Janus: Enabling Expressive and Efficient ACLs in High-speed RDMA Clouds

Janus: Enabling Expressive and Efficient ACLs in High-speed RDMA Clouds

Speakers: Ziteng Chen

Conference: NDSS Symposium 2026

YouTube: https://www.youtube.com/watch?v=4H-FwIRh96w

Overview

As public cloud vendors increasingly deploy RDMA (Remote Direct Memory Access) networking for high-performance workloads such as AI training, inference, and distributed storage, a critical security gap has emerged: traditional access control lists (ACLs) designed for TCP/IP traffic cannot adequately express or enforce security policies for RDMA environments. This talk introduces Janus, a new ACL paradigm that provides both expressive QP-semantics-aware policy language and line-rate hardware enforcement using NVIDIA BlueField-3 DPUs, achieving 200 Gbps throughput with sub-5-microsecond latency.

The core problem stems from a fundamental architectural mismatch. RDMA uses Queue Pairs (QPs) as its basic transmission unit, which involve intricate operations split across control path traffic (QP creation, destruction, metadata exchange) and data path traffic (application data transmission). Traditional five-tuple ACL expressions based on source/destination IP, ports, and protocol simply cannot describe QP semantics, operation codes, or memory address restrictions. On the enforcement side, software-based solutions like iptables and Open vSwitch operate at the kernel level and cannot intercept kernel-bypassing RDMA traffic, while hardware solutions like Bedrock introduce extra latency and miss control path traffic entirely.

Background

▶ Watch: RDMA background and why ACLs are necessary in public clouds (0:00)

RDMA is a kernel-bypass networking technology that delivers line-rate throughput and ultra-low latency by allowing applications to read and write remote memory directly without involving the operating system kernel. This makes it ideal for latency-sensitive workloads in modern data centers, particularly AI training and inference pipelines, distributed cloud storage, and high-frequency data processing.

In public cloud environments, tenants share physical infrastructure, making ACLs essential for regulating both intra-tenant and inter-tenant traffic and blocking unauthorized access. However, the existing ACL ecosystem was built entirely around the TCP/IP networking model. The five-tuple (source IP, destination IP, source port, destination port, protocol) that forms the basis of traditional ACL expressions has no mechanism to represent RDMA-specific concepts like QP numbers, operation codes (read, write, atomic operations), or memory region addresses.

Previous work such as Bedrock attempted to address this by deploying ACL functions at programmable switches, but this approach introduces extra latency for intra-host traffic and cannot regulate RDMA control path traffic. Software-based approaches like SNAT and FreeFlow can capture kernel-bypassing traffic but cannot deliver the line-rate performance that RDMA applications require.

Key Findings

▶ Watch: Three required properties: coverage, performance, usability (4:00)

The researchers identified three essential properties that a new ACL paradigm for RDMA clouds must satisfy:

Coverage: The ACL system must describe QP semantics and cover both control path and data path traffic sources. RDMA's disaggregated traffic model means that policies must address QP lifecycle operations (creation, destruction, metadata exchange) separately from data operations (memory reads, writes, atomics).

Performance: The enforcement mechanism must achieve line-rate throughput and ultra-low latency with minimal overhead. Any ACL solution that degrades RDMA performance defeats the purpose of using RDMA in the first place.

Usability: The system must be transparent to tenants and provide user-friendly interfaces. Cloud operators should be able to express complex QP-semantics policies without requiring deep RDMA protocol expertise.

The key finding is that by carefully identifying the minimum but necessary packet fields within RDMA packets and separating them from irrelevant application-layer fields, it is possible to construct an expressive yet efficient ACL language that captures the full QP semantic space.

Technical Deep Dive

▶ Watch: Identifying minimum necessary RDMA packet fields for ACL expressions (6:00)

Janus's architecture consists of two major components: tailored ACL expressions and DPU-based ACL enforcement.

For the expression layer, the researchers performed a systematic analysis of RDMA packet fields to identify which are necessary for security policy and which are irrelevant. The necessary fields fall into two categories: entity fields (networking interface fields like IP addresses and ports that establish network-layer identity) and QP semantics fields (QP creation/destruction control operations, plus memory read/write/atomic data path operations). Fields like packet sequence numbers, RKEYs, and DMA lengths were classified as application-layer fields and excluded from ACL expressions.

