A 100 Gbps security dataplane on a DPU with 0% host CPU

The challenge

AI data centers run denser workloads at higher traffic volumes, and each compromised host has a bigger blast radius. The standard playbook puts an agent on every host, compiles policies from a central SIEM and enforces them in the host kernel. Every cycle spent inspecting packets is a cycle taken from inference and training, and SIEM round-trips take seconds to minutes. The client had the policy engine but lacked the inline dataplane that turns Kubernetes policies into wire-rate enforcement.

What was at risk:

• Host CPU spent on security instead of AI workloads, attacks mitigated only after a SIEM round-trip, and enforcement that falls with the host it runs on, plus an agent to install, upgrade and troubleshoot on every host

What we did

• Split the dataplane in two: software decides once per flow on the BlueField Arm cores, and the DPU’s switch enforces every packet after that at silicon speed
• Wrote the slow path as a C++ application on DPDK that extracts the 5-tuple of each new flow, matches it against compiled policy and programs the switch
• Programmed the fast path in NVIDIA DPL, compiled down to the DPU’s internal switch dataplane
• Tuned DPDK to reach line rate on Arm cores, through queue sizing, memory pinning and thread affinity, so the slow path never becomes the bottleneck
• Integrated the client’s eBPF policy engine and built a pipeline that compiles Kubernetes workload policies into DPU match rules, with changes reaching the DPU in real time
• Aligned the dataplane with a multi-tenant spine-leaf fabric, preserving VRF isolation from policy compilation through rule generation
• Worked in direct engineering collaboration with NVIDIA, through joint calls, shared channels and co-developed solutions

How it works

Policy is written at the Kubernetes level and enforced on the DPU, off the host, in five layers.

1. Workloads Kubernetes pods run AI inference, training and serving. Nothing security-related is installed on the host OS.
2. Policy The client’s eBPF policy engine expresses policies in Kubernetes terms: endpoint selectors, namespaces and labels. A compilation pipeline resolves the selectors to the current set of flows and emits DPL-compatible match rules, so policy changes reach the DPU in real time with no SIEM round-trip.
3. DPU slow path A C++/DPDK application on the BlueField Arm cores hooks NVIDIA’s drivers, handles the first packet of each flow, extracts its 5-tuple, matches it against the compiled policy and programs the switch.
4. DPU fast path The DPU’s internal switch, programmed in NVIDIA DPL, matches and enforces every later packet of the flow at line rate: 100 Gbps per port.
5. Fabric The DPU sits in a spine-leaf fabric with a VPP-based dataplane and multi-site data center interconnect. Tenants are isolated per VRF, with several VRFs per tenant for workload segmentation, and VRF context is preserved through the whole match pipeline, including under policy churn.

Because enforcement runs on a separate processor behind its own PCIe boundary, compromising a host does not compromise the policy that protects it, and the DPU becomes the unit of deployment.