KMS and HSM services manage server keys. They do not automatically place every phone-held secret inside the same boundary.
Evaluation approach
Move suitable signing and decryption to protected services, while limiting which operations a client can request.
Application example
A mobile app can request permitted actions through its API without carrying long-lived cloud-administration credentials.
Limits and considerations
Hardware protection cannot prevent business abuse if the service signs for unauthorized users.
Protecting the key-use API
Authorize each signing or decryption request. Hardware may protect the key while an incorrectly authorized service misuses it. Record purpose, scope and audit context.
Checks and decisions
- Narrow server privileges
- Avoid embedded administrative secrets
- Monitor use
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.