Guudmar
Maamulka Furayaasha Shirkadaha (EKM) wuxuu kuu oggolaanayaa inaad macluumaadka macaamiishaada ee OpenAI ku sirgeliso furayaal uu maamulo Nidaamkaaga Maamulka Furayaasha ee dibadda (KMS); adeeggan waxaa heli kara ChatGPT Enterprise iyo API labadaba.
OpenAI waxay taageertaa sirgelinta Bring Your Own Key (BYOK) ee akoonnada dibadda ee AWS KMS, Google Cloud (GCP), iyo Azure Key Vault.
Waqtigan, hirgelinta EKM waxay ku kooban tahay goobaha shaqada Enterprise iyo Edu ee leh wakiil akoon OpenAI oo loo magacaabay.
Sida siraynta OpenAI EKM u shaqeyso
Socodka Heerka Sare
Waxaan u sameynaa Data Encryption Key (DEK) bixiyahaaga cloud-ka.
Cloud KMS-gaagu wuxuu maamulaa Key Encryption Key (KEK) aasaasi ah, kaas oo ku kaydsan gudaha cloud-kaaga ama dibadda. Hirgelintu adiga ayay kugu xiran tahay.
Waxaan cloud-kaaga ka codsannaa siraynta DEK si aan u helno encrypted DEK (eDEK). Haddii KEK-gaaga dibadda lagu kaydiyo, cloud-kaagu wuxuu keliya sameeyaa tallaabo dheeraad ah oo ugu gudba kaydkaaga dibadda, taas oo aan u muuqan OpenAI.
Sirgelinta
Marka la sirgelinayo, xogtaada waxaa lagu sirgeliyaa DEK, eDEK-na waxaa faylka loogu kaydiyaa xog-sifeed ahaan.
Furfurid
Marka la furfurayo, waxaan codsannaa in eDEK-ga uu KMS-gaaga cloud-ku u furfuro DEK, kadibna xogta ayaan ku furfurnaa DEK-ga.
Ereyada Muhiimka ah
Data Encryption Key (DEK) - furaha sira xogtaada.
Encrypted Data Encryption Key (eDEK) - DEK-ga la siray, oo uu sameeyo KMS-gaagu
Key Encryption Key (KEK) - furaha aasaasiga ah ee aad maamusho kaas oo sira DEK -> eDEK isla markaana furfura eDEK -> DEK. Furahani mar walba wuxuu ka baxsan yahay nidaamyada OpenAI.
Shuruudaha heer-sare ee hirgelinta
Bixiyahaaga adeegga daruurta dhexdiisa
Ku dhex samee fure cusub KMS-ka daruurtaada (Azure, AWS, ama GCP)
Samee siyaasad gaar ah oo xaddidan, taas oo leh oggolaanshaha Encrypt/Decrypt ee KMS
OpenAI u samee siyaasad kalsooni (AWS), aqoonsiga culayska shaqada (GCP), ama maamule adeeg (Azure)
OpenAI u qoondee door leh siyaasadda xaddidan si ay u gasho KMS-kaaga
Gudaha madallada OpenAI
ChatGPT Enterprise
U samee goob shaqo ChatGPT sandbox ah ujeeddooyin tijaabo.
API
Gudaha dashboard-kaaga OpenAI, ku samee mashruuc cusub halkaas oo siraynta lagu dabaqi doono.
Hawlaha u gaarka ah bixiyaha
Dhanka AWS, OpenAI waxay:
wici doontaa AssumeRole iyadoo wadata ExternalID
Dhanka GCP, OpenAI waxay:
ka wici doontaa STS endpoint-kaaga akoon GCP oo OpenAI ah
u adeegsan doontaa GCP access token si ay ugu wacdo encrypt/decrypt gudaha KMS-gaaga.
Dhanka Azure, OpenAI waxay:
codsan doontaa access token loogu talagalay vault-ka tenant-kaaga Azure
u adeegsan doontaa access token-kaas si ay ugu wacdo encrypt/decrypt gudaha Key Vault-kaaga.
