Adding Network Security To AI, HPC, And Data Centers

AI and HPC are transforming data center networking. Modern infrastructures typically consist of a front-end network connecting users, storage, and management systems, and a back-end network interconnecting GPUs and compute nodes. At the largest scale, AI clusters span multiple locations, relying on scale-across networking to create a unified infrastructure.

While most modern data centers use leaf-spine architectures, implementation choices are influenced by more than technical requirements. Existing vendor relationships, product availability, supply-chain considerations, and total cost of ownership all play important roles. Consequently, organizations pursuing similar objectives often implement the network based on their business priorities, operational constraints, and upgrade strategies.

AI and HPC infrastructures process valuable data and represent significant financial investments. Protecting these environments requires controls for:

Access control and authentication
Data confidentiality through encryption
Isolation between users, tenants, and workloads
Detection of tampering, replay, and other threats

At the same time, security mechanisms must support the fundamental goals of AI infrastructure:

Full line-rate throughput and minimal latency impact
Scalability across large numbers of ports and nodes
Acceptable power, silicon area, and deployment cost

The industry benefits from more than a decade of operational experience with technologies such as MACsec and IPsec in high-speed networks. The primary challenge today is determining where and how those capabilities should be implemented.

Modern AI networks operate at hundreds of gigabits per second and are rapidly moving toward multi-terabit speeds. At these performance levels, network security must be implemented in following way:

The security data plane performs real-time packet processing and protection. These functions are integrated into switching ASICs, SmartNICs, DPUs, optical DSPs, or interface devices.
The control plane implements security policy management, session establishment and run-time operations like periodic encryption key refresh.

Fig. 1: Hardware-accelerated network security architecture with data plane and control plane.

One of the most important architectural decisions is the location of security functions such as MACsec, IPsec, or emerging Ultra Ethernet security mechanisms.

Integrating security directly into the switch ASIC allows encryption and authentication to become part of the packet-forwarding pipeline.

Advantages:

Native integration with packet classification and forwarding.
Broad flexibility in optical and pluggable module selection.

Challenges:

Consumes silicon area that could otherwise increase port density, packet buffering, switching capacity.
Security capabilities are tied to the ASIC lifecycle, limiting future upgrades.

Alternatively, security functions can be implemented in external PHY devices (like the line-card retimer/gearboxes) or security-enabled pluggable modules.

Advantages:

Easier introduction of new security capabilities.
Preserves switch ASIC resources for networking functions.
Moves extra power consumption away from the main ASIC and use the power optimized technology.

Challenges:

Creates dependencies on external vendors and module availability.
Shifts the security boundary from the chip level to the front-panel level.

AI and compute systems rely on specialized transport protocols, including InfiniBand, RoCEv2, Ultra Ethernet Transport (UET). Unlike fabric-level security, transport security is typically associated with a specific user, job, or workload and therefore operates as an end-to-end service. Security must remain transparent to the underlying fabric while preserving the low latency and high throughput required by accelerated computing.

For this reason, transport security is integrated into (Smart) NICs and closely coupled with hardware-accelerated transport processing and often support multiple transport and security protocols simultaneously to accommodate diverse communication requirements.

Fig. 2: Network security in the AI NIC.

Modern infrastructures deploy multiple security layers simultaneously based on topology, trust boundaries, and workload requirements:

MACsec for Layer 2 protection
IPsec for Layer 3 security
UET-TSS for Ultra Ethernet transport security
Proprietary security protocols optimized for specific fabrics and deployments

These mechanisms are largely complementary rather than competitive. MACsec is commonly used for link-level protection, IPsec secures routed traffic across networks, and transport-level security protects AI and HPC communication flows.

Advances in optics are expanding deployment options for network security. MACsec is now being integrated directly into 800G and 1.6T optical modules, enabled by use of silicon technologies optimized for low-power packet processing.

Looking ahead, chiplet-based switch and NIC architectures, together with near-package and co-packaged optics, may create new opportunities for security integration. Dedicated I/O chiplets could become a natural location for encryption and authentication functions while preserving valuable compute and switching resources.

Network security is now a fundamental requirement for AI, HPC, and cloud-scale data centers. Protecting traffic at terabit speeds demands hardware-based implementation capable of maintaining line-rate performance while meeting cost and power targets.

The industry offers multiple deployment options, including switch ASICs, external PHYs, optical modules, SmartNICs, and future chiplet-based architectures. This flexibility allows data center designers to balance security, performance, power efficiency, and system cost according to the needs of their infrastructure.

Rambus addresses these challenges through a broad portfolio of industry-proven network security silicon IP supporting rates up to 1.6T, and 3.2T in the future. Customers can balance security features, throughput, power consumption, and integration effort to deploy network security capabilities that meet the performance, cost, and time-to-market requirements of their silicon devices. You can read more about this topic in the white paper in the Links section below.

Maxim Demchenko

(all posts)
Maxim Demchenko is a technical director for Rambus Security IP. He joined Rambus following the acquisition of Inside Secure. His work focuses on network security IP architectures, design/verification methods, and bringing various line-rate MACsec/IPsec and Ultra Ethernet products to market. His role includes direct engagement with leading SoC and system vendors to define optimal product solutions. Before Rambus, Demchenko worked at Philips as an FPGA/ASIC engineer.