Marvell, Microsoft and Oracle have formed an Open Compute Project working group to develop an integrated hardware security module for cloud and hyperscale data centres. The proposal would keep cryptographic keys inside a certified hardware boundary and perform key operations where workloads run, rather than relying only on network-attached security hardware or software-based key management.
Marvell Technology Watch analysis
What happened
The companies say the group will define an open specification for secure key caching, cryptographic key lifecycle management and hardware attestation at server level. The proposed design targets NIST FIPS 140-3 Level 3 certification. That is a specification effort, not a report that certified hardware is already available or deployed.
Marvell says an initial draft is targeted for the OCP Global Summit in October 2026, with version 1.0 to follow. The companies also plan to demonstrate the technology at the summit. Other organisations can join the working group through the Open Compute Project.
Why it matters
Cloud and AI workloads depend on more than chips and power. Their cryptographic keys and the ability to prove a workload’s integrity are part of the infrastructure too. Putting those functions closer to the server could reduce network trips and make it easier to verify that workloads are running within trusted hardware boundaries, if the proposal delivers as described.
An open specification could give cloud providers and hardware makers a shared target instead of another set of incompatible security appliances. That is the ambition, not the outcome: adoption will depend on the finished specification, implementations and certification.
Our read
This is a practical infrastructure proposal, with a clear security job and an industry-wide route to setting the rules. The interesting test is whether “open” produces hardware that providers can actually use across systems, rather than a tidy document followed by a long queue of incompatible products.
What to watch
- Whether the initial specification appears at the October OCP Global Summit.
- What the final design requires for certification and interoperability.
- Whether other OCP members join and providers adopt the resulting hardware.
Discussion spark: Should cloud providers favour an open, shared hardware-security standard, or keep choosing proprietary systems they can deploy on their own timetable?
Sources and evidence
- Source update (13 October 2026, 00:00 UTC)
not affiliated with or endorsed by Marvell Technology