构建自定义密钥服务以启用客户端加密功能
使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
您可以使用自己的加密密钥来加密组织的数据，而不是使用 Google Workspace 提供的加密密钥。使用 Google Workspace 客户端加密功能 (CSE) 时，系统会在将文件存储到云端硬盘的云端存储空间之前，先在客户端的浏览器中对文件进行加密。使用这种方式时，Google 服务器无法访问您的加密密钥，因此也无法解密您的数据。如需了解详情，请参阅客户端加密功能简介。
借助此 API，您可以使用自定义的外部密钥服务来控制可保护数据的顶级加密密钥。使用此 API 创建外部密钥服务后，Google Workspace 管理员可以连接到该服务，并为用户启用 CSE。
重要术语
以下是 Google Workspace Client-side Encryption API 中使用的常见术语列表：
- 客户端加密功能 (CSE)
- 在将数据存储到云端存储空间之前，先在客户端的浏览器中对数据进行加密。这样可以防止存储空间提供商读取该文件。了解详情
- Key Access Control List Service (KACLS)
- 使用此 API 来控制对存储在外部系统中的加密密钥的访问权限的外部密钥服务。
- 身份提供方 (IdP)
- 在用户对文件进行加密或访问已加密的文件之前，对用户进行身份验证的服务。
加密和解密
- 数据加密密钥 (DEK)
- Google Workspace 在浏览器客户端中用于加密数据本身的密钥。
- 密钥加密密钥 (KEK)
- 您服务中的一个密钥，用于加密数据加密密钥 (DEK)。
访问权限控制
- 访问控制列表 (ACL)
- 可打开或读取文件的用户或群组的列表。
- 身份验证 JSON Web 令牌 (JWT)
- 由身份合作伙伴 (IdP) 签发的不记名令牌 (JWT：RFC 7516)，用于证明用户身份。
- 授权 JSON Web 令牌 (JWT)
- 由 Google 签发的不记名令牌 (JWT：RFC 7516)，用于验证调用者是否已获得加密或解密资源的授权。
- JSON Web 密钥集 (JWKS)
- 指向用于验证 JSON Web 令牌 (JWT) 的公钥列表的只读端点网址。
- Perimeter
- 在 KACLS 内对身份验证和授权令牌执行额外的检查，以实现访问权限控制。
客户端加密流程
管理员为组织启用 CSE 后，已启用 CSE 的用户可以选择使用 Google Workspace 协作式内容创建工具（例如 Google 文档和 Google 表格）创建加密文档，或对其上传到 Google 云端硬盘的文件（例如 PDF）进行加密。
用户加密文档或文件后：
Google Workspace 会在客户端浏览器中生成 DEK 来加密内容。
Google Workspace 会使用您向 Google Workspace 组织管理员提供的网址，将 DEK 和身份验证令牌发送到您的第三方 KACLS 进行加密。
您的 KACLS 使用此 API 加密 DEK，然后将混淆的加密 DEK 发送回 Google Workspace。
Google Workspace 会将混淆处理后的加密数据存储在云端。只有有权访问您的 KACLS 的用户才能访问相应数据。
如需了解详情，请参阅加密和解密文件。
后续步骤
如未另行说明，那么本页面中的内容已根据知识共享署名 4.0 许可获得了许可，并且代码示例已根据 Apache 2.0 许可获得了许可。有关详情，请参阅 Google 开发者网站政策。Java 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-08-29。
[null,null,["最后更新时间 (UTC)：2025-08-29。"],[[["\u003cp\u003eGoogle Workspace Client-side Encryption (CSE) allows you to encrypt your organization's data with your own keys, preventing Google servers from accessing or decrypting it.\u003c/p\u003e\n"],["\u003cp\u003eThis API enables you to manage the encryption keys via an external key service, giving you control over data access.\u003c/p\u003e\n"],["\u003cp\u003eCSE encrypts files in the user's browser before they are stored in Google Drive, ensuring only authorized users with access to your external key service can decrypt them.\u003c/p\u003e\n"],["\u003cp\u003eWhen a file is encrypted, Google Workspace generates a Data Encryption Key (DEK), which is then encrypted by your external key service and stored with the encrypted data.\u003c/p\u003e\n"],["\u003cp\u003eTo get started, you can configure your external key service and learn how to encrypt and decrypt data using the provided guides.\u003c/p\u003e\n"]]],["Google Workspace Client-side Encryption (CSE) allows users to encrypt data in their browser before cloud storage. This is achieved by using your own external Key Access Control List Service (KACLS). Google Workspace generates a Data Encryption Key (DEK) and sends it to your KACLS for encryption with a Key Encryption Key (KEK). Your service then returns the encrypted DEK to Google Workspace. This ensures that only users with KACLS access can decrypt the stored data.\n"],null,["# Build a custom key service for client-side encryption\n\nYou can use your own encryption keys to encrypt your organization's data,\ninstead of using the encryption that Google Workspace provides. With Google Workspace Client-side Encryption (CSE), file encryption is handled in the\nclient's browser before it's stored in Drive's cloud-based storage. That way,\nGoogle servers can't access your encryption keys and, therefore, can't decrypt\nyour data. For more details, see\n[About client-side encryption](https://support.google.com/a/answer/10741897#zippy=%2Cbasic-setup-steps-for-cse).