Marvell Technology, Microsoft and Oracle have formed a new working group under the Open Compute Project to standardize a piece of security hardware that has traditionally lived outside the server. The group, organized under the OCP Security Track, will define open specifications for an integrated hardware security module designed for cloud and hyperscale data centers.
Today, most cloud and enterprise servers depend on network-attached hardware security modules or on software-only key management. That design forces cryptographic keys to travel across a network or to sit in memory that does not meet a high assurance standard, creating exposure that operators have long had to work around. Moving the function into the server itself is meant to close that gap.
Under the proposal, a hardware security boundary, a key vault and an attestation chain would be embedded directly in the server. Cryptographic operations would then run where the workload runs, keys would remain inside a certified hardware boundary, and the integrity of a workload could be proven to another party. The companies say secure key caching and lifecycle management at the server level should reduce latency, improve scalability and strengthen the security posture of cloud workloads.
The target is a NIST FIPS 140-3 Level 3 integrated module. That level matters for regulated workloads and for zero-trust designs, where identity and integrity need to be rooted in hardware rather than assumed from the surrounding network. Executives from the three companies framed the effort in those terms, linking it to compliance, interoperability and the longer transition toward post-quantum cryptography, which will place fresh demands on how keys are created, stored and rotated.
An initial draft of the technical specification is targeted for release around the 2026 OCP Global Summit, held October 12 to 15 at the San Jose Convention Center in San Jose, California, with a version 1.0 specification to follow. The founding members plan to demonstrate the technology during the summit's Security Track sessions and in their exhibits, and they are inviting other organizations to join the working group through OCP.
For enterprise IT teams, the significance is less about a single product than about standardization. If an integrated HSM becomes a common, open specification rather than a proprietary add-on, server makers and cloud operators could build to the same interface, and buyers could compare implementations more easily. That would also give operators a clearer path to planting the root of trust inside every server, rather than consolidating it in a separate appliance that becomes both a bottleneck and a high-value target.