An HSM is the server-side counterpart of a device’s secure element. Keys are created inside it and never leave; applications send data to be signed or decrypted and receive the result. Physical tamper detection erases the keys if the enclosure is opened. Cloud providers offer HSM-backed key services for teams that do not want to run the appliance themselves.
In an IoT program the HSM typically holds the certificate authority keys of the PKI and the firmware signing keys that secure boot relies on. A compromise of either would let an attacker mint device identities or push malicious updates to the whole fleet, which is why those keys deserve stronger protection than the rest of the backend. Manufacturing lines also use HSMs to inject per-device keys at scale.
Part of the IoT Glossary. Spotted an error or a missing term? Tell us.