{"id":54512,"date":"2026-10-13T09:15:00","date_gmt":"2026-10-13T16:15:00","guid":{"rendered":"https:\/\/azure.microsoft.com\/en-us\/blog\/?p=54512"},"modified":"2026-10-13T09:36:46","modified_gmt":"2026-10-13T16:36:46","slug":"advancing-hardware-security-with-open-source-integrated-hsm-technology","status":"publish","type":"post","link":"https:\/\/azure.microsoft.com\/en-us\/blog\/advancing-hardware-security-with-open-source-integrated-hsm-technology\/","title":{"rendered":"Advancing hardware security with open-source Integrated HSM technology"},"content":{"rendered":"\n

At this year\u2019s OCP Global Summit<\/a>, Microsoft announced Project Tessera, the evolution of the Azure Integrated Hardware Security Module (HSM),<\/a> into a fully open-source initiative developed in collaboration with Marvell\u00ae, Oracle, and Open Compute Project (OCP)<\/a>. Project Tessera advances our broader commitment to open, industrywide standards for platform security.<\/p>\n\n\n\n

The motivation behind Project Tessera is straightforward: the entire industry benefits when we collaborate and advance hardware security together.<\/p>\n\n\n\n

Project Tessera carries forward the workload directly attached to the HSM architecture introduced by Azure Integrated HSM, making the architecture, specifications, protocols, drivers, software, firmware, and reproducible build environments open source<\/a> for the broader community. Over time, the initiative will advance toward a fully open-source silicon implementation, while making hardware broadly available, enabling organizations across the ecosystem to adopt, integrate, and contribute to the platform.<\/p>\n\n\n\n

\n
Explore the Tessera Integrated HSM GitHub<\/a><\/div>\n<\/div>\n\n\n\n

This approach builds on the model Microsoft established with other industry collaborators on Caliptra<\/a>, a fully open-source silicon root-of-trust that has since been broadly adopted<\/a> across the hardware ecosystem. Through Project Tessera, industry leaders including Microsoft, Marvell\u00ae, Oracle, and the Open Compute Project will apply that same model of transparency and collaboration to advance hardware key protection with the industry.<\/p>\n\n\n

\"Image\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n

The cybersecurity landscape is rapidly changing, and protecting keys and credentials has never been more important. We are now facing two generational transformations that are fundamentally reshaping how we view the cybersecurity landscape:<\/p>\n\n\n\n

    \n
  1. AI is increasing the speed and scale of cyberattacks<\/strong>

    AI-orchestrated attacks are increasing the scale, speed, and sophistication of attacks, giving adversaries new ways to operate and compressing the time between vulnerability discovery and exploitation. These capabilities amplify risks such as credential theft, key exfiltration, and signing abuse.

    Keys and credentials are high-value control assets<\/a>. When compromised, they can enable attackers to impersonate trusted entities, bypass security controls, authorize malicious operations, expose sensitive data, and undermine software security defenses. Protecting these assets requires infrastructure with layered, hardened protections capable of withstanding sustained attacks across multiple concurrent attack vectors.<\/li>\n<\/ol>\n\n\n\n
      \n
    1. Quantum computing is changing the cryptographic risk horizon<\/strong>

      Quantum computing promises transformative advances, but it also presents a risk to many of today\u2019s cryptographic algorithms.       A sufficiently powerful quantum computer could break widely used public-key cryptography<\/a>, undermining digital signatures, authentication, and identity verification.

      Post-quantum cryptography was once viewed as an important but distant technology shift. Advances in quantum computing have changed that perspective as organizations recognize the urgency, scale, and complexity of the transition.       HSM-backed signing infrastructure will be among the first critical systems to migrate<\/a>, requiring HSMs that support post-quantum cryptography and are interoperable with classical HSMs to support migration.<\/li>\n<\/ol>\n\n\n\n

      These emerging threats motivated the development of Azure Integrated HSM<\/a>, which was designed to meet rigorous security standards for hardware-based key protection, while also accelerating Microsoft’s transition to post-quantum cryptography through scale deployments of quantum resilient integrated HSMs.<\/p>\n\n\n\n

      Azure Integrated HSM<\/a> introduced a workload-attached HSM that performs cryptographic operations closer to the workload while keys remain continuously protected within the HSM security boundary. This architecture strengthens key protection, improves cryptographic performance, offers crypto-agility, and provides a simpler operational model.<\/p>\n\n\n\n

      Tessera is an evolution of Azure\u2019s first integrated HSM model, incorporating insights gained from deploying Azure Integrated HSM at scale, and advances the technology through collaboration in the Open Compute Project, with the goal of broadly addressing the challenges of key and credential management in the era of AI and quantum computing.<\/p>\n\n\n\n

      Eliminating key management anti-patterns<\/strong><\/h2>\n\n\n\n

      In central HSM deployment models, HSM infrastructure is separate from compute resources, requiring cryptographic operations to traverse the network. The resulting latency and operational dependencies can lead enterprises to adopt workarounds that improve performance or availability but unintentionally weaken key protections. Some of these common key-management anti-patterns include:<\/p>\n\n\n\n