Cisco leverages NVIDIA BlueField-3 DPU to enhance workload security and operational efficiency

As cyber attacks become increasingly complex, organizations must continuously adopt advanced solutions to protect their critical assets. One of the solutions is Cisco Secure Workload, a comprehensive security solution designed to protect application workloads across different infrastructure, locations, and form factors.

Cisco recently released Cisco Secure Workload version 3.9, which takes enterprise security and operational efficiency to a new level. It provides new features to mitigate threats and vulnerabilities, and offers greater flexibility for deploying microsegmentation. Now, it has also been extended to the NVIDIA BlueField-3 data processor, whose dedicated Arm core can accelerate hardware tasks and isolate specific operations, ensuring efficient data processing and strong security, thus creating a more streamlined and secure infrastructure。

The main functions of Cisco security workloads

Cisco security workloads provide excellent visibility for each workload interaction and utilize the powerful capabilities of AI to automatically perform tasks that human administrators cannot complete, thereby protecting application workloads.

• Cisco Security Workloads provide a variety of features, including:
• Micro segmentation: This technology can isolate workloads and limit lateral movement within the network, thereby preventing threat spread and minimizing the attack surface.
• Workload encryption: Static and in transit data encryption can protect sensitive information, even if attackers gain system access.
• Threat detection and prevention: Cisco security workloads use advanced threat detection mechanisms to identify and prevent malicious activities in real-time.
• Automatic event response: This solution can automatically execute event response procedures, enabling organizations to quickly contain and remedy threats.

Integration with NVIDIA BlueField-3 DPU

The integration of Cisco Secure Workload and NVIDIA BlueField DPUs has completely changed workload security. BlueField DPUs are programmable processors designed specifically for offloading tasks from CPUs and enhancing data center security. They reside on server hardware, strategically located in the data path between the network and virtual machines (VMs).

By utilizing BlueField DPU, Cisco security workloads can offload security critical workloads from VMs. This can free up valuable CPU resources on the VM, allowing it to focus on core application processing tasks and improve overall application performance.

NVIDIA BlueField-3 DPU is a disruptive product in the field of data center service delivery. BlueField is a 400 gigabits per second (Gb/s) infrastructure computing platform that enables line speed processing for cybersecurity, storage, and software defined networking. This platform integrates powerful computing power, high-speed networking, and extensive programmability, providing software defined, hardware accelerated solutions for demanding workloads。

The main features include:

• Hardware Acceleration and Offloading: The BlueField DPU has built-in dedicated hardware accelerators for specific security features such as encryption, decryption, and data compression. These accelerators can offload computationally intensive tasks from the CPU, significantly improving performance.
• Enhanced Scalability: As the number of VMs in the environment increases, traditional proxy based methods become difficult to manage. BlueField-3 has hardware offloading capabilities that provide greater scalability to accommodate more VMs without compromising performance.
• Fortified security: BlueField-3 provides a layer of isolation between the network and VM. This isolation strengthens the overall security posture by preventing malware or unauthorized access attempts from directly accessing the VM. BlueField-3’s hardware based security features also complement Cisco Secure Workload’s software based protections. These features include:
• oSecure boot： Ensure that only authorized firmware is loaded during system startup to prevent unauthorized modifications.
• Simplified workload implementation: By offloading security tasks to data processing units (DPUs), Cisco Secure Workload 3.9 can more efficiently execute security policies. This is because BlueField-3 is specifically designed for high-performance data processing, and compared to traditional agents based on virtual machines (VMs), it can handle secure operations with higher efficiency.
• Reduce latency: Uninstalling security features to BlueField-3 can reduce latency related to security enforcement, thereby shortening application response time and improving user experience.
• Simplified operation: The centralized management of security policies on BlueField-3 simplifies operational tasks. Administrators no longer need to manage individual agents on each VM, thereby reducing the overall complexity of security management.。

BlueField technology advantages

BlueField plays a critical role in Cisco’s Secure Workload solution, which monitors network traffic and sends it to a central agent for analysis. Agents provide actionable intelligence and suggest optimized user behavior based on observed patterns to prevent threat spread and minimize attack surface.

BlueField uses 16 Arm A78 cores v8.2+, equipped with SkyMesh’s fully consistent low latency interconnect, 8 MB L2 cache, and 16 MB LLC system cache, optimizing high-performance packet processing applications and advanced packet handling. This makes BlueField an ideal choice for offloading CPU computing and data intensive tasks, allowing it to focus on high-value business operations。

For Cisco security workloads, NVIDIA Accelerated Switching and Packet Processing (ASAP2) and NVIDIA DOCA have improved scalability and CPU efficiency. Offloading communication and Open vSwitch (OVS) processing to BlueField Data Processor (DPU) can simplify and reduce the need for proxy instances per virtual machine (VM). OVS enables VMs to communicate with each other and with the external world. OVS traditionally resides in hypervisors and exchanges flow based 12 tuple matching.

The solution based on OVS software requires a large amount of CPU usage, which can affect system performance and prevent the full utilization of available bandwidth. ASAP2 technology unloads OVS by processing the OVS data plane in BlueField while keeping the OVS control plane unchanged. This can significantly improve OVS performance without the need for related CPU load.

The result is a significant improvement in efficiency, better CPU performance, and scalability.

From a security and programmability perspective, BlueField hardware access control lists (ACLs) ensure strong security by offloading ACL processing from the CPU to the DPU. This can free up the CPU to perform other tasks and improve overall system performance.

Normally, the central processing unit (CPU) is responsible for checking each incoming and outgoing packet based on a set of access control list (ACL) rules, which can be a time-consuming process for high-speed networks. When offloaded to BlueField, the data processor (DPU) can take over the task of checking packets according to ACL rules, and because DPU is specifically designed to handle network tasks, it can complete this task faster。

BlueField hardware acceleration can also encrypt and decrypt data transmitted between computing nodes and storage systems faster and more efficiently. This ensures data confidentiality without significantly affecting network performance.

The advantages of these security enhancement features include improving data confidentiality, reducing attack surface, and optimizing security performance.

Conclusion

Cisco Secure Workload represents an important step forward in security and operational efficiency. By integrating NVIDIA BlueField-3 data processors (DPUs), Cisco has created a solution that provides powerful protection without compromising performance. The combination of hardware and software innovation paves the way for businesses of all sizes to create a safer and more agile future.