As storage networks move beyond 100G toward 400G and next-generation speeds, performance is no longer determined by network bandwidth alone. Every packet that crosses the network may also need to be encrypted, authenticated, and integrity checked creating a growing processing burden for the host CPU.
For NVMe over Fabrics (NVMe-oF), disaggregated storage, and software-defined storage, this creates a critical challenge: how do you protect high-speed data without sacrificing the performance that high-speed networking was designed to deliver?
Traditional software-based security can consume significant CPU cycles as traffic rates increase. Those same CPU resources are needed for storage applications, virtualization, analytics, and other compute-intensive workloads.
The iW-Fibre SmartNIC takes a different approach by bringing security acceleration directly into the FPGA-based network data path
Instead of sending every packet to the host CPU for security processing, SmartNIC can perform key security functions inline as data moves through the network interface. Encryption, authentication, integrity verification, and policy enforcement become part of the high-speed hardware pipeline rather than an additional software workload.
This architecture helps keep security close to the wire while reducing unnecessary host involvement.
The Challenge: Securing 400G Without Slowing It Down:
NVMe-oF and distributed storage architectures rely on high-speed, low latency networking to move data efficiently between compute and storage resources. As network speeds scale toward 400G and beyond, however, the security workload grows with the traffic.
When encryption, authentication, and integrity processing are handled primarily by the host CPU, security can become a performance constraint rather than a transparent layer of protection. The results can include:
• Higher host CPU utilization as security workloads increases with traffic volume
• Additional processing overhead and latency across the data path
• Fewer CPU resources are available for storage applications and computing workloads
• Reduced performance predictability as traffic rates continue to scale
The challenge is no longer simply protecting storage traffic it is delivering strong security at high data rates without adding unnecessary CPU overhead or disrupting the low-latency data path.
Hardware Accelerated Security Architecture:
The iW-Fibre SmartNIC brings security directly into the FPGA based network data path, transforming security from a host side processing task into an inline hardware function. Instead of sending storage traffic to the CPU for every encryption, authentication, or integrity operation, the SmartNIC processes security functions as packets move through the data path.
This architecture is built around five tightly integrated functional blocks, working together to maintain high throughput packet processing while minimizing unnecessary host involvement.
Figure 1 : Five functional blocks work together inside the FPGA data path, keeping the host focused on storage and applications
Five Integrated Functions Powering the Secure Data Path:
The architecture combines five key functional blocks, each contributing to a fast, efficient, and programmable security pipeline:
- Packet & Flow Classification
Intelligently identifies traffic flows and packet characteristics, enabling the SmartNIC to determine the appropriate security policy for each flow. - Hardware Security Engine
Accelerates encryption, authentication, and integrity processing using dedicated FPGA resources, reducing the security workload placed on the host CPU. - Policy Management
Applies security rules directly within the data path, allowing traffic to be handled according to its flow, protocol, and security requirements. - Key Management
Supports the provisioning and management of cryptographic keys required for secure and controlled data processing. - High-Speed Data Path
Keeps packet movement and security processing tightly integrated, helping minimize unnecessary data copies and maintain an efficient flow of traffic.
As storage networks move toward 400G and beyond, security can no longer be treated as an afterthought. Encryption, authentication, and integrity checks are essential for protecting high-value data, but processing every packet through the host CPU can consume valuable compute resources and introduce additional data movement and latency.
The iW-Fibre SmartNIC takes a different approach by integrating security directly into the FPGA-based packet processing data path. Instead of sending security workloads back to the host, SmartNIC performs key security operations inline closer to the network interface and before data reaches the host.
Inline Security, Built into the Data Path:
With security integrated into the packet pipeline, protection becomes part of the normal flow of traffic rather than a separate processing stage.
For outbound traffic, SmartNIC applies configured encryption, authentication, and integrity protection before packets are transmitted. For inbound traffic, it verifies the security information and performs decryption before the data reaches the host system.
This architecture minimizes unnecessary movement between the network interface, host memory, and CPU, helping deliver a more efficient and predictable processing path for high-speed storage traffic.
Figure 2: Outbound traffic is encrypted and policy-checked before it ever leaves the NIC; inbound traffic is verified and decrypted before it reaches the host.
FPGA-Accelerated Security Functions:
Dedicated FPGA resources allow the iW-Fibre SmartNIC to accelerate critical security operations without placing the entire workload on the host processor:
- Encryption: Hardware accelerated AES GCM provides confidentiality and integrity while processing alongside the packet pipeline.
- Integrity Verification: Inline verification helps identify corrupted or modified traffic before it reaches the host or storage application.
- Authentication: Hardware acceleration supports authentication operations required by the underlying storage or transport security architecture.
- Policy Enforcement: Security policies can be applied directly in the data path based on flow information, protocol classification, and packet metadata.
Beyond Storage: Security for High-Speed Networks
The same FPGA-based architecture can extend beyond NVMe-oF and enterprise storage. Hardware-accelerated security and packet processing can support a wide range of bandwidth-intensive applications, including:
- NVMe-oF and distributed storage: Secure high-speed traffic while reducing host CPU involvement.
- Enterprise storage: Maintain predictable processing performance with security enabled.
- Multi-tenant infrastructure: Apply hardware-based policies and maintain isolated security contexts across traffic flows.
- Network security: Support line-rate firewalling, IDS/IPS, DDoS mitigation, traffic capture, and anomaly detection.
- NFV and virtualized networking: Accelerate Open vSwitch, virtual routers, and virtual switches for high-bandwidth workloads.
- Defense and critical infrastructure: Enable real-time packet inspection and hardware-accelerated cryptography for networks operating in demanding environments.
As storage and network interfaces move from 100G to 400G and beyond, security must scale at the same pace. Relying entirely on host software can turn encryption and packet inspection into a performance bottleneck.
The iW-Fibre SmartNIC addresses this challenge by making security a native part of the FPGA data path. By offloading security processing, reducing unnecessary host data movement, and minimizing CPU involvement, it helps deliver a high-performance and predictable architecture for secure, next-generation storage and networking.
