Based on the joint press release from Marvell, Microsoft and Oracle, 13 October 2026.
Chipmaker Marvell, Microsoft and Oracle have set up a new working group in the Open Compute Project (OCP) to write an open standard for a hardware security module built directly into data-centre servers [1].
The Open Compute Project is an industry group that shares open designs for data-centre hardware. The new group sits in its Security Track [1].
What is an HSM?
A hardware security module (HSM) is a dedicated, tamper-resistant piece of hardware that stores cryptographic keys and does the maths that uses them. The keys are the secrets that lock and unlock encrypted data and prove identities. The point of an HSM is that the keys never leave it in readable form.
What does FIPS 140-3 Level 3 mean?
FIPS 140-3 is a US government standard, run by NIST, for testing and certifying cryptographic modules. It has four levels. Level 3 adds strong physical protection: the module must resist and respond to tampering, for example by wiping keys if someone tries to break in, and it requires identity-based checks on who can use it. The three companies are aiming for a Level 3 design [1].
What is wrong with today’s setup?
According to the release, most cloud and enterprise servers today use HSMs that sit elsewhere on the network, or manage keys in software only. That means keys have to travel across the network or sit in memory that is not protected to FIPS 140-3 Level 3, “exposing sensitive keys to potential security attacks” [1].
What the group will do
The working group will write an open specification for building “a hardware security boundary, key vault and attestation chain directly into the server” [1]. (“Attestation” means a server can prove cryptographically what software it is running.)
The companies say this means [1]:
- cryptographic work happens where the data is processed;
- keys “never leave a certified hardware boundary”;
- a workload’s integrity “can be proven cryptographically to any relying party”.
They say it will cut delays, scale better and improve security for cloud workloads [1].
Timing
An initial draft is “targeted for release around the 2026 OCP Global Summit”, with version 1.0 later. The Summit runs from 12 to 15 October at the San Jose Convention Center in California, where the companies plan demonstrations and talks. Other organisations can join through the OCP [1].
What they said
“An integrated HSM will allow cryptographic key operations to execute where the workload runs, satisfying both regulatory compliance and zero-trust architecture requirements,” said Cary Ussery, senior vice president and general manager of Marvell’s Multimarket Business Group [1].
“As AI transforms cybersecurity and quantum technology reshapes cryptography, protecting the keys and credentials at the heart of our digital infrastructure has never been more important,” said Mark Russinovich, CTO, deputy CISO and technical fellow, Microsoft Azure. He said the effort would help “accelerate the adoption of post-quantum cryptography” [1].
“This effort aims to establish a common foundation for adoption across the industry,” said Pradeep Vincent, executive vice president, Compute and AI Infrastructure at Oracle [1].
What this means
- Keys stay in the box. The aim is that encryption keys no longer cross the network to a separate HSM.
- An open standard, not one company’s product. Any hardware maker could build to it once published.
- It is early. Only a first draft is expected now; version 1.0 has no date.
Sources
- Marvell Technology, “Marvell, Microsoft and Oracle Establish OCP Working Group to Standardize Data Center Hardware Security”, 13 October 2026. https://investor.marvell.com/news-events/press-releases/detail/1038/marvell-microsoft-and-oracle-establish-ocp-working-group-to-standardize-data-center-hardware-security
