How to create a key in OnBoard™ IoT Security

This article will guide you on how to create a symmetric and asymmetric key in OnBoard™ IoT Security (OBIS).

Prerequisites

Before getting started, please ensure that you have OBIS role permissions as a System Manager or Resource Manager.

Instructions

tip

After a key is created, it can be selected when configuring Keys for a product.

1. Sign in to OBIS.

2. In the Core section of the left menu, click KMS, and then click Create on the KMS page.

   

Step one: Configure the basic information

In the Basic Info section, select and enter the key basic information.

Description of key basic information:

Information	Mandatory	Description
Key Name	Yes	The key name must be unique in the same environment.
Environment	Yes	Two environments can be selected: PROD and TEST.
Key Type	Yes	Two key types can be selected: Symmetric and Asymmetric.
Key Spec	Yes	Select encryption algorithms for symmetric and asymmetric keys: Symmetric key: AES-128, AES-192, or AES-256 Asymmetric key: RSA-2048, RSA-3072, RSA-4096, ECC-P256, ECC-P384, ECC-P521, or ECC-P256K
Key Usage	Yes	Limit the operations the key is allowed to perform (multiple selections allowed): Sign/Verify: Allows the use of an asymmetric key to generate or verify digital signatures. Encrypt/Decrypt: Allow the use of a symmetric or asymmetric key to encrypt or decrypt data. Generate and Verify HMAC: Allows the use of a symmetric key to generate and verify message authentication codes to ensure data integrity. Key Agreement: Used in key exchange protocols (such as ECDH) for the secure exchange of encryption keys. Note: For asymmetric keys, once Key Agreement is selected, the Import Public Key option in the Key Source area will be unavailable.

Step two: Configure the key source

Symmetric key

Generated by System

tip

The system securely generates a random key pair inside a Hardware Security Module (HSM).

In the Key Source Setting section, select Generated by System.

BYOK Account Role

tip

Connect to AWS KMS using IAM Role-based access—secure and ideal for cloud-native deployments.

In the Key Source Setting section, select BYOK Account Role, and then enter the key-related information.

Description of Account Role information:

Information	Mandatory	Description
User RN	No	Uniquely identifies a user in AWS IAM (such as an administrator or developer), used for permission assignment and resource access control.
Role RN	Yes	Uniquely identifies a role in AWS IAM, used for temporary permission assignment (such as cross-account access for EC2 instances or Lambda functions).
Key RN	Yes	Uniquely identifies an encryption key in AWS KMS, used for data encryption and decryption.

BYOK AK/SK

tip

Access external keys from third-party KMS using Access Key and Secret Key credentials.

In the Key Source Setting section, select BYOK AK/SK, and then enter the key-related information.

Description of AK/SK information:

Information	Mandatory	Description
AK	Yes	AK (Access Key ID): Identity identifier: Uniquely identifies a user in AWS IAM (Identity and Access Management), similar to a username. Public attribute: Can be safely shared (for example, configured in code or the CLI), but must be used together with the SK to complete authentication.
SK	Yes	SK (Secret Access Key): Confidential credential: Used to generate request signatures and verify identity, similar to a password. Strict confidentiality: Disclosure may result in full account compromise and should be protected with the same care as a password.
Key RN	Yes	ARN (Amazon Resource Name): uniquely identifies an encryption key in AWS KMS, used for data encryption and decryption.

Import Key

tip

Manually upload an existing symmetric key generated outside the system.

In the Key Source Setting section, select Import Key. Select the encryption method and key algorithm. Description of Import Key information:

Description of Import Key information:

Information	Mandatory	Description
Select Encrypt	Yes	Select the encryption algorithm. Currently, only RSA_2048 is supported, which provides a baseline level of security and is suitable for scenarios such as key encryption and digital signatures.
Key Algorithm	Yes	Select the key algorithm: RSA_AES_KEY_WRAP_SHA_1 RSA_AES_KEY_WRAP_SHA_256

tip

When the key source is Import Key, you need to complete the key encryption configuration after creating the key. Before the key encryption configuration is completed, the key will remain in the Pending status and can't be used.

