English 
Tiếng ViệtClassify keys and assurance target
HSM/QSCD/SAM architecture and integration
HSM · KEY PROTECTION PRODUCT / SOLUTION PROFILE
Trusted PQC HSM / QSCD Integration
Available
Design and integrate protected key custody for CA, TSA, remote signing, code signing and enterprise services.
CUSTOMER PROBLEM
Design and integrate protected key custody for CA, TSA, remote signing, code signing and enterprise services.
CA, TSA, remote signing and code-signing keys need high-assurance custody, quorum, recovery and operational evidence—not only an algorithm library.
Available
- Portfolio class
- Key protection product / solution profile
- Public profile
- 2026.07
- Version rule
- Confirmed in quotation / release record
PRODUCT-SPECIFIC IMPLEMENTATION FLOW
How Trusted PQC HSM / QSCD Integration operates from input to evidence.
HSM, QSCD, SAM, PKCS#11, remote-signing services and approved operational procedures. Architecture, ceremony records, configuration baseline, recovery tests and operational runbooks.
Design security and tenancy domains
M-of-N, dual control and key ceremony
Provision keys under ceremony
PKCS#11 and remote-signing interfaces
Expose approved service interfaces
HA/DR, backup and recovery testing
Operate HA, backup and monitoring
Tenant and service-key separation
Rehearse recovery and destruction
Audit, monitoring and operational runbooks
NAMED COMPONENTS AND RESPONSIBILITIES
What Trusted PQC HSM / QSCD Integration contains and what each component does.
The descriptions below state concrete technical behaviour rather than generic support language.
HSM/QSCD/SAM architecture and integration
Defines HSM, QSCD and SAM roles for CA, TSA, remote signing, code signing and application keys without collapsing different assurance targets into one boundary.
M-of-N, dual control and key ceremony
Implements M-of-N authorization, dual control, witnessed key ceremonies and separation of duties for creation, activation, backup and destruction.
PKCS#11 and remote-signing interfaces
Publishes only the PKCS#11, remote-signing or vendor interfaces required by each service and disables unused mechanisms and administrative paths.
HA/DR, backup and recovery testing
Designs clustering, backup, restore and disaster recovery around key non-exportability, quorum requirements and documented recovery-time objectives.
Tenant and service-key separation
Separates tenants, services and key purposes using partitions, labels, policy objects and role assignments that can be independently audited.
Audit, monitoring and operational runbooks
Provides monitored operational procedures for alarms, capacity, firmware change, backup verification, incident response and evidence retention.
- High-assurance key custody
- Quorum and ceremony controls
- HA/DR and lifecycle architecture
HSM, QSCD, SAM, PKCS#11, remote-signing services and approved operational procedures.
Customer security boundary
HSM, QSCD, token or KMS components remain in the customer-controlled environment with documented ceremonies.
Dedicated high-availability service
Protected key services run across approved HA/DR nodes with tested quorum, backup and recovery.
Integrated managed operation
Operational responsibility is divided explicitly across customer, Mobile-ID and hardware/technology partners.
- Architecture, ceremony records, configuration baseline, recovery tests and operational runbooks.
- Version and configuration manifest for: HSM, QSCD, SAM, PKCS#11, remote-signing services and approved operational procedures.
- Negative, failure and recovery tests for “Operate HA, backup and monitoring” and “Rehearse recovery and destruction”.
- Signed acceptance record, accountable owner, published limitations and next review date.
STANDARDS & PROFILES
- FIPS 140-3 / Common Criteria as applicable
- ETSI QSCD concepts
- PKCS#11
- CSC / remote-signing integration where applicable
PRODUCT-SPECIFIC BOUNDARIES
Conditions that must remain true for Trusted PQC HSM / QSCD Integration.
These points come from the product profile, not from a shared disclaimer.
NEXT STEP
Request a product workshop: Trusted PQC HSM / QSCD Integration
Review the exact operating model, interfaces and evidence needed for deployment.