CommSec D1 - An Isolated Data Center Security Policy Model Using SmartNICs
summary
Argues that placing policy on SmartNICs isolates infrastructure from tenant hosts, offloads control and data planes, and restores performance lost to host-based controls — operators see 40–60% of CPU eaten by virtual networking and IPSec can consume up to ~12 cores at 40Gbps, while SR‑IOV yields near‑line‑rate (≈39.5/40G) forwarding. Demonstrates a SmartNIC reference architecture that implements offloaded IPSec and microsegmentation at line rate and a working bypass IOMMU physical‑memory introspection prototype that reads host physical memory for live forensics.
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:59Inherent Data Center Security Issues
- 7:52Modern Data Center Architecture
- 16:25The Server CPU Bottle Neck
- 21:38Different Trust Domains Are Bridged
- 24:0830 Years of Host-based Security Failures
- 27:43A SmartNIC is a Computer
- 32:05Function Isolation
- 33:59Creating an Isolated Trust Domain
- 40:08Flow Tables
- 45:10Controlling the flow of Data A Programmable Platform with a Dynamic Data Path
- 47:36A Programmable Platform A Dynamic Data Path Configured By Policy
- 49:15Sample Applications
related talks
17mOSMOSIS: Enabling Multi-Tenancy in Datacenter SmartNICs
15mCharacterizing Off-path SmartNIC for Accelerating Distributed Systems
17mRearchitecting the TCP Stack for I/O-Offloaded Content Delivery
17mZOC: Elastic and Cost-Efficient Virtual SmartNIC Architecture for Cloud Physical Machines
17mSmartNIC-Enabled Live Migration for Storage-Optimized VMs with PYROCUMULUS
22mTransparent MultiNIC Routing for Large AI Models
16mOneSidedMW: Managing Disaggregated Memory Efficiently, Flexibly, and Securely with RNIC
31mSecure IO