Marvell, Utimaco & Microsoft Join Forces to Launch New Azure Payment HSM v2

Microsoft, Marvell, and Utimaco recently announced the launch of Azure Payment HSM v2, a multi-tenant, payment Hardware Security Module-as-a-Service (HSMaaS) delivered via the Azure cloud. This marks a new era for digital payments infrastructure where the modernization cycle has been fairly slow, to date. An engineering feat involving complex multi-party PCI compliance, the solution brings payment Hardware Security Modules (HSMs) into the cloud-native era. By combining Marvell’s LS2 hardware, Utimaco’s Atalla payment firmware and Application Programming Interfaces (APIs), and Microsoft’s orchestration layer, the new service signals a shift in the payment HSM space, one of the last major hold-outs for on-premises hardware.

This launch answers a longstanding pain point in the payments market. General Purpose (GP) HSMs have cracked the cloud space for some time, but scalable, compliant, and cloud-native HSMs have been slow to materialize. Payment HSM services are already available, but encapsulated in a fairly conservative infrastructure of single-tenant, dedicated managed offerings. But with the market increasingly pushing for more flexibility, cryptographic services, and centralization capabilities in payments, the payment HSMaaS market has been long overdue.

The Azure Payment HSM v2 launch places the payment HSM segment firmly on the same path as GP HSMs in terms of go-to-market strategy. The workflows and role responsibilities remain aligned with familiar payment industry concerns, notably around retaining key ownership and having full administrative control. The “cloud” benefit is that Microsoft now manages fleet delivery and underlying cloud orchestration, abstracting that operational complexity away from the customer, while allowing them to retain control of keys and administration of the HSMs.

Multi-tenancy is playing a central role in answering that demand for HSM platform centralization. This is a major architectural shift, changing the value proposition. The solution is moving from one based on dedicated hardware per function to a cryptographic infrastructure platform. The most notable achievement enabling this is compliance based, and specifically system-level PCI certification for multi-tenancy.  PCI PTS HSM v4 has been an important catalyst, introducing new capabilities and evaluation structures, including cloud-related classes and giving vendors a path to certify newer cloud-based payment HSM models. Payment HSM services either fail or succeed on the end-to-end compliance story where HSM and the infrastructure and the operational process must be PCI compliant. The Azure HSM v2 solution cements that story as a core capability.

What is particularly interesting in the solution is the partnership between the three companies. Marvell owns the hyperscaler HSM space with its ultra-performant and hyper-targeted LS2. Utimaco is a global leader in the payment HSMs market, deploying one of the two global proprietary APIs with Atalla. Porting the Atalla firmware onto the LS2 hardware was the first step, followed by enabling a centralized group management and monitoring platform feature that Utimaco had been working on for HSMs. The Atalla API was then pulled into the Microsoft control plane, baking the orchestration layer into Microsoft’s HSM control fabric for tenant lifecycle management. Microsoft had already been using the LS2 for its cloud HSM and Key Management Services (KMS) offerings, so the brunt of the work happened on the software side, ensuring that the three technologies could be successfully brought together in terms of performance, usability, and compliance. All three come out of it stronger in the payment HSM space—Marvell and Microsoft with the expertise and reach of decades-long experience and market pull of Utimaco’s Atalla ecosystem; Utimaco with the sheer raw power of Marvell’s hardware capabilities and the reach of Microsoft’s hyperscaler status; and perhaps Microsoft, with a sunk investment of LS2s that can now perform both GP and payments services.

This is an opportunity for payment service providers, banks, and fintechs to review the division of compliance and operational control under a new payment HSMaaS model. Key ownership, API compatibility, and clarified lifecycle management, and a service that can match and perhaps even exceed on-premises expectations flatten the barriers to adoption with the Azure Payment HSM v2.