Overview of SEMS in OnBoard™ IoT Security

The SEMS (Secure Element Management System) in OBIS (OnBoard IoT Security) is responsible for managing SE (Secure Element) profile configurations. It defines the factory state, target provisioning configuration, and secure communication parameters of the secure element for provisioning on the production line. It is mainly used for:

• Creating and managing SE Profiles for use within product workspaces.
• Integrating KMS (Key Management System) keys and GP CA certificates to configure SCP03 and SCP11c secure channels.
• Encapsulating external GP scripts using the SCP11c protocol, resulting in secure scripts that can be executed offline.

The following table summarizes the core capabilities of the SEMS:

Capability	Description
SE Profile Management	Manage the creation, configuration, and lifecycle of SE Profiles Configure elements such as ISD, AMSD, SSD, CAP, and Instances Support freezing profiles after activation and deleting drafts.
Secure Channel Configuration	Reference SCP03 keys via KMS without storing plaintext keys Reference GP CA certificates to configure SCP11c secure channels
SCP11c Script Encapsulation	Receive external GP scripts and invoke the OCE (Off-Card Entity) private key service of the GP CA to complete secure encapsulation Output secure scripts for offline execution without exposing the underlying GP command content
Collaboration and Permission Management	Manage collaborators for SE Profiles and their associated object permissions
Production Integration	Provide SE Profile definitions to the product workspace Provide interfaces for configuration, status, and production authorization
Security State Synchronization	Lock or revoke the relevant profiles based on the status of upstream certificates or keys Automatically restore profiles to the Active state once all locking conditions are cleared

The SEMS manages the design-time configuration of SEs; It is not responsible for real-time management on the device side.