Overview of GPCA in OnBoard™ IoT Security

The GP CA (GlobalPlatform Certificate Authority) in OBIS (OnBoard IoT Security) is a dedicated certificate service for GlobalPlatform SCP11c, responsible for certificate issuance, management, and private key operations. It is mainly used for:

• Managing CA, Key Authority (KA), OCE (Off-Card Entity) 和 SD (Security Domain) certificates and their trust chains.
• Providing OCE private key operation services, ensuring that private keys never leave the GP CA.
• Providing authorization for certificate signing and encrypted key export to the EdgeHSM.

The GP CA operates independently of SE Profile configuration management, supporting collaboration across teams and organizations. The following table summarizes the core capabilities of the GP CA:

Capability	Description
GP PKI Hierarchy Management	Manage CA-KLCC and CA-KLOC root CAs Manage subordinate KA, OCE, and SD certificates Maintain certificate trust chains
Certificate Lifecycle Management	Support certificate issuance and status management Support notifications for certificate status changes Specific operations depend on object type and key source
Private Key Operation and Authorization	Perform ECDH operations using OCE private keys; private keys do not leave the GP CA Authorize certificate signing and encrypted key export for EdgeHSM Supports usage count and validity period limits
Collaboration and Permission Control	Support object-level collaborator management Assign permissions such as View, Use, Create Authorization, and Manage Status as needed
External CA Support	Support import of external root CAs and KAs Support offline issuance
SD Certificate Archiving	Centrally archive Mode A and Mode B SD certificates Support queries by certificate serial