Configuring Edge Encryption

After the Edge Encryption proxy server is installed and running, manage Edge Encryption through the proxy server.

You must complete all the steps in Installing Edge Encryption before creating encryption configurations and encryption patterns on the instance.

Note: To access the Edge Encryption configuration, you must log in through the proxy server and elevate to the security_admin role.

• Rotate encryption keys
  Perform encryption key rotation from the instance. Add a new key, change the default key assignment, and then schedule a mass key rotation or a single key rotation.
• Encrypt fields using encryption configurations
  Encrypt fields by creating encryption configurations.
• Encrypt attachments using standard encryption
  You can encrypt attachments for specific tables.
• Change a field or attachment's encryption type
  You can change a field or attachment's encryption type by selecting a new encryption type in the existing encryption configuration record. A specific table and field combination can only have one active configuration at a time.
• Tokenize strings using encryption patterns
  You can replace string patterns with tokens before they are sent to and stored in the instance.
• Repair or recover order-preserving encrypted data
  If you have the security-admin role, you can schedule jobs performed by the Edge Encryption proxy to repair or recover fields that use order preserving encryption.
• Configure the IP address deny list
  Prevent an IP address in your network from sending requests to your instance
• Encrypt data from a record producer
  Configure your Edge Encryption proxy server to allow inserts from a record producer by creating encryption rules from the record producer record.
• Define a custom encryption rule
  It may be necessary to identify and encrypt sensitive information in HTTP requests on the way to your instance. You can write encryption rules to identify, interpret, and encrypt data in such requests, mapping fields in the request to table-field names on your instance.
• Edge Encryption dictionary attributes
  Add dictionary attributes to tables and fields to control how they work with Edge Encryption.
• Domain separation and Edge Encryption
  Domain separation is supported in limited circumstances with Edge Encryption. Edge Encryption provides the ability to encrypt data from within the customer's environment through the use of specific configurations, rules, and keys defined on the Edge Encryption proxy. The Edge Encryption proxy is not domain aware and cannot support domain-specific settings. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.
• Data integration with Edge Encryption
  To integrate third-party data with an instance using Edge Encryption, you must route the data through the Edge Encryption proxy server using supported integrations. Supported integrations use base system encryption rules that map data in each payload to fields in a table.
• Edge Encryption diagnostics and performance
  Monitor Edge Encryption proxy server performance trends and drill into errors generated by the Edge Encryption proxy server.
• Increase debug logging for the Edge Encryption proxy
  Increase the level of logging to interpret the logs and debug issues with the proxy.

Parent Topic:Edge Encryption