Integrated security stacks, which offer diverse security function chains in a single device, hold substantial potential to satisfy the security requirements of multiple tenants on a public cloud. However, it is difficult for the software-only or hardware-customized security stack to establish a good tradeoff between performance and flexibility. SmartNIC overcomes these limitations by providing a programmable platform for implementing these functions with hardware acceleration. Significantly, without a professional CPU/SmartNIC co-design, developing security function chains from scratch with low-level APIs is challenging and tedious for network operators. This paper presents PASS, a flexible programmable framework for the fast development of high-performance security stacks with SmartNIC acceleration. In the data plane, PASS provides modular abstractions to extract the shared security logic and eliminate redundant operations by reusing the intermediate results with the customized metadata. In the control plane, PASS offloads the tedious security policy conversion to the proposed security auxiliary plane. With well-defined APIs, developers only need to focus on the core logic instead of labor-intensive shared logic. We built a PASS prototype based on a CPU-FPGA platform and developed three typical security components. Compared to implementation from scratch, PASS reduces the code by 65% on average. Additionally, PASS improves security processing performance by 76% compared to software-only implementations and optimizes the latency of policy translation and distribution by 90% versus the architecture without offloading.

Deterministic Ethernet (DetEth) is widely used in real-time distributed systems, such as avionics and in-vehicle control. Clock synchronization protocols (CSPs) establish global time, which is a critical foundation for deterministic communication in DetEth. However, existing protocols often lack flexibility, making customization and adaptation to specific scenarios difficult and time consuming. We propose OpenSync, which is a software-defined clock synchronization architecture that decouples the synchronization control plane from the data plane. OpenSync includes a programmable time data injector and a fine-grained calibrated timer in the data plane, enabling easy implementation with standard DetEth hardware and support for various CSPs. The control plane provides a synchronization library to configure local clocks and retrieve accurate time data for different methods. To validate OpenSync’s generality and efficiency, we develop an FPGA-based prototype and implement three CSPs through software programming. A fully functional testbed demonstrates that these CSPs meet the accuracy and protocol consistency requirements of their respective application scenarios.