DPU-Offloaded TLS Termination and Session Routing for Stateful MCP Traffic#

Balakrishna Bhamidipati and Vijay Ram Inavolu

Why: Agentic traffic is starting to generate its own infrastructure requirements, and this one is squarely identity-shaped: OAuth2/JWT validation moved onto the DPU, which relocates the authentication trust boundary off the inference host.

What: A DPU-resident reverse proxy, built only from stock Linux mechanisms, that does TLS termination, OAuth2/JWT validation and MCP session-aware L7 routing.

How: MCP sessions are pinned to a backend by an application-layer Mcp-Session-Id that the backend assigns in the initialization response — so affinity is invisible at connection time and only readable after TLS termination. On the DPU, the proxy does the OpenSSL handshake in userspace then enables kernel TLS via SSL_OP_ENABLE_KTLS, handing record processing to the kernel tls subsystem where cipher and kernel support allow. It extracts the session id from decrypted headers into an in-process affinity table (round-robin for new sessions), and a single-process epoll state machine multiplexes handshakes, forwarding, long-lived SSE relay and teardown. JWT validation on the DPU rejects unauthorized requests before they reach inference hosts. Evaluation covers session affinity correctness, backend balance, stale-session handling and kTLS stability over long-lived streams. (From abstract only.)

Where applicable: Explicitly framed as a reusable architecture on commodity DPUs with no kernel modifications, rather than a new protocol — so the pattern (identity checks at the DPU boundary, kTLS fallback path) transfers even if MCP doesn't.