Edge Encryption

Use encryption rule APIs to parse and encrypt values in requests moving through the Edge Encryption proxy server to the instance.

Specify that a proxy server is a trusted source so that Edge Encryption can process requests coming from that proxy server.

Encrypt fields by creating encryption configurations.

If you have the security-admin role, you can schedule jobs performed by the Edge Encryption proxy to repair or recover fields that use order preserving encryption.

Edge Encryption is a network encryption system that resides on your network and that encrypts and decrypts sensitive data as it travels between your data center and the ServiceNow cloud.

Successful implementation of Edge Encryption requires planning and preparation.

Edge Encryption is composed of the Edge Encryption proxy server that runs on a server in your network, and the Edge Encryption plugin that must be installed on your ServiceNow instance. If using order-preserving encryption types or encryption patterns, a proxy database must also be installed in your network.

You can encrypt attachments for specific tables.

You are responsible for providing and managing the encryption keys used by Edge Encryption.

Perform encryption key rotation from the instance. Add a new key, change the default key assignment, and then schedule a mass key rotation or a single key rotation.

An encryption rule maps fields in a client request to fields in a table on your instance and identifies fields marked for encryption.

Encryption rule conditions determine if the rule should be executed.

It may be necessary to identify and encrypt sensitive information in HTTP requests on the way to your instance. You can write encryption rules to identify, interpret, and encrypt data in such requests, mapping fields in the request to table-field names on your instance.

With Edge Encryption, you can encrypt fields and tokenize strings.

You can install an Edge Encryption proxy manually or using the Edge Encryption interactive installer.

Configure your ODBC driver to query data encrypted by Edge Encryption. The Edge Encryption proxy server encrypts ODBC driver requests to the ServiceNow instance when Edge Encryption is integrated with the ODBC driver.

A global object that provides methods to iterate over the JSON content.

You get a JsonNodeIterator object by calling the getIterator() or iterator() methods of the JsonNode class.

The request object is a global object available in Edge Encryption rule action and condition scripts.

Both instance upgrades and proxy server upgrades require special consideration in an Edge Encryption environment.

A global object that provides methods to iterate over the XML content.

Provides methods for iterating through XML elements and mapping values to fields in a table.

Provides methods for iterating over XML elements.

After you configure the HTTPS certificate through the Edge Encryption proxy installer, configure the AES 128-bit encryption key to encrypt your data.

After you configure the AES 128-bit key through the Edge proxy installer, you can optionally configure an AES 256-bit encryption key to encrypt your data.

To enable clients to connect to the Edge Encryption proxy server using a secure SSL connection, import the HTTPS certificate to the proxy server.

Optionally, configure CyberArk properties protection to securely store Edge Encryption passwords in a centralized and secure digital vault.

If using order-preserving encryption types or encryption patterns, you can optionally configure the Edge Encryption proxy database properties.

Configure the signature key after installing the proxy server through the Edge Encryption proxy installer.

Use CyberArk to store passwords in a centralized and secure digital vault to secure passwords that were previously stored in clear text and secured by file access, or that were previously encrypted via a second file.

To integrate third-party data with an instance using Edge Encryption, you must route the data through the Edge Encryption proxy server using supported integrations. Supported integrations use base system encryption rules that map data in each payload to fields in a table.

Prevent an IP address in your network from sending requests to your instance

Edge Encryption uses three clients to inform the instance that the proxy is running, to synchronize requests between the proxy and the instance, and to forward all end user requests to the instance after any potential encryption.

After the Edge Encryption proxy server is installed and running, manage Edge Encryption through the proxy server.

Increase the level of logging to interpret the logs and debug issues with the proxy.

Domain separation is supported in limited circumstances with Edge Encryption. Edge Encryption provides the ability to encrypt data from within the customer's environment through the use of specific configurations, rules, and keys defined on the Edge Encryption proxy. The Edge Encryption proxy is not domain aware and cannot support domain-specific settings. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.

Edge Encryption impacts system functions. Carefully evaluate the impact of encrypting a field.

The edgeencryption.properties configuration file located in the <installation directory>/conf/ folder contains properties used to configure your environment.

ServiceNow Edge Encryption encrypts sensitive data on your company premises before sending it over the internet to your ServiceNow instance. Data is encrypted in flight and remains encrypted at rest.

Choosing the number of proxy servers for your environment is an important task. Consider the number of users, redundancy needs, and acceptable latency.

Configure the MID Server to route data through an Edge Encryption proxy server.

Monitor Edge Encryption proxy server performance trends and drill into errors generated by the Edge Encryption proxy server.

Set the initial memory limit and upper bound memory limit to specify how much memory the proxy server can consume. Set these limits to avoid performance issues in your Edge Encryption implementation.

Install an Edge Encryption proxy on a 64-bit Windows or Linux computer.

Install the Edge Encryption proxy on a Windows or Linux computer.

