Before you can explain how Check Point secures an AI factory, you need one mental model: the DPU — a computer that lives on the network card. Meet BlueField-3.
This track's destination is Check Point AI Factory Firewall running on NVIDIA BlueField-3. But that only makes sense once you can answer one question: what is a DPU, and why does it exist? That's this lesson.
A DPU (Data Processing Unit) is the data center's third socket — after the CPU and GPU — a full computer on the network card that handles networking, storage, and security so the host's CPU and GPU don't have to.arch
Each socket is good at a different job. Keep these three roles separate in your head and the rest of the track falls into place.
This placement is the whole point. The DPU is the card the server plugs into the network through — so all traffic in and out of the host passes through the DPU first.
BlueField-3 is a system-on-chip. The parts you should be able to name:datasheet
| Part | What it is |
|---|---|
| Arm cores | Up to 16 Armv8.2+ (Cortex-A78) cores — run the DPU's own Linux and the security software |
| ConnectX-7 NIC | The 400 Gb/s network engine — Ethernet or InfiniBand — the data path itself |
| Datapath Accelerator | 16 cores / 256 threads, programmable, for high-rate packet work |
| HW accelerators | Fixed-function engines: crypto (IPsec/TLS), RegEx, compression/dedupe, storage |
| Memory | DDR5 5600, ~32 GB onboard |
| Storage | ~128 GB onboard SSD |
Numbers are "up to" — they vary by SKU. The point isn't the exact figures; it's that BlueField-3 is a real computer (cores + memory + storage + OS), not a dumb NIC. Programmed through DOCA — the subject of Lesson 2.
Because the DPU has its own cores, OS, and accelerators, and sits inline on the data path, you can run a firewall on it — inspecting traffic at line rate using the crypto/RegEx engines, while consuming zero host CPU/GPU. That is exactly what Check Point does.
The NVIDIA BlueField-3 DPU datasheet (the canonical spec), and the Hot Chips architecture writeup for the "why." Skim the block diagram and match it to the table above.