MRI: Acquisition of Equipment for Research in Cyber Security Processor Design

MRI：采购网络安全处理器设计研究设备

• 批准号: 0619741
• 负责人: H. Jonathan Chao
• 金额: $ 25.59万
• 依托单位: Polytechnic University of New York
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2006
• 资助国家: 美国
• 起止时间: 2006-09-01 至 2011-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0619741&HistoricalAwards=false
• 关键词: MRI; Acquisition; Equipment; Research; Cyber

This project, building a cyber security processor with functions to protect part of the Internet from various attacks, designs an integrated CYber SEcurity Processor (CYSEP) to accelerate encryption, decryption, authentication, shallow and deep packet inspection, and DDoS security function. The work aims at demonstrating that security engines can scale in throughput to 10 Gbps and beyond. The encryption/decryption engine supports message confidentiality VPN function. This engine will support both block and stream modes of operation. It can accelerate application, transport, network, and data link layer VPN protocols. The authentication engine implements message integrity VPN function and an extremely fast scalable universal hash function-based Message Authentication CODE (MAC) hardware architecture. The DDoS detection and protection engine uses a novel Packet-Score scheme to estimate the legitimacy of suspicious packets avoiding the problems associated with conventional binary rule-based filtering. By implementing packet classification and multi-packet content inspection at line speed without fragmentation, the FIrewall and INtrusion Detection (FIND) engine detects attacks and filters unwanted content.

该项目构建了一个具有保护部分互联网免受各种攻击的功能的网络安全处理器，设计了一个集成的网络安全处理器(CYSEP)，以加速加密、解密、身份验证、浅层和深度包检测以及DDoS安全功能。这项工作旨在证明安全引擎可以将吞吐量扩展到10Gbps甚至更高。加解密引擎支持报文保密VPN功能。该引擎将同时支持块和流操作模式。它可以加速应用层、传输层、网络层和数据链路层VPN协议。该认证引擎实现了消息完整性VPN功能和一个极快、可扩展的基于通用散列函数的消息认证码(MAC)硬件架构。DDoS检测和保护引擎使用一种新的数据包得分方案来评估可疑数据包的合法性，避免了传统的基于二进制规则的过滤所带来的问题。通过以无碎片的线速实施数据包分类和多数据包内容检测，防火墙和入侵检测(Find)引擎可检测攻击并过滤不需要的内容。