SaTC: CORE: Small: Emerging Security Challenges and a Solution Framework for FPGA-accelerated Cloud Computing

现场可编程门阵列（fpga）已广泛应用于数据中心，使其任务运行速度更快。与传统计算机不同，fpga可以针对不同的任务进行不同的配置和/或编程，并在多个用户之间共享，从而增加了云环境的灵活性。然而，这种灵活性增加了安全风险。例如，如果许多用户共享一个FPGA，恶意用户可以窃取或破坏其他用户的数据。该项目的创新之处在于开发新的方法来保护fpga免受这些有害的攻击。该项目更广泛的意义和重要性是使云计算更安全、更容易使用，并促进FPGA安全方面的教育和研究。该项目旨在通过引入新颖的方法来解决FPGA安全问题，防止攻击危及用户数据，导致数据中心损坏或物理损坏。通过实现安全的操作机制，fpga在多个用户之间的可控共享成为可能。在FPGA中嵌入了安全和队列管理单元（SQMU），以保持进程隔离，并在不牺牲性能和能效的情况下实现安全共享。所提出的结构使多个应用能够安全地共享相同的加速器或在同一FPGA上使用不同的加速器。对FPGA接口的访问受到严格控制，以防止拒绝服务攻击，并且内存访问与授权页面隔离。此外，该项目有助于FPGA状态保存，以支持进程抢占。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Field programmable gate arrays (FPGAs) have been extensively used in data centers to make their tasks run faster. Unlike conventional computers, FPGAs can be configured and/or programmed differently for different tasks and shared among multiple users, adding agility to cloud environments. However, this flexibility adds security risks. For example, if many users are sharing an FPGA, a malicious user can steal or corrupt other users’ data. The project’s novelties are developing novel ways to protect FPGAs from these harmful attacks. The project's broader significance and importance are making cloud computing safer and easier to use and promoting education and research in FPGA security. This project aims to address FPGA security concerns by introducing novel approaches that prevent attacks compromising user data, causing corruption or physical damage to the data center. By implementing secure operating mechanisms, controlled sharing of FPGAs among multiple users is made possible. A security and queue management unit (SQMU) are embedded within the FPGA to maintain process isolation and allow secure sharing without sacrificing performance and energy efficiency. The proposed structure enables multiple applications to securely share the same accelerator or utilize different accelerators on the same FPGA. Access to FPGA interfaces is tightly controlled to prevent denial-of-service attacks, and memory access is isolated to authorized pages. Additionally, the project contributes to FPGA state saving to support process preemption.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.