Marvell Technology, Inc., Microsoft Corporation and Oracle have formed an Open Compute Project (OCP) working group to standardize integrated hardware security for cloud and hyperscale data centers. The effort aims to define a NIST FIPS 140-3 Level 3 integrated hardware security module (HSM).
Most cloud and enterprise servers today rely on network-attached HSMs or software-only key management. The approach can require cryptographic keys to traverse the network or reside in unprotected memory that is not FIPS 140-3 Level 3, exposing them to potential security attacks.
The working group will define an open specification for secure key caching and cryptographic key lifecycle management at the server level. It will cover embedding a hardware security boundary, key vault and attestation chain directly into the server, so cryptographic operations execute where data is processed, keys remain within a certified hardware boundary, and workload integrity can be proven cryptographically to any relying party.
Cary Ussery, senior vice president and general manager, Multimarket Business Group, at Marvell, said: “An integrated HSM will allow cryptographic key operations to execute where the workload runs, satisfying both regulatory compliance and zero-trust architecture requirements, all without compromising higher performance for security. By defining this as an open specification, we’ll make that capability available to the entire industry.”
Marvell, Microsoft and Oracle will work with the broader OCP community to publish a joint technical specification. An initial draft is targeted for release around the 2026 OCP Global Summit, with version 1.0 to follow. The companies plan to demonstrate the technology in their exhibit booths and during Security Track presentations at the summit, October 12-15, at the San Jose Convention Center in San Jose, California.