\n\nThis API lets you control the top-level encryption keys that protect your data\nwith a custom external key service. After you create an external key service\nwith this API, Google Workspace administrators can connect to it and enable CSE\nfor their users.\n\nImportant terminology\n---------------------\n\nBelow is a list of common terms used in the Google Workspace Client-side Encryption API:\n\n*Client-side encryption (CSE)*\n: Encryption that's handled in the client's browser before it's stored in\n cloud-based storage. This protects the file from being read by the storage\n provider. [Learn more](https://support.google.com/a/answer/10741897#zippy=%2Chow-is-cse-different-from-end-to-end-ee-encryption)\n\n*Key Access Control List Service (KACLS)*\n: Your external key service that uses this API to control access to encryption\n keys stored in an external system.\n\n*Identity Provider (IdP)*\n: The service that authenticates users before they can encrypt files or access\n encrypted files.\n\n### Encryption \\& decryption\n\n*Data Encryption Key (DEK)*\n: The key used by Google Workspace in the browser client to encrypt the data\n itself.\n\n*Key Encryption Key (KEK)*\n: A key from your service used to encrypt a Data Encryption Key (DEK).\n\n### Access control\n\n*Access Control List (ACL)*\n: A list of users or groups that can open or read a file.\n\n*Authentication JSON Web Token (JWT)*\n: Bearer token ([JWT: RFC 7516](https://tools.ietf.org/html/rfc7516))\n issued by the identity partner (IdP) to attest a user's identity.\n\n*Authorization JSON Web Token (JWT)*\n: Bearer token ([JWT: RFC 7516](https://tools.ietf.org/html/rfc7516))\n issued by Google to verify that the caller is authorized to encrypt or decrypt a resource.\n\n*JSON Web Key Set (JWKS)*\n: A read-only endpoint URL that points to a list of public keys used to verify\n JSON Web Tokens (JWT).\n\n*Perimeter*\n: Additional checks performed on the authentication and authorization tokens\n within the KACLS for access control.\n\nClient-side encryption process\n------------------------------\n\nAfter an administrator enables CSE for their organization, users for whom CSE is\nenabled can choose to create encrypted documents using the Google Workspace\ncollaborative content creation tools, like Docs and Sheets, or encrypt files\nthey upload to Google Drive, such as PDFs.\n\nAfter the user encrypts a document or file:\n\n1. Google Workspace generates a DEK in the client browser to encrypt the\n content.\n\n2. Google Workspace sends the DEK and authentication tokens to your third-party\n KACLS for encryption, using a URL you provide to the\n Google Workspace organization's administrator.\n\n3. Your KACLS uses this API to encrypt the DEK, then sends the obfuscated,\n encrypted DEK back to Google Workspace.\n\n4. Google Workspace stores the obfuscated, encrypted data in the cloud.\n Only users with access to your KACLS are able to access the data.\n\nFor more details, see [Encrypt and decrypt files](/workspace/cse/guides/encrypt-and-decrypt-data).\n\nNext steps\n----------\n\n- Learn how to [configure your service](/workspace/cse/guides/configure-service).\n- Learn how to [encrypt \\& decrypt data](/workspace/cse/guides/encrypt-and-decrypt-data)."]]
