Overview of KMS in OnBoard™ IoT Security

KMS (Key Management Service) in OBIS (OnBoard™ IoT Security) is the core module responsible for key security, which provides secure management and access control of keys. It supports creating, importing, integrating, and managing various types of keys, and leverages HSM (Hardware Security Module) to ensure high-security key generation, storage, and usage.

• Supports both symmetric and asymmetric keys, as well as various key algorithms.
• Supports constraining key usage, environment, validity period, and access permissions.
• Supports creating, importing, and integrating keys by using multiple key sources.
• Supports the use of KMS in multiple scenarios:
  • Resource encryption and decryption
  • Firmware signing and verification
  • Secure boot
  • Secure debug
  • HMAC (Hash-based message authentication code) authentication

The following table summarizes the core capabilities of KMS:

Capability	Description
Key Lifecycle Management	Symmetric and asymmetric key lifecycle management
Key State & Storage	Key state management (Active, Suspended, Revoked) Hardware-backed secure storage and cryptographic execution
Enterprise BYOK (Key Import)	OEM generates and imports keys into HSM KMS governs usage via authorization policies
Cloud-Native BYOK (External KMS)	Keys remain in customer's cloud KMS (e.g., AWS KMS) KMS invokes operations through secure authenticated APIs

KMS does not mandate where keys must live. It mandates how cryptographic capabilities are governed, constrained, and audited.