Key encryption configuration

tip

When the key source is Import Key, refer to the following steps to complete the key encryption.

1. On the KMS page, select the corresponding key.

2. Locate the Download Encryption Key Package section on the key page, and then click Download to download the encryption key file.

   

3. Import the downloaded encryption key into your HSM and use it to encrypt the symmetric key.

4. After the symmetric key is encrypted, select and upload the encrypted key file in .json format in the Upload Encrypted Key section.

5. Click Submit to complete the key encryption configuration, and the key status will change to Active.

Asymmetric key

Generated by System

tip

The system securely generates a random key pair inside a Hardware Security Module (HSM).

In the Key Source Setting section, select Generated by System.

Import Key Pair

tip

Manually upload an existing asymmetric key pair generated outside the system.

In the Key Source Setting section, select Import Key Pair. Then, select the encryption method and key algorithm.

Description of Import Key Pair information:

Information	Mandatory	Description
Select Encrypt	Yes	Select the encryption algorithm. Currently, only RSA_2048 is supported, which provides basic security strength and is suitable for scenarios such as key encryption and digital signatures.
Key Algorithm	Yes	Select the key algorithm: RSA_AES_KEY_WRAP_SHA_1 RSA_AES_KEY_WRAP_SHA_256

tip

When the key source is Import Key Pair, you need to complete the key encryption configuration after creating the key. Before the key encryption configuration is completed, the key will remain in the Pending status and can't be used.

Key encryption configuration

tip

When the key source is Import Key Pair, refer to the following steps to complete the key encryption.

1. On the KMS page, select the corresponding key.

2. Locate the Download Encryption Key Package section on the key page, and then click Download to download the encryption key file.

   

3. Import the downloaded encryption key into your HSM and use it to encrypt the symmetric key.

4. After the symmetric key is encrypted, select and upload the encrypted key file in .json format in the Upload Encrypted Key section.

5. Click Submit to complete the key encryption configuration, and the key status will change to Active.

BYOK Account Role

tip

Connect to AWS KMS using IAM Role-based access—secure and ideal for cloud-native deployments.

In the Key Source Setting section, select BYOK Account Role, and then enter the key-related information.

Description of Account Role information:

Information	Mandatory	Description
User RN	No	Uniquely identifies a user in AWS IAM (such as an administrator or developer), used for permission assignment and resource access control.
Role RN	Yes	Uniquely identifies a role in AWS IAM, used for temporary permission assignment (such as cross-account access for EC2 instances or Lambda functions).
Key RN	Yes	Uniquely identifies an encryption key in AWS KMS, used for data encryption and decryption.

BYOK AK/SK

tip

Access external keys from third-party KMS using Access Key and Secret Key credentials.

In the Key Source Setting section, select BYOK AK/SK, and then enter the key-related information.

Description of AK/SK information:

Information	Mandatory	Description
AK	Yes	AK (Access Key ID): Identity identifier: Uniquely identifies a user in AWS IAM (Identity and Access Management), similar to a username. Public attribute: Can be safely shared (for example, configured in code or the CLI), but must be used together with the SK to complete authentication.
SK	Yes	SK (Secret Access Key): Confidential credential: Used to generate request signatures and verify identity, similar to a password. Strict confidentiality: Disclosure may result in full account compromise and should be protected with the same care as a password.
Key RN	Yes	ARN (Amazon Resource Name): uniquely identifies an encryption key in AWS KMS, used for data encryption and decryption.

Import Public Key

tip

Import only a public key for verifying signatures or device identities—no private key required.

In the Key Source Setting section, select Import Public Key. In the Public Key section, upload a public key file in .pem format.

Step three: Configure the validity

In the Validity Setting section, you can choose Duration, Specific Date, or Never Expires to set the validity period as needed.

Step four: Add the notes

In the Notes section, you can provide additional information related to the key, such as special requirements and important notes.

Step five: Complete the creation

After verifying that the configuration is correct, click Create. Once the key is successfully created, it can be checked on the KMS page.

tip

By default, the key creator is set as the Admin. To change the Admin, click the Options icon for the Admin and select Transfer Admin on the Member tab, then choose the new Admin and click Confirm.