{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":41742,"path":"platform-security/platform-encryption/instance-level-keys.md","title":"Instance level keys in the Key Management Framework","bundle":null,"doc_type":null,"release":"australia","body":"\n# Instance level keys in the Key Management Framework\n\nLearn about the Key Management Framework \\(KMF\\) key structure, which uses envelope encryption to ensure that all platform keys under KMF management are protected through a chain of keys. Customer Data Encryption Keys \\(CDEKs\\) created by KMF are also included in this structure\n\n.\n\n## KMF key storage architecture\n\nThe KMF key structure uses the SafeNet KeySecure Hardware Security Module \\(HSM\\). The HSM is designed to be physically and electronically tamper-proofed to meet the [FIPS 140-2-L3 security standard](https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp2850.pdf). KMF uses envelope encryption to ensure that all platform keys under KMF management are protected through a chain of keys, including the module keys that can be generated by KMF.\n\n## Envelope encryption\n\nEnvelope encryption is the practice of encrypting a key with another key, also referred to as wrapping. Module keys are envelope encrypted by the Instance Key Encryption Key \\(IKEK\\), which in turn is envelope encrypted by the Instance Root Key \\(IRK\\), which is finally envelope encrypted by the Root Key \\(RK\\). Since the IRK can only be accessed by the HSM, the IKEK must be uploaded for decryption.\n\n\\[Omitted image \"envelope-encryption.png\"\\] Alt text: Envelope encryption flow for ServiceNow keys\n\nAt the instance level, KMF defines several keys that are used internally for varying cryptographic purposes throughout the ServiceNow AI Platform.\n\nThis table provides examples of a subset of available keys that are managed and protected by KMF.\n\n\n
\n\nKey\n\n\n\nLocation\n\n\n\nDescription\n\n
\n\nRoot Key \\(RK\\)\n\n\n\nHardware Security Model \\(HSM\\)\n\n\n\nRoot key used to decrypt the IRK.\n\n
\n\nInstance Root Key \\(IRK\\)\n\n\n\nHSM\n\n\n\nA key unique to your instance that is used to envelope-encrypt several instance internal keys.\n\n
\n\nInstance HMAC Key \\(IHK\\)\n\n\n\nInstance\n\n\n\nUnique per instance, the IHK is used internally for Hash-Based Message Authentication Code \\(HMAC\\) purposes. The IHK helps to verify the authenticity and integrity of module keys and is wrapped on either KeySecure or the File Key Store.\n\n
\n\nInstance Key Encryption Key \\(IKEK\\)\n\n\n\nInstance\n\n\n\nThe IKEK wraps the module keys and is wrapped on either KeySecure or the File Key Store.\n\n
\n\nInstance Asymmetric Encryption Key \\(IAEK\\)\n\n\n\nInstance\n\n\n\nA key unique to your instance that is used internally for asymmetric encryption purposes.The IAEK is used to transmit confidential messages between an instance during Key Exchange or Instance Data Replication consumer approval.\n\n
\n\nInstance Signature Key \\(ISK\\)\n\n\n\nInstance\n\n\n\nA key unique to your instance that is used internally for signing purposes.\n\n
\n\nPassword2 \\(PW2\\)\n\n\n\nInstance\n\n\n\nWith KMF, the key for PW2 fields is fully managed by KMF.\n\n
\n\nCustomer Data Encryption Key \\(CDEK\\)\n\n\n\nInstance\n\n\n\nEncryption keys created through KMF are envelope-encrypted by the IKEK.\n\n
\n\nInstance Data Replication \\(IDR\\) Data Encryption Key \\(DEK\\)\n\n\n\nInstance\n\n\n\nSpecific encryption keys used for the IDR process.\n\n
**Parent Topic:**[Exploring the Key Management Framework](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/platform-encryption/explore-kmf.md)\n\n"}}