Marvell, Microsoft and Oracle Establish OCP Working Group to Standardize Data Center Hardware Security

Marvell Technology (MRVL), Microsoft and Oracle have established an Open Compute Project working group to standardize integrated hardware security for data centers.

See more from StockTitan in Google Search and AI answers. Adds StockTitan as a preferred source · opens Google

Add on Google Not now

• New Open Compute Project (OCP) working group: Companies form a new working group to standardize on a silicon-based and attested secure integrated hardware security module (HSM) solution for cloud and hyperscale data center infrastructure.
• Strengthening cloud security: Secure key caching and attestation cryptographic key lifecycle management at the server level will reduce latency, improve scalability and strengthen the security posture of cloud compute workloads.
• Open technical specification: Initial draft of technical specification to be released at OCP Global Summit in October 2026, paving the way for broad industry adoption of in-server security for data centers.

SANTA CLARA, Calif.--(BUSINESS WIRE)-- Marvell Technology, Inc. (NASDAQ: MRVL), Microsoft Corporation and Oracle today announced a collaborative effort aligned with the Open Compute Project (OCP) aimed at standardizing a NIST FIPS 140-3 Level 3 integrated HSM for cloud and hyperscale data center infrastructure.

To direct this effort, the three companies have established a new OCP working group under OCP’s Security Track. The working group’s charter is to define open specifications for an integrated hardware security module for secure key caching and cryptographic key lifecycle management directly at the server level. This approach will reduce latency, improve scalability and strengthen the security posture of cloud compute workloads.

Most cloud and enterprise servers today rely on network-attached hardware security modules (HSMs) or software-only key management. This approach requires cryptographic keys to traverse the network or reside in unprotected, non-FIPS 140-3 Level 3 memory, exposing sensitive keys to potential security attacks. The working group will define an open specification for embedding a hardware security boundary, key vault and attestation chain directly into the server. This will ensure that cryptographic operations execute where data is processed, keys never leave a certified hardware boundary and workload integrity can be proven cryptographically to any relying party.

“An integrated HSM will allow cryptographic key operations to execute where the workload runs, satisfying both regulatory compliance and zero-trust architecture requirements, all without compromising higher performance for security,” said Cary Ussery, senior vice president and general manager, Multimarket Business Group, at Marvell. “By defining this as an open specification, we’ll make that capability available to the entire industry.”

“As AI transforms cybersecurity and quantum technology reshapes cryptography, protecting the keys and credentials at the heart of our digital infrastructure has never been more important,” said Mark Russinovich, CTO, deputy CISO and technical fellow, Microsoft Azure. “Through the Open Compute Project, industry leaders are coming together around a fully open-source integrated HSM, combining our collective innovation to advance interoperability, accelerate the adoption of post-quantum cryptography, and shape the future of hardware security.”

“An open specification for integrated Hardware Security Module (HSM) capabilities is an important step toward enabling cryptographic operations where data is processed, protecting keys within a hardware security boundary and supporting cryptographic verification of workload integrity,” said Pradeep Vincent, executive vice president, Compute and AI Infrastructure at Oracle. “This effort aims to establish a common foundation for adoption across the industry.”

About OCP and the New Security Working Group

The Open Compute Project (OCP) is a collaborative community focused on redesigning hardware technology to efficiently support the growing demands of compute infrastructure.

As founding members of the new OCP working group, Marvell, Microsoft and Oracle will collaborate with the broader OCP community to publish a joint technical specification, with an initial draft targeted for release around the 2026 OCP Global Summit and version 1.0 to follow. The companies plan to demonstrate the new technology in their exhibit booths and during Security Track presentations at the OCP Global Summit (October 12-15) at the San Jose Convention Center in San Jose, California.

Organizations interested in participating in the security working group are encouraged to join through the Open Compute Project.

About Marvell

To deliver the data infrastructure technology that connects the world, we’re building solutions on the most powerful foundation: our partnerships with our customers. Trusted by the world’s leading technology companies for over 30 years, we move, store, process and secure the world’s data with semiconductor solutions designed for our customers’ current needs and future ambitions. Through a process of deep collaboration and transparency, we’re ultimately changing the way tomorrow’s enterprise, cloud and carrier architectures transform—for the better.

About Oracle

Oracle offers integrated suites of applications plus secure, autonomous infrastructure in the Oracle Cloud. For more information about Oracle (NYSE: ORCL), please visit us at www.oracle.com.

Marvell and the M logo are trademarks of Marvell or its affiliates. Please visit www.marvell.com for a complete list of Marvell trademarks. Oracle, Java, MySQL, and NetSuite are registered trademarks of Oracle Corporation. NetSuite was the first cloud company—ushering in the new era of cloud computing. Other names and brands may be claimed as the property of others.

This press release contains forward-looking statements within the meaning of the federal securities laws that involve risks and uncertainties. Forward-looking statements include, without limitation, any statement that may predict, forecast, indicate or imply future events, results or achievements. Actual events, results or achievements may differ materially from those contemplated in this press release. Forward-looking statements are only predictions and are subject to risks, uncertainties and assumptions that are difficult to predict, including those described in the “Risk Factors” section of our Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q and other documents filed by us from time to time with the SEC. Forward-looking statements speak only as of the date they are made. Readers are cautioned not to put undue reliance on forward-looking statements, and no person assumes any obligation to update or revise any such forward-looking statements, whether as a result of new information, future events or otherwise.

View source version on businesswire.com: https://www.businesswire.com/news/home/20261012067973/en/

George Millington
pr@marvell.com

Cecilia Xia
ceciliaxia@microsoft.com

Carolin Bachmann
carolin.bachmann@oracle.com

Source: Marvell Technology, Inc.

Key Terms

hsm technical

A hardware security module (HSM) is a dedicated, tamper-resistant device that generates, stores and uses cryptographic keys to protect sensitive digital assets and transactions. Think of it as a locked, monitored safe for the digital keys that authorize payments, sign documents or manage encrypted data; it matters to investors because companies that use HSMs reduce the risk of key theft, fraud, or data breaches that can cause financial loss and regulatory problems.

fips 140-3 regulatory

A U.S. government standard that sets detailed security requirements for cryptographic modules—software or hardware components that encrypt data and manage keys. Think of it as a rigorous safety inspection for digital locks: passing the test signals that a product meets recognized security practices, which matters to investors because certification can affect a company’s ability to sell to governments and regulated industries, reduce legal and operational risk, and support customer trust.

attestation technical

An attestation is a formal, signed statement by a company officer, auditor, or expert confirming that a document, financial figure, or regulatory claim is true and complete. Think of it like a trusted person signing a receipt to confirm what happened; for investors this adds credibility and legal accountability to the information they rely on, helping reduce uncertainty and the risk of hidden errors or misleading claims.

cryptographic key lifecycle management technical

Cryptographic key lifecycle management is the set of policies, procedures and technical controls used to create, distribute, store, use, rotate, archive and securely destroy cryptographic keys that protect data and digital operations. It covers every stage from key generation and secure provisioning to backup, access control, scheduled replacement (rotation), incident-driven revocation and end-of-life destruction, plus auditing and logging to prove keys were handled correctly. A practical consequence is that failures at any stage—weak generation, poor storage, missed rotation or improper destruction—can undermine the security guarantees the keys are supposed to provide.