Exploring the Key Management Framework

Learn about the components of the Key Management Framework (KMF), and how to use them to manage how cryptographic operations are performed on your instance.

Components of the Key Management Framework

This graphic shows you the components that comprise the KMF.

KMF cryptographic modules

KMF is centered around managing Cryptographic modules. Use these modules to define what data on your instance is encrypted, and what method of encryption to use. By using multiple modules, you can encrypt different areas of your instance using different cryptographic specifications.

For example, if you wanted to secure the data in your Human Resources application with an AES-CBC with a 256-bit symmetric key, you can create a module for that purpose. For more information on these modules, see Cryptographic module overview.

Cryptographic keys

Cryptographic keys are strings of characters used in cryptography. When used together with a cryptographic algorithm, they can encode or decode your data. These keys are used by the cryptographic specifications assigned to your modules. You can choose to use a key generated by ServiceNow, or upload your own key with Field Encryption Enterprise. For more information on keys, see Instance level keys in the Key Management Framework.

Cryptographic specifications

A cryptographic specification defines algorithms used to encrypt data. These algorithms use a cryptographic key to encode or decode your data. Assigning a cryptographic specification to the module determines how the data assigned to that module is encrypted.

Module access policies

Module access policies (MAPs) are the access controls you apply to your cryptographic modules. Use these policies to determine which users and scripts can access data encrypted by a cryptographic module. For more information, see Module access policy overview.

Key Management Framework workflow

1. Assign KMF roles

Administrators must begin by assigning themselves the sn_kmf.admin role. This role enables you to use KMF features and assign KMF roles to other users.

2. Configure KMF settings

Configure your field encryption settings to select either supplied keys or your own customer-supplied keys (CSK) for encryption.

3.Create cryptographic modules

Use cryptographic modules to select a set of data on your instance to be encrypted. In later steps, you assign a cryptographic specification to determine how to encrypt this data, and a module access policy to determine who can decrypt the data.

4. Create a cryptographic specification

The cryptographic specification defines a method of encryption. Once assigned to a module, it defines how the data assigned to that module is encrypted.

5. Create module access policies

After creating modules to secure your data, create module access policies to control which users and scripts are able to access the encrypted data.

6. Create a cryptographic module life-cycle policy

These policies place limits on cryptographic modules, such as how long a cryptographic key is valid. These policies can safeguard your cryptographic modules by limiting their exposure.

Key Management Framework benefits

Benefit	Feature	Users
Protect your sensitive and proprietary data.	Encryption and key Management	All
Maintain compliance with NIST 800-57 guidelines. These guidelines are provided by the National Institute of Standards and Technology to reduce cybersecurity risk to your networks and data.	Encryption and key Management	Security administrators
Use the Key Management Framework to generate, upload, view, and manage your cryptographic keys. Use key rotation for manual or scheduled rotation of your keys for increased security.	Key Management Framework	Security administrators

• Cryptographic module overview
  The Key Management Framework (KMF) is centered around managing Cryptographic modules. Use these modules to select a cryptographic mechanism and define where they're applied on your instance.
• Cryptographic specification
  The Cryptographic specification is the component that defines aspects of your cryptographic module, including its cryptographic purpose and which encryption algorithm to use.
• Module access policy overview
  Module access policies (MAPs) are access controls that you apply to your cryptographic modules. Use these access policies to decide which users and scripts can access data encrypted by a cryptographic module.
• Instance level keys in the Key Management Framework
  Learn about the Key Management Framework (KMF) key structure, which uses envelope encryption to ensure that all platform keys under KMF management are protected through a chain of keys. Customer Data Encryption Keys (CDEKs) created by KMF are also included in this structure