Edge Encryption installs tables to store encryption-related data, system properties to configure default behavior, and the edge_encryption role to administer Edge Encryption.

JSON APIs can be used after calling getAsJsonContent() on either the request object or a ParameterValue property.

After an Edge Encryption proxy is installed and configured, you can start the proxy from the installer.

You can use a load balancer to balance the load across the proxy servers in your Edge Encryption proxy setup. If the load balancer and proxy servers are using different ports, specify the host name and HTTPS port of the load balancer to enable users to view responses on their browser.

Manually install multiple Edge Encryption proxy servers in your network.

POST and URL parameters can be accessed as properties of the request object using request.postParams and request.urlParams.

Install the Edge Encryption proxy server on a Windows or Linux computer using the interactive installer.

You can run the Edge Encryption proxy application on servers or virtual machines that run on Microsoft Windows or Linux operating systems. For optimum performance, ensure that your configuration meets these requirements.

Add dictionary attributes to tables and fields to control how they work with Edge Encryption.

Prints a message to the wrapper log file: <proxy server directory>/logs/wrapper_<date>.log.

The Edge Encryption proxy validates encryption rule scripts before saving the rule. Many JavaScript keywords aren’t allowed in encryption rule scripts.

Configure your Edge Encryption proxy server to allow inserts from a record producer by creating encryption rules from the record producer record.

Before creating a custom encryption rule, you must determine the format of the client request entering the Edge Encryption proxy server.

Use SafeNet key versioning to simplify changing keys. Instead of creating an alias for every new key, SafeNet key versioning keeps the same alias and increments the version.

Create an upgrade schedule to enable the instance to upgrade an out-of-date proxy server.

After installing the Edge Encryption proxy server in your network and setting up your keystore and keys, configure the additional Edge Encryption properties.

Set up the keystore and encryption keys used by the Edge Encryption proxy server.

If using order-preserving encryption or encryption patterns, determine the size of your MySQL database by multiplying the number of potential records by record size.

Set up multiple provider SSO to enable logging in through the Edge Encryption proxy server URL or the instance URL. If you are implementing multiple provider single sign-on (SSO) with Edge Encryption enabled, some users might need to log in to your instance through the Edge Encryption proxy server, while other users might not.

After the first Edge Encryption proxy is properly configured and tested, you can set up additional proxies on a Linux or Windows machine. Installing multiple proxies on the same machine is not recommended.

You can change a field or attachment's encryption type by selecting a new encryption type in the existing encryption configuration record. A specific table and field combination can only have one active configuration at a time.

You can replace string patterns with tokens before they are sent to and stored in the instance.

You can use a simple text file as a keystore. Each file holds a single encryption key.

Encryption rules are used by the proxy to find content in HTTP requests that should be encrypted.

You can use the keytool shipped with the encryption proxy distribution to create AES 128-bit and AES 256-bit encryption keys.

Download the Edge Encryption proxy server application from your instance, and then copy the file to each computer that is to run the Edge Encryption proxy server.

The Edge Encryption plugin (com.glide.edgeencryption) is available as a separate subscription.

You can use a Java KeyStore keystore to store encryption keys.

If a proxy upgrade is unsuccessful, you can go back to the earlier version.

Edge Encryption provides the tools to manage encryption keys without taking the proxy offline.

After an Edge Encryption proxy is installed and configured, you can start the proxy from the command line.

Create an RSA key pair that the proxy server can use to create the digital signature for signing changes to the encryption properties and configuration.

The Edge Encryption proxies connect to the instance as a user to obtain and update encryption configuration information. Create a user account for this purpose and give the edge_encryption role to the user.

If you are using a SafeNet keystore, copy a set of libraries into the proxy distribution directory.

Obfuscate passwords in the edgeencryption.properties file to be able to share the properties file without revealing clear text passwords.

To use a secure SSL connection, import a server certificate and add it to the Java KeyStore.

If your network uses a web proxy, you can set up the Edge Encryption proxy to use the web proxy.

You can stop an Edge Encryption proxy from the command line.

You can uninstall the Edge Encryption proxy. If you are upgrading the proxy, it is not necessary to shut down and uninstall the current version.

You can uninstall the Edge Encryption proxy. If you are upgrading the proxy, it is not necessary to shut down and uninstall the current version.

Update a proxy running on Linux.

Update a proxy running on Windows.

Use Unbound Technology (previously Dyadic Security) keys with Edge Encryption by storing the base64-encoded wrapped encryption key as text file on the Edge Encryption proxy server and providing the wrapping key alias. The Unbound Technology implementation maintains control of the wrapping key.

When updating an SSL certificate on an Edge proxy server, you must delete the old one.

After your Edge Encryption proxy is installed, you can verify the installation to locate problems or start and stop the proxy.

XML APIs can be used after calling getAsXmlContent() on either the request object or a ParameterValue property.