MRI: Acquisition of Equipment for Research in Cyber Security Processor Design

本课题通过构建具有保护部分互联网免受各种攻击功能的网络安全处理器，设计了一种集成的网络安全处理器（CYSEP），以加速加密、解密、认证、浅包和深包检测以及DDoS安全功能。这项工作旨在证明安全引擎可以将吞吐量扩展到10gbps甚至更高。加解密引擎支持消息保密VPN功能。该引擎将支持块和流两种操作模式。它可以加速应用、传输、网络和数据链路层VPN协议。该认证引擎实现了消息完整性VPN功能和基于通用哈希函数的快速可扩展MAC （message authentication CODE）硬件架构。DDoS检测和保护引擎使用一种新颖的Packet-Score方案来估计可疑数据包的合法性，避免了传统的基于规则的二进制过滤相关的问题。FIND （FIrewall and INtrusion Detection）引擎通过实现包分类和多包内容检测，在不分片的情况下以线速检测攻击并过滤不需要的内容。

This project, building a cyber security processor with functions to protect part of the Internet from various attacks, designs an integrated CYber SEcurity Processor (CYSEP) to accelerate encryption, decryption, authentication, shallow and deep packet inspection, and DDoS security function. The work aims at demonstrating that security engines can scale in throughput to 10 Gbps and beyond. The encryption/decryption engine supports message confidentiality VPN function. This engine will support both block and stream modes of operation. It can accelerate application, transport, network, and data link layer VPN protocols. The authentication engine implements message integrity VPN function and an extremely fast scalable universal hash function-based Message Authentication CODE (MAC) hardware architecture. The DDoS detection and protection engine uses a novel Packet-Score scheme to estimate the legitimacy of suspicious packets avoiding the problems associated with conventional binary rule-based filtering. By implementing packet classification and multi-packet content inspection at line speed without fragmentation, the FIrewall and INtrusion Detection (FIND) engine detects attacks and filters unwanted content.