The push to move cryptographic security from centralized network appliances directly into the server chassis is gaining significant momentum through a new industry alliance. Marvell Technology, Microsoft, and Oracle have established a new working group within the Open Compute Project (OCP) to standardize a silicon-based, integrated Hardware Security Module (HSM) for hyperscale and cloud data center infrastructure. This collaborative effort aims to define open specifications for an integrated HSM that meets NIST FIPS 140-3 Level 3 standards. By embedding a hardware security boundary and attestation chain directly into the server, the group intends to address current vulnerabilities where cryptographic keys must traverse networks or reside in unprotected memory, potentially exposing sensitive data to sophisticated attacks.
Standardizing NIST FIPS 140-3 Level 3 Security
The newly formed OCP working group, operating under the OCP Security Track, is tasked with defining open specifications for secure key caching and cryptographic key lifecycle management at the server level. Currently, many cloud and enterprise environments rely on network-attached HSMs or software-only management solutions. These legacy architectures often require cryptographic keys to move across the network, which can introduce latency and increase the attack surface. The proposed integrated approach seeks to ensure that cryptographic operations execute in the same location where data is processed.
By embedding a key vault and an attestation chain directly into the server hardware, the working group aims to ensure that keys never leave a certified hardware boundary. This architecture is designed to allow workload integrity to be proven cryptographically to any relying party. Marvell’s Cary Ussery, senior vice president and general manager of the Multimarket Business Group, noted that this integration is intended to satisfy both regulatory compliance and zero-trust architecture requirements without sacrificing performance. The initiative is positioned to provide a common foundation that allows for higher scalability and a strengthened security posture for cloud compute workloads across the broader industry.
Roadmap for Open Hardware Security Specifications
The development of these integrated security capabilities is structured around a multi-year release cycle aimed at driving widespread industry adoption. Marvell, Microsoft, and Oracle are serving as the founding members of this working group, intending to collaborate with the wider OCP community to publish a joint technical specification. The group has set a target to release an initial draft of the technical specification around the OCP Global Summit in October 2026. Following this initial draft, the group plans to release version 1.0 of the specification.
This timeline suggests a long-term commitment to reshaping how data center hardware handles sensitive credentials. Microsoft Azure CTO Mark Russinovich highlighted that the initiative is intended to advance interoperability and accelerate the adoption of post-quantum cryptography as quantum technology begins to reshape the cryptographic landscape. The companies plan to showcase the emerging technology through presentations and exhibits during the OCP Global Summit, held from October 12-15 at the San Jose Convention Center. This roadmap provides a clear signal to the enterprise market that the transition from network-centric to server-centric hardware security is a primary strategic objective for the world's largest cloud providers and semiconductor leaders.
Key Takeaways
- Marvell, Microsoft, and Oracle have formed an OCP working group to standardize integrated, silicon-based HSMs that meet NIST FIPS 140-3 Level 3 standards.
- The initiative aims to move cryptographic key management from network-attached appliances directly to the server level to reduce latency and improve scalability.
- An initial draft of the open technical specification is targeted for release at the OCP Global Summit in October 2026.
TechInsyte's Take
In our view, this move by Marvell, Microsoft, and Oracle represents a decisive shift toward hardware-rooted zero-trust architectures in the hyperscale era. By moving the hardware security boundary from a centralized network appliance to the individual server, these companies are addressing the fundamental tension between high-performance compute requirements and the stringent security demands of modern regulatory frameworks. This transition is particularly significant as the industry prepares for the complexities of post-quantum cryptography. If successful, this standardization could effectively commoditize high-assurance security at the silicon level, making NIST FIPS 140-3 Level 3 protection a baseline expectation for cloud workloads rather than a premium, high-latency add-on. This signals that the next frontier of data center resilience is not just about software-defined security, but about deeply integrating cryptographic integrity into the very fabric of the server hardware itself.
Questions & Answers
How does the proposed integrated HSM improve upon current cloud security models?
Current models often rely on network-attached HSMs or software-only management, which requires keys to traverse the network or reside in non-FIPS 140-3 Level 3 memory. The new integrated approach embeds the hardware security boundary, key vault, and attestation chain directly into the server, ensuring keys never leave a certified boundary and operations occur where data is processed.
What specific security standard is the new OCP working group targeting?
The working group is specifically aiming to standardize a hardware security module (HSM) that meets the NIST FIPS 140-3 Level 3 standard for cloud and hyperscale data center infrastructure.
What is the expected timeline for the release of these new hardware security specifications?
The group intends to release an initial draft of the technical specification around the OCP Global Summit in October 2026, with a version 1.0 to follow.
Why is this shift toward server-level security considered critical for the future of cryptography?
As noted by Microsoft, the rise of AI and the emergence of quantum technology necessitate more robust protection for the keys and credentials at the heart of digital infrastructure. This integrated approach aims to accelerate the adoption of post-quantum cryptography and improve interoperability across the industry.
Source: Marvell
