标题： 重新思考云中的HSM和TPM安全性：现实世界攻击与下一代防御 显示英文标题

标题： Rethinking HSM and TPM Security in the Cloud: Real-World Attacks and Next-Gen Defenses

摘要： 随着组织迅速迁移到云端，加密密钥管理的安全性已成为日益关注的问题。 硬件安全模块（HSMs）和可信平台模块（TPMs），传统上被视为保护加密密钥和数字信任的黄金标准，正日益受到云原生威胁的挑战。 现实中的泄露事件暴露了云部署中的弱点，包括配置错误、API滥用和权限提升，使攻击者能够访问敏感的密钥材料并绕过保护措施。 这些事件表明，尽管硬件本身是安全的，但周围的云生态系统引入了系统性漏洞。 本文分析了涉及HSMs和TPMs的显著安全故障，识别了常见的攻击向量，并质疑了它们在分布式环境中的有效性的长期假设。 我们探讨了机密计算、后量子密码学和去中心化密钥管理等替代方法。 我们的研究结果表明，尽管HSMs和TPMs仍然发挥作用，但现代云安全需要更具适应性和分层的架构。 通过评估当前的弱点和新兴模型，这项研究为云架构师和安全工程师提供了策略，以在不断变化的威胁环境中加强加密信任。 显示英文摘要

摘要： As organizations rapidly migrate to the cloud, the security of cryptographic key management has become a growing concern. Hardware Security Modules (HSMs) and Trusted Platform Modules (TPMs), traditionally seen as the gold standard for securing encryption keys and digital trust, are increasingly challenged by cloud-native threats. Real-world breaches have exposed weaknesses in cloud deployments, including misconfigurations, API abuse, and privilege escalations, allowing attackers to access sensitive key material and bypass protections. These incidents reveal that while the hardware remains secure, the surrounding cloud ecosystem introduces systemic vulnerabilities. This paper analyzes notable security failures involving HSMs and TPMs, identifies common attack vectors, and questions longstanding assumptions about their effectiveness in distributed environments. We explore alternative approaches such as confidential computing, post-quantum cryptography, and decentralized key management. Our findings highlight that while HSMs and TPMs still play a role, modern cloud security requires more adaptive, layered architectures. By evaluating both current weaknesses and emerging models, this research equips cloud architects and security engineers with strategies to reinforce cryptographic trust in the evolving threat landscape.