SaTC: CORE: Small: Emerging Security Challenges and a Solution Framework for FPGA-accelerated Cloud Computing

现场可编程门阵列（FPGA）已广泛应用于数据中心，以使其任务运行得更快。与传统计算机不同，FPGA 可以针对不同的任务进行不同的配置和/或编程，并在多个用户之间共享，从而增加云环境的敏捷性。然而，这种灵活性增加了安全风险。例如，如果许多用户共享 FPGA，恶意用户就可以窃取或损坏其他用户的数据。 该项目的新颖之处在于开发新方法来保护 FPGA 免受这些有害攻击。该项目具有更广泛的意义和重要性，使云计算变得更安全、更易于使用，并促进 FPGA 安全性的教育和研究。该项目旨在通过引入新颖的方法来解决 FPGA 安全问题，这些方法可防止攻击损害用户数据、导致数据中心损坏或物理损坏。通过实施安全操作机制，多个用户之间受控的 FPGA 共享成为可能。 FPGA 中嵌入了安全和队列管理单元 (SQMU)，以保持进程隔离并允许安全共享，而无需牺牲性能和能源效率。所提出的结构使多个应用程序能够安全地共享同一加速器或在同一 FPGA 上使用不同的加速器。对 FPGA 接口的访问受到严格控制，以防止拒绝服务攻击，并且内存访问与授权页面隔离。此外，该项目还有助于 FPGA 状态保存以支持进程抢占。该奖项反映了 NSF 的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Field programmable gate arrays (FPGAs) have been extensively used in data centers to make their tasks run faster. Unlike conventional computers, FPGAs can be configured and/or programmed differently for different tasks and shared among multiple users, adding agility to cloud environments. However, this flexibility adds security risks. For example, if many users are sharing an FPGA, a malicious user can steal or corrupt other users’ data. The project’s novelties are developing novel ways to protect FPGAs from these harmful attacks. The project's broader significance and importance are making cloud computing safer and easier to use and promoting education and research in FPGA security. This project aims to address FPGA security concerns by introducing novel approaches that prevent attacks compromising user data, causing corruption or physical damage to the data center. By implementing secure operating mechanisms, controlled sharing of FPGAs among multiple users is made possible. A security and queue management unit (SQMU) are embedded within the FPGA to maintain process isolation and allow secure sharing without sacrificing performance and energy efficiency. The proposed structure enables multiple applications to securely share the same accelerator or utilize different accelerators on the same FPGA. Access to FPGA interfaces is tightly controlled to prevent denial-of-service attacks, and memory access is isolated to authorized pages. Additionally, the project contributes to FPGA state saving to support process preemption.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.