Encryption configurations and patterns

Release version: Australia

Updated March 12, 2026

2 minutes to read

Summarize

Summarized using AI

Summary of Encryption configurations and patterns

Edge Encryption enables the encryption of fields and tokenization of strings to secure sensitive data. It supports AES encryption with 128-bit and 256-bit keys, contingent on the installation of the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy files.

Show full answer Show less

Key Features

Encryption Configurations:
- Standard Encryption: Provides the highest security, with values differing on each encryption; fields cannot be filtered, sorted, or compared.
- Equality-Preserving Encryption: Consistent encrypted values for identical field values, allowing for equality comparisons and group operations. Caution is advised when mixing encrypted and unencrypted data.
- Order-Preserving Encryption: Supports sorting, equality comparisons, and requires a MySQL database. If the proxy database is down, updates can occur, but the sort order may be inaccurate until repaired.
Encryption Patterns: Secure strings matching specific patterns (e.g., social security numbers) by replacing them with tokens. While not a primary method, it complements encryption configurations by addressing sensitive information outside encrypted fields.

Key Outcomes

By implementing these encryption configurations and patterns, ServiceNow customers can effectively protect sensitive data, ensure compliance, and maintain data integrity. It is crucial to secure and back up the proxy database, especially since clear text values are stored there when using encryption patterns.

With Edge Encryption, you can encrypt fields and tokenize strings.

Encryption configurations

You can encrypt individual fields using encryption configurations. Edge Encryption supports AES 128-bit encryption keys. If the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy files are installed, Edge Encryption supports AES 256-bit encryption keys for each encryption type. Edge Encryption supports the following types of encryption configurations.

Standard encryption: The encrypted value of a field is different each time the field is encrypted, even when the field value remains the same. Standard encryption is the most robust form of encryption. Fields using standard encryption cannot be sorted, grouped by, or filtered on.
Equality-preserving encryption: The encrypted value of a field is the same when the field value remains the same. Supports equality comparisons and group by operations on a field.
Note:
When equality-preserving encryption is selected for a field that already contains data, performing a group by action on the field may not group fields with the same value if one is encrypted and the other is not.
Order-preserving encryption: Uses tokens and encryption to secure data in your proxy database. Supports equality comparisons, group by operations, and the ability to sort data. The order preserving encryption type is only supported if there is a MySQL database configured for the Edge Encryption proxy server.
Note:
When using order-preserving encryption and the proxy database is down, updates can be made to fields using order-preserving encryption. However, the sort order will not be correct when trying to sort data based on those fields. Groups also will not work as expected. When the proxy database is again operational, schedule an order token repair job to repair missing tokens.

Table 1. Encryption typesThe following encryption types are listed in decreasing security quality.
Encryption type	Description
Standard AES 256	Fields cannot be filtered, sorted, or compared.
Standard AES 128	Fields cannot be filtered, sorted, or compared.
Equality preserving AES 256	Fields can be filtered using equality comparisons.
Equality preserving AES 128	Fields can be filtered using equality comparisons.
Order preserving AES 256	Fields can be sorted and equality comparison filtering can be used. Requires the use of a MySQL database in your network.
Order preserving AES 128	Fields can be sorted and equality comparison filtering can be used. Requires the use of a MySQL database in your network.

Encryption Patterns

You can secure sensitive data found in strings using encryption patterns. Once an encryption pattern is stored and activated, the Edge Encryption proxy server identifies strings that match the pattern in requests. Once located, the clear text string is stored in the proxy database and replaced on the instance with a token. Use encryption patterns to tokenize strings that match regular patterns such as social security and credit card numbers. While we recommend that encryption configurations be the primary method of encryption, use encryption patterns as a supplement to locate and secure sensitive information found outside of encrypted fields.

Note:

The Edge Encryption proxy server requires a MySQL database in your network only if using order preserving encryption or encryption patterns. Clear text values are stored in the proxy database in your network. For this reason, it is critical that you secure and regularly back up your proxy database. For recommendations, see Edge Encryption components.