawlgeliso habaynta EKM mashruuc API ah. U samee mashruuc OpenAI API cusub oo loogu talagalay tijaabinta.
Tilmaamaha hirgelinta u gaarka ah bixiyaha
Hagitaan talaabo-talaabo ah, eeg xiriiriyeyaasha ku habboon ee hoose. Fadlan ogow kuwani waxay diiradda saaraan shuruudaha isdhexgalka OpenAI, mana loogu talagalin inay noqdaan hage dhammaystiran oo ku saabsan deegaankaaga oo dhan
Astaamaha aan la taageerin haddii EKM la hawlgeliyo
Astaamahan soo socda lama heli karo haddii EKM la hawlgeliyo:
Astaamaha aan guud ahaan la heli karin, oo ay ku jiraan astaamaha ku jira beta ama alpha.