CAREER: Towards the Security of Heterogeneous CPU-FPGA Systems

随着高性能计算需求的快速增长，传统的基于中央处理器（CPU）的计算系统已经部署了现场可编程门阵列（FPGA）组件来实现硬件加速，例如在新兴的CPU-FPGA云系统中。尽管具有显著的性能优势，CPU-FPGA架构通过两个异构组件之间的通信引入了新的攻击面。该项目开发了一个基于硬件隔离的安全框架，以消除新的攻击面，一个编程工具包，以促进安全CPU-FPGA系统的开发，以及一套CPU-FPGA基准应用程序的评估目的。该项目包括三项研究活动。首先，它开发了一个硬件安全框架，通过总线级硬件隔离实现fpga兼容容器，以及利用近似计算和侧信道分析的有效安全验证策略。其次，它提供了一个编程工具包，使用动态程序切片将CPU和FPGA作业自动划分到硬件隔离环境中，以及采用动态调度的性能和资源优化方案。第三，生成了一组具有代表性的CPU-FPGA基准测试，涵盖安全多媒体系统、金融安全和隐私保护科学计算，以评估CPU-FPGA系统的安全性和性能。该项目将从几个方面产生更广泛的影响。首先，通过新课程设计和暑期实习等综合教育活动，吸引大学生参与网络安全研究。其次，随着CPU-FPGA云的日益普及，它将以强大的安全性保证和短的学习曲线受益于许多领域的研究。第三，CPU-FPGA基准具有实现工业扩展和产生现实世界影响的潜力。此外，该项目将把硬件安全、软件工程和科学计算领域转变为共同支持异构架构的新前沿，推动跨学科网络安全研究。项目存储库将存储在内布拉斯加大学林肯分校的一个可公开访问的服务器上（http://cse.unl.edu/~swei/projects/hisa）。所有项目数据将在资助期结束后至少保存5年。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

With the rapidly growing demand of high performance computations, the traditional central processing unit (CPU)-based computing systems have been deployed with field programmable gate array (FPGA) components for hardware acceleration, such as in the emerging CPU-FPGA cloud systems. Despite the significant performance benefits, the CPU-FPGA architecture introduces new attack surfaces through the communications between the two heterogeneous components. This project develops a hardware isolation-based security framework to eliminate the new attack surfaces, a programming toolkit to facilitate the development of secure CPU-FPGA systems, as well as a set of CPU-FPGA benchmark applications for evaluation purposes. The project involves three research activities. First, it develops a hardware security framework that achieves FPGA-compatible containers enabled by bus-level hardware isolation, together with efficient security verification policies leveraging approximate computing and side channel analysis. Second, it delivers a programming toolkit that automatically partitions the CPU and FPGA jobs into the hardware isolation environment using dynamic program slicing, as well as a performance and resource optimization scheme employing dynamic scheduling. Third, it generates a representative set of CPU-FPGA benchmarks spanning secure multimedia systems, financial security, and privacy-preserving scientific computing to evaluate the security and performance of the CPU-FPGA systems. The project will generate broader impacts from several aspects. First, it will enable comprehensive education activities such as new curriculum design and summer internship programs attracting undergraduate students to cybersecurity research. Second, it will benefit many fields of studies with strong security guarantees and short learning curves given the growing popularity of CPU-FPGA cloud. Third, the CPU-FPGA benchmarks have the potential of enabling industrial outreach and generating real world impacts. Furthermore, the project will transform the fields of hardware security, software engineering, and scientific computing to the new frontier of jointly supporting heterogeneous architectures, motivating interdisciplinary cybersecurity research. The project repository will be stored on a publicly accessible server at the University of Nebraska-Lincoln (http://cse.unl.edu/~swei/projects/hisa). All the project data will be maintained for at least 5 years following the end of the grant period.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.