Marvell, Microsoft and Oracle Form Open Compute Group to Put Key Vaults Inside Servers

Marvell Technology, Microsoft and Oracle have formed a working group within the Open Compute Project to standardize a hardware security module that sits inside the server itself, the companies said Oct. 13.

The group, set up under OCP's Security Track, aims to define open specifications for an integrated module certified to NIST FIPS 140-3 Level 3, the federal standard for cryptographic hardware. Its charter covers secure key caching and the full life cycle of cryptographic keys, handled at the server level rather than across the network.

The companies said that most cloud and enterprise servers today rely on network-attached hardware security modules or on software-only key management. In either case keys must travel over the network or sit in memory that is not protected to the Level 3 standard, which exposes them to attack.

The proposed design embeds a hardware security boundary, a key vault and an attestation chain directly in the server. The aim is for cryptographic operations to run where data is processed, for keys never to leave a certified hardware boundary and for the integrity of a workload to be proven cryptographically to any party that relies on it. The companies said the approach would also reduce latency and improve scalability.

"An integrated HSM will allow cryptographic key operations to execute where the workload runs, satisfying both regulatory compliance and zero-trust architecture requirements, all without compromising higher performance for security," said Cary Ussery, senior vice president and general manager of Marvell's Multimarket Business Group.

Microsoft framed the effort around coming changes in cryptography. Mark Russinovich, chief technology officer, deputy chief information security officer and technical fellow for Microsoft Azure, said the companies are coming together "around a fully open-source integrated HSM" to advance interoperability and accelerate the adoption of post-quantum cryptography.

Pradeep Vincent, executive vice president for compute and AI infrastructure at Oracle, said an open specification is "an important step toward enabling cryptographic operations where data is processed."

As founding members, the three companies plan to publish a joint technical specification with the wider OCP community, with an initial draft targeted for release around this week's OCP Global Summit in San Jose and a version 1.0 to follow. They said they will demonstrate the technology at their booths and in Security Track sessions at the summit, which runs through Oct. 15.

The companies did not disclose financial terms, product timelines or which servers would carry the module first. Other organizations can join the working group through OCP.