建構用於用戶端加密的自訂金鑰服務
透過集合功能整理內容
你可以依據偏好儲存及分類內容。
您可以使用自己的加密金鑰來加密貴機構的資料，而非使用 Google Workspace 提供的加密功能。如果使用 Google Workspace 用戶端加密 (CSE) 功能，系統會先在用戶端的瀏覽器中加密檔案，再將檔案儲存在雲端硬碟的雲端儲存空間。這麼一來，Google 伺服器就無法存取您的加密金鑰，也無法解密資料。詳情請參閱「關於用戶端加密」。
透過這項 API，您可以透過自訂外部金鑰服務，控管用於保護資料的頂層加密金鑰。使用這個 API 建立外部金鑰服務後，Google Workspace 管理員就能連線至該服務，並為使用者啟用 CSE。
重要術語
以下列出 Google Workspace Client-side Encryption API 的常用字詞：
- 用戶端加密 (CSE)
- 系統會先在用戶端瀏覽器中加密郵件，再將郵件儲存在雲端儲存空間。這可防止儲存空間供應商讀取檔案。瞭解詳情
- 金鑰存取控管清單服務 (KACLS)
- 您的外部金鑰服務會使用這個 API，控管外部系統中儲存的加密金鑰存取權。
- 識別資訊提供者 (IdP)
- 這項服務會先驗證使用者，接著使用者才能為檔案加密，或是存取已加密的檔案。
加密與解密
- 資料加密金鑰 (DEK)
- Google Workspace 在瀏覽器用戶端中使用的金鑰，可加密資料本身。
- 金鑰加密金鑰 (KEK)
- 服務中的金鑰，用來加密資料加密金鑰 (DEK)。
存取權控管
- 存取控制清單 (ACL)
- 可開啟或讀取檔案的使用者或群組清單。
- 驗證 JSON Web Token (JWT)
- 不記名權杖 (JWT：RFC 7516)：由身分合作夥伴 (IdP) 發行，用於驗證使用者身分。
- 授權 JSON Web Token (JWT)
- 不記名權杖 (JWT：RFC 7516)
由 Google 發行，用於驗證呼叫者是否有權加密或解密資源。
- JSON Web Key Set (JWKS)
- 唯讀端點網址，指向用於驗證 JSON Web Token (JWT) 的公開金鑰清單。
- Perimeter
- 在 KACLS 中對驗證和授權權杖執行額外檢查，以進行存取權控管。
用戶端加密程序
管理員為機構啟用 CSE 後，只要使用者也啟用 CSE，就能選擇使用 Google Workspace 協作內容建立工具 (例如文件和試算表) 建立加密文件，或是將上傳到 Google 雲端硬碟的檔案 (例如 PDF) 加密。
使用者加密文件或檔案後：
Google Workspace 會在用戶端瀏覽器中產生 DEK，用於加密內容。
Google Workspace 會使用您提供給 Google Workspace 機構管理員的網址，將 DEK 和驗證權杖傳送至第三方 KACLS 進行加密。
您的 KACLS 會使用這個 API 加密 DEK，然後將經過混淆處理的加密 DEK 傳回 Google Workspace。
Google Workspace 會將經過模糊處理的加密資料儲存在雲端。
只有有權存取 KACLS 的使用者才能存取資料。
詳情請參閱「加密及解密檔案」。
後續步驟
除非另有註明，否則本頁面中的內容是採用創用 CC 姓名標示 4.0 授權，程式碼範例則為阿帕契 2.0 授權。詳情請參閱《Google Developers 網站政策》。Java 是 Oracle 和/或其關聯企業的註冊商標。
上次更新時間：2025-08-29 (世界標準時間)。
[null,null,["上次更新時間：2025-08-29 (世界標準時間)。"],[[["\u003cp\u003eGoogle Workspace Client-side Encryption (CSE) allows you to encrypt your organization's data with your own keys, preventing Google servers from accessing or decrypting it.\u003c/p\u003e\n"],["\u003cp\u003eThis API enables you to manage the encryption keys via an external key service, giving you control over data access.\u003c/p\u003e\n"],["\u003cp\u003eCSE encrypts files in the user's browser before they are stored in Google Drive, ensuring only authorized users with access to your external key service can decrypt them.\u003c/p\u003e\n"],["\u003cp\u003eWhen a file is encrypted, Google Workspace generates a Data Encryption Key (DEK), which is then encrypted by your external key service and stored with the encrypted data.\u003c/p\u003e\n"],["\u003cp\u003eTo get started, you can configure your external key service and learn how to encrypt and decrypt data using the provided guides.\u003c/p\u003e\n"]]],["Google Workspace Client-side Encryption (CSE) allows users to encrypt data in their browser before cloud storage. This is achieved by using your own external Key Access Control List Service (KACLS). Google Workspace generates a Data Encryption Key (DEK) and sends it to your KACLS for encryption with a Key Encryption Key (KEK). Your service then returns the encrypted DEK to Google Workspace. This ensures that only users with KACLS access can decrypt the stored data.\n"],null,["# Build a custom key service for client-side encryption\n\nYou can use your own encryption keys to encrypt your organization's data,\ninstead of using the encryption that Google Workspace provides. With Google Workspace Client-side Encryption (CSE), file encryption is handled in the\nclient's browser before it's stored in Drive's cloud-based storage. That way,\nGoogle servers can't access your encryption keys and, therefore, can't decrypt\nyour data. For more details, see\n[About client-side encryption](https://support.google.com/a/answer/10741897#zippy=%2Cbasic-setup-steps-for-cse).