As conventional CPU-based security architectures struggle to scale with ever-growing network bandwidths and increasingly sophisticated cyberattacks, the data processing unit (DPU), a specialized processor for datacenter infrastructure, has emerged as a transformative foundation for secure and high-performance computing. Unlike prior fragmented studies, this work proposes a comprehensive security framework for DPUs by systematically investigating the DPUs' dual role in cybersecurity, serving both as an active security enforcer and as a critical component that must itself be protected. First, the framework offloads security policies onto the DPU to enable line-rate packet inspection and hardware-accelerated security processing. Second, the framework re-architects the DPU itself to defend against physical and architectural attacks, acknowledging that the DPU also introduces a new attack surface. We validate these two design directions through two representative case studies, demonstrating the effectiveness and practicality of the proposed DPU security framework. Experimental results show that the proposed framework reduces remote direct memory access (RDMA) cache side-channel detection latency by up to 98.7% compared with the state-of-the-art, while enabling a trusted execution environment on field-programmable gate array (FPGA)-based DPUs with sub-100 ns overhead and less than 4% FPGA resource consumption.

The poor energy proportionality of server is seen as the principal source for low energy efficiency of modern data centers. We find that different resource configurations of an application lead to similar performance, but have distinct energy consumption. We call this phenomenon as “performance-equivalent resource configurations (PERC)”, and its performance range is called equivalent region (ER). Based on PERC, one basic idea for improving energy efficiency is to select the most efficient configuration from PERC for each application. However, it cannot support every application to obtain optimal solution when thousands of applications are run simultaneously on resource-bounded servers. Here we propose a heuristic scheme, CPicker, based on genetic programming to improve energy efficiency of servers. To speed up convergence, CPicker initializes a high quality population by first choosing configurations from regions that have high energy variation. Experiments show that CPicker obtains above 17% energy efficiency improvement compared with the greedy approach, and less than 4% efficiency loss compared with the oracle case.