当您退回设备时，我们会在 Google 数据中心接收设备。当您订购用于数据导出的设备时，我们会在 Google 数据中心之一准备该设备。保障客户数据安全是我们的第一要务和责任。如需详细了解我们的基础架构安全，请参阅 Google 基础架构安全设计概览；如需详细了解我们的数据中心安全做法，请参阅数据和安全。
确保运输过程中设备的安全
收到设备后，您需要运行 Transfer Appliance 证明应用。此应用会验证设备的身份及其状态，以确保设备的状态与我们寄送给您的状态相同。该应用会生成一个您要与我们分享的认证通行密钥。如果认证通行密钥与我们预期相符，我们会提供该设备的登录凭据。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-17。"],[],[],null,["# Security and encryption\n\nThis page describes how Transfer Appliance secures and encrypts your\ndata.\n\nGoogle's infrastructure data security\n-------------------------------------\n\nWhen you return an appliance, we receive it at one of our Google data centers.\nWhen you order an appliance for data export, we prepare it at one of our Google\ndata centers.\nSecuring customer data is our top priority and responsibility. For more\ninformation about our infrastructure security, see [Google Infrastructure\nSecurity Design\nOverview](https://cloud.google.com/security/infrastructure/design), and for more\ninformation about our data center security practices, see [Data and\nSecurity](https://www.google.com/about/datacenters/data-security/).\n\nSecuring the appliance in transit\n---------------------------------\n\nWhen you receive your appliance, you run the\n[Transfer Appliance Attestation Application](/transfer-appliance/docs/4.0/receive-appliance#validate). This application\nvalidates the appliance identity and its state, to ensure that the appliance is\nin the same state as it was when we shipped it to you. The application generates\nan attestation passcode that you share with us. If the attestation passcode\nmatches what we expect, we provide the login credentials for the appliance.\n\nWhen you're done using the appliance and we've received the appliance from you,\nwe validate the appliance again to ensure that it wasn't tampered with during\nshipping. After we've verified the appliance, we upload your data to\nCloud Storage.\n\nIf the appliance validation indicates that the appliance was tampered with at\nany point, we invalidate the entire transfer session and work with you to ship\nyou a replacement appliance.\n\nData encryption\n---------------\n\nYour data is encrypted during upload, during transit to our data centers,\nafter it has been uploaded to Cloud Storage, and during download to the\nappliance when using data export feature. The following are details of how\nwe encrypt your data:\n\n- **During transit to Cloud Storage** : Your data is encrypted on\n Transfer Appliance with `dm-encrypt` and partition-level\n encryption, with the AES-256 encryption algorithm.\n\n- **During upload to Cloud Storage**: Your data is encrypted using secure\n TLS connections. We transfer the encrypted data on your appliance to\n Cloud Storage. For customers using VPC Service Controls, this process occurs\n within your VPC Service Controls perimeter.\n\n- **On Cloud Storage** : Your data is encrypted on Cloud Storage by\n default. For more details, see\n [Data encryption options](/storage/docs/encryption).\n\n- **During download to Transfer Appliance**: Your data is encrypted\n in the cloud before it is downloaded to the appliance when data export feature is used.\n\n### Encrypting data in transit to your appliance\n\nWe do not apply encryption between your storage or network devices and your\nappliance. Securing the network and physical access to the appliance is your\nresponsibility. We do not access or monitor the appliance while it is connected\nto your network.\n\n### Encrypting data on your appliance\n\nWe use two keys to encrypt data on your appliance:\n\n- [A key encryption key](#key-encryption-key), which is applied to the data\n encryption key before you return the appliance to us.\n\n- [A data encryption key](#data-encryption-key), which is applied to your data\n before it is written to the appliance's disks.\n\n#### Key encryption key\n\nYou have the following two choices for the key encryption key (KEK):\n\n- You can create a customer-managed key, where you generate and manage the\n key yourself.\n\n- You can select a Google-owned and managed key, in which we\n generate and manage the key.