Cloud security increasingly depends on protecting the cryptographic keys that secure data, software identities and digital services. That’s why the term integrated hardware security module, or integrated HSM, is gaining attention. On October 13, 2026, Marvell, Microsoft and Oracle announced an Open Compute Project effort to create an open specification for this type of in-server security hardware. (investor.marvell.com)
What Is an Integrated HSM?
A hardware security module, or HSM, is a specialized, tamper-resistant system that generates, stores and uses cryptographic keys. An integrated HSM places that protected capability directly in a server, instead of using a separate network-connected appliance or relying only on software.
It isn’t just a password vault. The module keeps sensitive keys inside a protected hardware boundary while performing tasks such as encryption, decryption, digital signing and key management. That matters because, for an attacker, the key may be more valuable than the encrypted data itself.
How an Integrated HSM Works
When an application needs to encrypt data or prove its identity, it sends a cryptographic request to the HSM within the same server. The protected module handles the operation and returns the result without exposing the private key to the application or sending it across the data-center network.
An integrated design can also support attestation, which provides cryptographic evidence that a server or workload is operating in an expected, trusted state. Other systems can review that evidence before trusting the workload with sensitive data or credentials.
Why It Matters
Keeping key operations close to where data is processed can cut network delays and reduce the number of places where keys could be exposed. It may be especially useful for large cloud platforms, AI infrastructure and regulated workloads that need strong encryption and identity controls.
The proposed OCP work is aimed at a common, silicon-based approach rather than a proprietary design from a single vendor. It’s still an emerging specification, not a standard feature in every server. Its current importance comes from the effort to standardize hardware-based key protection for cloud-scale systems, alongside requirements such as FIPS 140-3 for cryptographic modules. (investor.marvell.com)
