Advancing hardware security with open-source Integrated HSM technology

At the OCP Global Summit, Microsoft unveiled Project Tessera, transforming Azure’s Integrated HSM into an open-source initiative developed with Marvell, Oracle, and the Open Compute Project. The project releases the architecture, specifications, protocols, drivers, software, firmware, and build environments under open licenses to enable broader adoption and collaboration across the hardware security ecosystem.

Project Tessera builds on Azure Integrated HSM’s workload-attached model, which performs cryptographic operations near the workload while keeping keys protected within the HSM boundary. This design reduces latency, improves performance, and maintains strong key protection compared to traditional central HSM deployments that rely on network traversal and risk-prone workarounds.

The initiative introduces Tessera Integrated HSM, an open-source solution designed to enforce FIPS 140-3 Level 3 key protection throughout the key lifecycle. It supports quantum-resilient cryptography and enables interoperability between heterogeneous HSMs, as demonstrated with Marvell’s LiquidSecurity 2 HSM using post-quantum cryptographic protocols for secure partition cloning and resiliency rings.

Project Tessera extends its security model beyond dedicated HSM hardware by offering a minimal, unikernel-based firmware stack for confidential computing environments. This implementation leverages AMD SEV-SNP and open-source virtualization technologies like OpenVMM, providing hardware-isolated key protection for platforms without integrated HSM hardware while maintaining a consistent security architecture.