CAREER: Towards the Security of Heterogeneous CPU-FPGA Systems

随着高性能计算需求的快速增长，传统的基于中央处理器(CPU)的计算系统已经部署了现场可编程门阵列(FPGA)组件来实现硬件加速，例如在新兴的CPU-FPGA云系统中。尽管具有显著的性能优势，但CPU-FPGA体系结构通过两个异类组件之间的通信引入了新的攻击面。该项目开发了一个基于硬件隔离的安全框架来消除新的攻击面，一个编程工具包来促进安全的CPU-FPGA系统的开发，以及一套用于评估目的的CPU-FPGA基准应用程序。该项目涉及三项研究活动。首先，它开发了一个硬件安全框架，该框架通过总线级硬件隔离实现了与FPGA兼容的容器，并利用近似计算和旁路分析来实现高效的安全验证策略。其次，它提供了一个编程工具包，该工具包使用动态程序切片将CPU和FPGA作业自动划分到硬件隔离环境中，以及使用动态调度的性能和资源优化方案。第三，它生成了一组具有代表性的CPU-FPGA基准测试，涵盖安全多媒体系统、金融安全和隐私保护科学计算，以评估CPU-FPGA系统的安全性和性能。该项目将从几个方面产生更广泛的影响。首先，它将使新课程设计和暑期实习计划等综合教育活动能够吸引本科生从事网络安全研究。其次，鉴于CPU-FPGA云的日益普及，它将以强大的安全保障和较短的学习曲线造福于许多研究领域。第三，CPU-FPGA基准有可能实现行业扩展并产生现实世界的影响。此外，该项目将把硬件安全、软件工程和科学计算领域转变为共同支持异类体系结构的新前沿，推动跨学科的网络安全研究。项目库将存储在内布拉斯加州大学林肯分校(http://cse.unl.edu/~swei/projects/hisa).)的可公开访问的服务器上所有项目数据将在资助期结束后保留至少5年。这一奖励反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

With the rapidly growing demand of high performance computations, the traditional central processing unit (CPU)-based computing systems have been deployed with field programmable gate array (FPGA) components for hardware acceleration, such as in the emerging CPU-FPGA cloud systems. Despite the significant performance benefits, the CPU-FPGA architecture introduces new attack surfaces through the communications between the two heterogeneous components. This project develops a hardware isolation-based security framework to eliminate the new attack surfaces, a programming toolkit to facilitate the development of secure CPU-FPGA systems, as well as a set of CPU-FPGA benchmark applications for evaluation purposes. The project involves three research activities. First, it develops a hardware security framework that achieves FPGA-compatible containers enabled by bus-level hardware isolation, together with efficient security verification policies leveraging approximate computing and side channel analysis. Second, it delivers a programming toolkit that automatically partitions the CPU and FPGA jobs into the hardware isolation environment using dynamic program slicing, as well as a performance and resource optimization scheme employing dynamic scheduling. Third, it generates a representative set of CPU-FPGA benchmarks spanning secure multimedia systems, financial security, and privacy-preserving scientific computing to evaluate the security and performance of the CPU-FPGA systems. The project will generate broader impacts from several aspects. First, it will enable comprehensive education activities such as new curriculum design and summer internship programs attracting undergraduate students to cybersecurity research. Second, it will benefit many fields of studies with strong security guarantees and short learning curves given the growing popularity of CPU-FPGA cloud. Third, the CPU-FPGA benchmarks have the potential of enabling industrial outreach and generating real world impacts. Furthermore, the project will transform the fields of hardware security, software engineering, and scientific computing to the new frontier of jointly supporting heterogeneous architectures, motivating interdisciplinary cybersecurity research. The project repository will be stored on a publicly accessible server at the University of Nebraska-Lincoln (http://cse.unl.edu/~swei/projects/hisa). All the project data will be maintained for at least 5 years following the end of the grant period.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.