Securing Azure infrastructure with silicon innovation

As part of our systems approach in optimizing every layer in our infrastructure, security is a key priority and we are designing our infrastructure hardware with multiple layers of defense with dedicated innovations to ensure robust protection for Microsoft and for our customers.

In September, Microsoft outlined our vision for Trustworthy AI and Azure Confidential Inferencing. This vision emphasizes the use of hardware-based Trusted Execution Environments (TEEs) for data privacy and the protection of workloads. Last month, we expanded on this vision by introducing new open-source silicon security innovations. This included the announcement of Adams Bridge, a quantum-resilient accelerator, and its integration into Caliptra 2.0, the next-generation open-source silicon root of trust (RoT).

As part of Microsoft’s commitment to our Secure Future Initiative (SFI), we are announcing our newest in-house security chip, Azure Integrated HSM, a dedicated Hardware Security Module (HSM) that strengthens key protection by enabling the use of encryption and signing keys while they remain within the bounds of a HSM, without incurring the typical network access latencies for HSM access.

Enhancing security capabilities for every new Azure server

Azure Integrated HSM is designed to meet the demanding Federal Information Processing Standards (FIPS) 140-3 Level 3 Security Requirements for Cryptographic Modules. Azure Integrated HSM protects keys and security assets while these assets are in-use. Azure Integrated HSM has specialized hardware cryptographic accelerators to perform encryption, decryption, signing, and verification operations while they remain within the bounds of the integrated HSM. 

Typical cloud HSM services are centralized resources on the network that can be configured by cloud tenants to offer key services to their respective workloads. While these models provide robust key protection, they can be difficult to scale with the same flexibility as other resources, such as compute. In addition, when workloads need to use their keys, they either incur network round-trip latency for calls to the network attached HSM service or, if their key policy permits, the workloads may request the release of their keys from the HSM and import them into their local environment. When keys are released from the HSM and imported into the workload’s environment, the security protections offered may become less than FIPS 140-3 Level 3. 

Azure Integrated HSM eliminates the classic tradeoff between increased network round trip latency to remote HSM services or seeking the release of keys from the remote HSMs. As a server-local HSM that securely binds to the workload environments, Azure Integrated HSM provides locally attached HSM services to both confidential and general-purpose virtual machines and containers. This provides the benefit of industry-leading in-use key protection without the latency drawbacks of round-trip network-attached HSM calls.

Security benefits of Azure Integrated HSM 

Azure Integrated HSM offers several benefits for Azure customers who need to protect their sensitive data and applications in the cloud.

• Enhanced security and locally deployed.
  Azure Integrated HSM allows cryptographic keys to remain isolated from software, including both guest and host software. With Azure Integrated HSM, keys can remain entirely within a dedicated, hardware-based HSM, designed to FIPS 140-3 Level 3 security standards, even while those keys are in-use. This provides strong isolation with both physical and logical tamper protection and tamper detection.
   
• Locally deployed with minimum latency.
  Azure Integrated HSM can handle high volumes of cryptographic requests with minimum latency, thanks to its dedicated hardware accelerators and node-integrated connectivity. Azure Integrated HSM also supports dedicated, per-workload HSM partitions. Hardware isolates the partitions and allows only oracle access to keys from the workload environment.  
  
  
• “Secure by design”, protecting across the Azure hardware fleet.
  Azure Integrated HSM will be installed in every new server in Microsoft’s datacenters starting next year to increase protection across Azure’s hardware fleet for both confidential and general-purpose workloads.

Azure Integrated HSM represents the latest innovation in ensuring robust and comprehensive protection of our infrastructure. By integrating advanced hardware security features such as the silicon root of trust and secure control modules, we are providing the foundation for the trust and security that Azure delivers to our customers. We are committed to continuously enhancing our cloud hardware security capabilities to meet the evolving needs of our customers.

Learn more about our latest innovations. Check out what’s new in Azure Infrastructure.