\n\nThis API lets you control the top-level encryption keys that protect your data\nwith a custom external key service. After you create an external key service\nwith this API, Google Workspace administrators can connect to it and enable CSE\nfor their users.\n\nImportant terminology\n---------------------\n\nBelow is a list of common terms used in the Google Workspace Client-side Encryption API:\n\n*Client-side encryption (CSE)*\n: Encryption that's handled in the client's browser before it's stored in\n cloud-based storage. This protects the file from being read by the storage\n provider. [Learn more](https://support.google.com/a/answer/10741897#zippy=%2Chow-is-cse-different-from-end-to-end-ee-encryption)\n\n*Key Access Control List Service (KACLS)*\n: Your external key service that uses this API to control access to encryption\n keys stored in an external system.\n\n*Identity Provider (IdP)*\n: The service that authenticates users before they can encrypt files or access\n encrypted files.\n\n### Encryption \\& decryption\n\n*Data Encryption Key (DEK)*\n: The key used by Google Workspace in the browser client to encrypt the data\n itself.\n\n*Key Encryption Key (KEK)*\n: A key from your service used to encrypt a Data Encryption Key (DEK).\n\n### Access control\n\n*Access Control List (ACL)*\n: A list of users or groups that can open or read a file.\n\n*Authentication JSON Web Token (JWT)*\n: Bearer token ([JWT: RFC 7516](https://tools.ietf.org/html/rfc7516))\n issued by the identity partner (IdP) to attest a user's identity.\n\n*Authorization JSON Web Token (JWT)*\n: Bearer token ([JWT: RFC 7516](https://tools.ietf.org/html/rfc7516))\n issued by Google to verify that the caller is authorized to encrypt or decrypt a resource.\n\n*JSON Web Key Set (JWKS)*\n: A read-only endpoint URL that points to a list of public keys used to verify\n JSON Web Tokens (JWT).\n\n*Perimeter*\n: Additional checks performed on the authentication and authorization tokens\n within the KACLS for access control.\n\nClient-side encryption process\n------------------------------\n\nAfter an administrator enables CSE for their organization, users for whom CSE is\nenabled can choose to create encrypted documents using the Google Workspace\ncollaborative content creation tools, like Docs and Sheets, or encrypt files\nthey upload to Google Drive, such as PDFs.\n\nAfter the user encrypts a document or file:\n\n1. Google Workspace generates a DEK in the client browser to encrypt the\n content.\n\n2. Google Workspace sends the DEK and authentication tokens to your third-party\n KACLS for encryption, using a URL you provide to the\n Google Workspace organization's administrator.\n\n3. Your KACLS uses this API to encrypt the DEK, then sends the obfuscated,\n encrypted DEK back to Google Workspace.\n\n4. Google Workspace stores the obfuscated, encrypted data in the cloud.\n Only users with access to your KACLS are able to access the data.\n\nFor more details, see [Encrypt and decrypt files](/workspace/cse/guides/encrypt-and-decrypt-data).\n\nNext steps\n----------\n\n- Learn how to [configure your service](/workspace/cse/guides/configure-service).\n- Learn how to [encrypt \\& decrypt data](/workspace/cse/guides/encrypt-and-decrypt-data)."]]