On top of these field definitions, Janus provides a policy language that allows operators to construct fine-grained policies incorporating QP semantics for large-scale cloud deployments. The language is designed to reduce policy-making difficulty despite the increased complexity of RDMA semantics compared to traditional five-tuples.

For enforcement, Janus deploys on NVIDIA BlueField-3 DPUs (Data Processing Units), which are programmable SmartNICs positioned in the critical path of all RDMA traffic. The DPU provides ARM cores for general computation and multi-threaded DPA cores for parallelism. Memory resources include L1-L3 cache and shareable DRAM accessible from both DPA and ARM cores. The DPU location provides native coverage of all RDMA traffic without requiring traffic redirection.

To achieve line-rate performance, Janus introduces two system-level optimizations. First, a cache-friendly data structure for hash tables that isolates hot rules from cold rules across hierarchical memory layers, improving L1 cache hit rates. Second, a load-aware packet steering strategy that heuristically schedules RDMA packets to physical threads based on runtime thread load, preventing bottlenecks on individual processing threads.

The system uses a centralized controller where operators define QP-semantics ACL policies using Janus expressions. Trusted end-host DPUs enforce these policies through a control plane for policy maintenance and a data plane for high-speed packet inspection.

Demo / Proof of Concept

▶ Watch: Cache-friendly hash tables and load-aware packet steering optimizations (10:00)

The evaluation demonstrates that Janus achieves its design goals across both expressivity and performance dimensions. For expressivity, Janus can block existing unauthorized RDMA access patterns with just a few lines of Janus policy code, covering scenarios that traditional TCP/IP ACLs cannot address at all. For performance, the DPU-based enforcement with tailored optimizations delivers 200 Gbps throughput and sub-5-microsecond latency, matching RDMA's line-rate requirements. The comparison against existing ACL expressions shows that Janus provides strictly greater coverage of RDMA-specific access patterns while maintaining competitive performance.

Defensive Implications

▶ Watch: Evaluation: 200 Gbps throughput and sub-5 microsecond latency (10:30)

Janus addresses a significant blind spot in cloud security posture. Organizations deploying RDMA-based networking services -- which now includes most major public cloud vendors -- currently lack the tools to enforce meaningful access control on RDMA traffic. Traditional network security monitoring and enforcement tools are architecturally incapable of inspecting kernel-bypassing RDMA traffic, leaving a gap that tenants and operators may not even be aware of.

The DPU-based enforcement approach is particularly significant because it provides transparent security that does not require tenants to modify their applications or sacrifice RDMA performance. As RDMA adoption accelerates due to AI workload demands, the absence of proper ACL enforcement represents an increasing risk surface. Without QP-semantics-aware policies, cloud operators cannot regulate which memory regions tenants can access, what operations they can perform, or how QP lifecycle events are managed -- all of which are potential vectors for unauthorized data access.

The centralized controller model also enables cloud operators to deploy and update policies at scale without disrupting tenant workloads, which is essential for incident response in large RDMA deployments.

Key Takeaways

• Traditional TCP/IP ACL paradigms fundamentally cannot express RDMA QP semantics, leaving RDMA cloud traffic unregulated by conventional security tools
• RDMA traffic is split between control path (QP lifecycle) and data path (memory operations), and both require distinct ACL coverage
• Janus identifies the minimum necessary RDMA packet fields for security policy, excluding irrelevant application-layer fields like packet sequence numbers and RKEYs
• NVIDIA BlueField-3 DPUs provide the ideal enforcement point: positioned in the critical path with native RDMA traffic coverage and sufficient parallelism for line-rate processing
• Cache-friendly data structures and load-aware packet steering enable 200 Gbps throughput with sub-5-microsecond latency
• The system is transparent to tenants, requiring no application modifications

About the Speaker(s)

Ziteng Chen is a researcher focused on cloud networking security, particularly the intersection of high-performance RDMA networking and access control in public cloud environments. The work was presented at the NDSS Symposium and reflects deep expertise in both RDMA protocol internals and DPU-based network function offloading. The research team has experience with NVIDIA BlueField hardware and large-scale cloud deployment considerations.