Macluumaadka aad uga baahan tahay OpenAI
Xaqiijin
Waxaad u baahan doontaa inaad aqoonsato tokennada aqoonsiga mideysan ee OpenAI ee AWS iyo GCP. Dhanka Azure, waxaad u baahan doontaa inaad aqoonsato application id-ga OpenAI ee diiwaangelinta app-keeda.
Soo koobidda xuduudaha xaqiijinta
| Mabda’a AWS ee OpenAI | arn:aws:iam::790389265272:role/EnterpriseKeyManagement |
| Aqoonsiga service account-ka GCP ee OpenAI | 105900137572174660365 |
| Aqoonsiga application-ka Azure ee OpenAI | 20a14814-5ab7-4612-a671-1382b412bf93 |
Macluumaadka loo baahan yahay inta lagu jiro hirgelinta, iyadoo lagu salaynayo bixiyahaaga adeegga daruurta
Marka la joogo AWS, waa inaad dejisaa siyaasad kalsooni oo aqoonsata:
Marka la joogo GCP, waa inaad dejisaa aqoonsiga culayska shaqada oo aqoonsada:
Marka la joogo Azure, waa inaad kireystahaaga Azure uga abuurtaa maamule adeeg diiwaangelinta abka OpenAI
Mid u samee aqoonsiga macmiilka abka ee OpenAI: 20a14814-5ab7-4612-a671-1382b412bf9
Waxaad tan samayn kartaa adigoo codsi POST ah u diraya bar-dhammaadka https://graph.microsoft.com/v1.0/servicePrincipals.
Oggolaanshaha
Waxaad u baahan doontaa inaad samayso siyaasad u oggolaanaysa aqoonsiga OpenAI inuu galaangal xaddidan u yeesho KMS-kaaga.
| AWS | GCP | Azure |
| kms:Decryptkms:Encrypt | cloudkms.cryptoKeyVersions.useToDecryptcloudkms.cryptoKeyVersions.useToEncrypt | Microsoft.KeyVault/vaults/keys/encrypt/actionMicrosoft.KeyVault/vaults/keys/decrypt/action |
Kale
Gudaha Azure, nooca Key-ga (algorithm-ka siraynta furaha), ka dooro RSA, hana dooran EC.
Macluumaadka ay OpenAI kaaga baahan tahay
Raac tilmaamaha ku jira dukumeentigan si aad KMS-kaaga uga diiwaangeliso OpenAI. Halkan waxaa ku qoran soo koobidda cabbirrada aad u baahan tahay inaad bixiso.
La xidhiidha xaqiijinta aqoonsiga
AWS
GCP
Azure
Aqoonsiga kireystaha
| AWS | GCP | Azure | |
| La xidhiidha xaqiijinta aqoonsiga | Aqoonsiga kireystaha | ||
| La xidhiidha KMS | KMS ARN — (tusaale: arn:aws:kms:REGION:ACCOUNT_NUMBER:key:KEY_UUID) | Aqoonsiga mashruuca KMS (tusaale: adjective-noun-12345) Magaca giraanta furaha KMS Magaca furaha KMS Goobta furaha KMS (tusaale: us-east1) | URI-ga Vault (tusaale: https://your-vault-name.vault.azure.net/) Magaca furaha |
Markaad KMS-kaaga ka diiwaangeliso OpenAI, sii wad raacista tilmaamaha dukumeentiga si aad habaynta EKM uga hawlgeliso mashruuc API ah. Ujeeddooyinka tijaabada awgood, samee mashruuc API oo OpenAI ah oo cusub.
Hagayaasha hirgelinta ee u gaarka ah bixiye kasta
Si aad u hesho hagitaan tallaabo-tallaabo ah, eeg xiriiriyeyaasha u dhigma ee hoose. Fadlan ogow in hagayaashani diiradda saarayaan shuruudaha ku-xidhidda OpenAI, loomana talagelin inay noqdaan hage dhammaystiran oo ku saabsan deegaankaaga oo dhan
Astaamaha aan la taageerin haddii EKM la hawlgeliyo
Astaamahan soo socda lama heli karo haddii EKM la hawlgeliyo:
Astaamaha aan guud ahaan la heli karin, oo ay ku jiraan astaamaha ku jira beta ama alpha.