English 
Tiếng ViệtRegister application and key purpose
Key generation, import and wrapping policy
KMS · KEY PROTECTION PRODUCT / SOLUTION PROFILE
QuantumSafe Key Management
Solution architecture
Coordinate key generation, wrapping, rotation, versioning, tenant isolation and policy enforcement.
CUSTOMER PROBLEM
Coordinate key generation, wrapping, rotation, versioning, tenant isolation and policy enforcement.
Hybrid and PQC deployments increase key versions, policies and dependencies. Without centralized governance, rotation, recovery and tenant isolation become inconsistent.
Solution architecture
- Portfolio class
- Key protection product / solution profile
- Public profile
- 2026.07
- Version rule
- Confirmed in quotation / release record
PRODUCT-SPECIFIC IMPLEMENTATION FLOW
How QuantumSafe Key Management operates from input to evidence.
On-premises or private-cloud KMS, HSM, applications and approval workflows. Key policy, access model, lifecycle logs, recovery tests and tenant-isolation validation.
Authorize generation or import
Key versioning, rotation and retirement
Create key inside approved boundary
HSM-backed envelope encryption
Issue wrapped key or service handle
Tenant isolation and delegated administration
Rotate without breaking consumers
API, PKCS#11 and application connectors
Recover, retire and destroy
Recovery, escrow and exception governance
NAMED COMPONENTS AND RESPONSIBILITIES
What QuantumSafe Key Management contains and what each component does.
The descriptions below state concrete technical behaviour rather than generic support language.
Key generation, import and wrapping policy
Applies separate rules for generated, imported and derived keys, including allowed algorithms, exportability, origin evidence and wrapping hierarchy.
Key versioning, rotation and retirement
Maintains stable key aliases and immutable key versions so applications can rotate encrypting or signing keys without losing historical verification.
HSM-backed envelope encryption
Uses HSM-backed master keys to wrap data-encryption keys and records the wrapping key, version, policy and affected data set for each envelope.
Tenant isolation and delegated administration
Enforces tenant, environment and application separation through distinct namespaces, roles, quotas and approval scopes.
API, PKCS#11 and application connectors
Provides REST, PKCS#11 or application connectors with authenticated requests, idempotency, audit correlation and least-privilege service accounts.
Recovery, escrow and exception governance
Defines tested recovery, escrow, compromise, revocation and exception procedures, including when key recovery is prohibited by policy.
- Centralized key policy
- Rotation and version control
- HSM-backed API integration
On-premises or private-cloud KMS, HSM, applications and approval workflows.
Customer security boundary
HSM, QSCD, token or KMS components remain in the customer-controlled environment with documented ceremonies.
Dedicated high-availability service
Protected key services run across approved HA/DR nodes with tested quorum, backup and recovery.
Integrated managed operation
Operational responsibility is divided explicitly across customer, Mobile-ID and hardware/technology partners.
- Key policy, access model, lifecycle logs, recovery tests and tenant-isolation validation.
- Version and configuration manifest for: On-premises or private-cloud KMS, HSM, applications and approval workflows.
- Negative, failure and recovery tests for “Rotate without breaking consumers” and “Recover, retire and destroy”.
- Signed acceptance record, accountable owner, published limitations and next review date.
STANDARDS & PROFILES
- NIST key-management guidance
- PKCS#11
- KMIP concepts
- Envelope encryption patterns
PRODUCT-SPECIFIC BOUNDARIES
Conditions that must remain true for QuantumSafe Key Management.
These points come from the product profile, not from a shared disclaimer.
NEXT STEP
Review the solution architecture: QuantumSafe Key Management
Confirm trust boundaries, interfaces, threat model and productization path.