SBIR Phase II: Hardware Support for 10 Gbps Intrusion Detection

这个小型企业创新研究（SBIR）第二阶段项目将通过利用应用于高速入侵检测和防御系统（IDPS）硬件的多指令单数据（MISD）处理模型来大幅推进性能突破。 MISD处理模型的多芯片实现将进一步展示该技术的可扩展性和成本效益，将IDPS处理能力提高到一定水平，同时降低现有系统的成本。 当前的线速度有状态计算受到当前可用的内容可寻址存储器的成本和可扩展性的限制。来自内存缓存架构的想法将适用于构建一个新的内存子系统，专门设计用于经济高效地支持关键的，有状态的，10 Gbps的安全应用，如TCP流重组和协议规范化。最后，开放源码接口的开发将扩大这些创新的使用范围，使广大用户通过组织间的协作努力，为IDPS技术的进步作出贡献。例如，超级计算机集群、医疗图像传输、数据存储网络、视频会议和远程呈现应用都需要10千兆位或更高的速度。不幸的是，公共和私人通信基础设施今天正因安全妥协而不稳定。网络病毒、蠕虫和其他攻击可以在互联网和专用网络上非常迅速地传播，使商业无法进行，并导致生产力的重大损失。检测和防止这些攻击通过高速链路传播的能力是促进其跨组织边界采用的关键要求。如果没有适当的入侵检测和预防，高速链路将在信息系统中引入严重的攻击，并限制高带宽下一代应用程序的商业可行性和深远的利益。 这个第二阶段项目将大大提高高速IDPS技术的成本效益、开放性和可扩展性。这将有助于更广泛地利用组织间的高速连接，并影响社会、经济和教育的进步。

This Small Business Innovation Research (SBIR) Phase II project will dramatically advance performance breakthroughs achieved by utilizing a Multiple Instruction Single Data (MISD) processing model applied to high-speed Intrusion Detection and Prevention System (IDPS) hardware. A multiple-chip implementation of the MISD processing model will further demonstrate the scalability and cost-effectiveness of the technology by increasing IDPS processing capacity to levels while reducing costs for the existing system. Current line speed stateful computations are limited by the cost and scalability of currently available content addressable memories. Ideas derived from memory caching architectures will be adapted to build a novel memory subsystem specifically designed to cost-effectively support critical, stateful, 10 Gbps security applications such as TCP stream reassembly and protocol normalization. Finally, the development of open-source interfaces will extend the use of these innovations to a large community of users who will certainly contribute to the advancement of IDPS technology through inter-organizational collaborative efforts.Next-generation applications require high-speed network connectivity. For example, supercomputer clustering, medical image delivery, data storage networking, video conferencing, and tele-presence applications all need 10 Gigabit and higher speeds. Unfortunately, public and private communication infrastructures are today being destabilized by security compromises. Network viruses, worms and other attacks can propagate very quickly over the Internet and private networks, disabling commerce and resulting in significant productivity loss. The ability to detect and prevent these attacks from traveling through high speed links is a crucial requirement for fostering their adoption across organizational boundaries. Without proper intrusion detection and prevention, high speed links will introduce severe attacks in information systems and limit the commercial viability and far-reaching benefits of high bandwidth, next-generation applications. This Phase II project will dramatically improve the cost-effectiveness, openness and scalability of high-speed IDPS technology. This will facilitate a broader use of inter-organizational, high-speed connectivity and impact social, economic and educational progress.