\n\n Google-owned and managed keys are unique per session, and\n are not shared with other Google Cloud services. When a session is\n completed or cancelled, or if an appliance is lost, we destroy the key to\n ensure your data security.\n\n The following are the settings used to create\n Google-owned and managed keys:\n - **Region** : [Global](/kms/docs/locations#global)\n - **Protection level:** Software\n - **Purpose**: Asymmetric decrypt\n - **Algorithm:** 4096-bit RSA - OAEP Padding - SHA256 Digest\n\nDestroying the KEK before the session is completed results in complete data loss\non the appliance.\n\nThe KEK is generated as a Cloud Key Management Service (Cloud KMS) asymmetric key in\nGoogle Cloud, and we download the KEK public key to the appliance before we ship\nit to you.\n\n#### Data encryption key (DEK)\n\nThe DEK is generated on the appliance. The DEK is kept in memory, and is stored\non the appliance's Trusted Platform Module to persist the key across reboots.\nThe DEK is never stored on a local disk unencrypted.\n\nThe appliance applies the generated DEK to your data before writing your data to\ndisk. When you finalize the data on the appliance, the KEK public key is applied\nto the DEK, and then the DEK is removed from the appliance.\n\nData is never stored unencrypted on the appliance.\n\n### Encrypt data for data export from Cloud Storage\n\nWhen you order an appliance for data export, your appliance is prepared in a\nsecured Google data center and your data is encrypted first. The encrypted data is then\nsecurely moved to the appliance which is further secured with disk level encryption.\nYour data remains encrypted on the appliance while in the data center and during\ntransit and is only accessible once you activate the appliance.\n\n### Restrict access to data on your appliance\n\nTo restrict access to the data stored on your appliance's NFS shares, you can\napply an IP filter that allows specific hosts on your network to access the\nappliance. Contact your network administrator for assistance.\n\nFor more information about the IP network ports that Transfer Appliance\nuses, see [Configuring IP network ports](/transfer-appliance/docs/4.0/ip-network-ports).\n\n### Upload data to Cloud Storage\n\nWhen we receive your appliance in one of our secured data centers, we upload\nyour encrypted data into your VPC Service Controls perimeter before applying the KEK\nto decrypt the DEK and your data. The DEK is never persisted at any point during\nthe transfer lifecycle. Then we securely move your data to\nCloud Storage on our private data center network using secure TLS\nconnections. Your data is encrypted in Cloud Storage by default, and is\naccessible only to you.\n\nAppliance media sanitization\n----------------------------\n\nAfter uploading your data or receiving the appliance for data export,\nwe sanitize the drive media in the appliance you\nreturned by applying NIST 800-88 standards for purging information.\nSpecifically, we use cryptographic erasure to sanitize all encrypted data\npreviously stored on the appliance's drives. If a drive suffers a failure during\nuse that renders it inoperable and unable to be erased, we physically destroy\nthe affected physical media. For more information on our media sanitization\nprocesses, see\n[Ensure safe and secure media sanitization](/security/deletion#ensuring_safe_and_secure_media_sanitization).\n\nYou can request a wipe certificate for proof that we've securely sanitized the\nappliance media within 4 weeks after your data is available within\nCloud Storage or after you've returned the appliance after data export.\n\nTransfer Appliance refurbishment\n--------------------------------\n\nOnce we've destroyed your data on the appliance you returned, we prepare to ship\nthe appliance out to the next customer. The following is a summary of how we\nrefurbish each appliance after media sanitization:\n\n1. We partition the drives on the appliance. Media sanitization also destroys\n our data partitions, so we start fresh each time.\n\n2. Then we reformat the drives, preparing them to store data and the\n appliance's software.\n\n3. Next, we install the appliance's software, and apply any necessary updates.\n\n4. Finally, we package and prepare to ship the appliance to the next customer."]]
