CNS Core: Small: A Hardware/Software Infrastructure for Secured Multi-Tenancy in FPGA-Accelerated Cloud and Datacenters

随着基于云的计算资源在全球范围内的使用越来越多，比以往任何时候都更需要高效、可靠、安全和节能的计算中心。为了科普社交媒体、内容流、银行、购物和高性能计算的多样化需求，数据中心必须适应异构架构以科普计算的多功能性。FPGA器件最近被引入云基础设施中，为人工智能、成像、高性能和密码学等关键应用提供加速，同时降低功耗。不幸的是，目前的云计算提供商仍然将整个FPGA分配给单个客户，这导致利用率不足，功耗和成本增加。主要原因是缺乏安全稳定的方法来实现多个云租户之间的FPGA资源共享，其中许多租户可能是恶意的。该项目旨在通过提供多用户之间有效共享FPGA设备的架构和机制，解决FPGA加速云和云中心中的多租户问题。具体来说，研究人员将设计和实施1）硬件和软件虚拟化技术，用于将相同硬件的部分集成到云虚拟机管理程序中，2）基于NSA开发的Flux高级安全内核（FLASK）的隔离框架，以将域分离从软件线程和虚拟机扩展到配置的硬件加速器，3）硬件资源的时空管理方法，从准入控制到FPGA器件上的执行。由此产生的云管理框架将提供给学校、学院、社区和商业实体，以促进采用包含FPGA的异构云基础设施。虽然安装在佛罗里达大学的20节点FPGA加速云将在整个项目中用作测试平台，但它也将作为开发新课程并为校内和校外学生提供培训的工具。在这方面，调查人员将加大努力，招募和参与利用现有资源，如乔治华盛顿卡弗研究计划和佛罗里达州-加勒比路易斯斯托克斯地区卓越中心的代表性不足的群体。这个奖项反映了NSF的法定使命，并已被认为是值得通过评估使用基金会的智力价值和更广泛的影响审查标准的支持。

With increasing world-wide use of cloud-based computing resources it is more than ever necessary to have efficient, reliable, secured, and power-efficient datacenters. In order to cope with the versatile demand in social media, content streaming, banking, shopping, and high-performance computation, data centers must accommodate heterogeneous architectures to cope with the versatility in computing. FPGA devices have been recently introduced in cloud infrastructure to provide acceleration for critical applications in artificial intelligence, imaging, high-performance, and cryptography, with reduced power consumption. Unfortunately, current cloud providers are still assigning entire FPGAs to single customers, which leads to underutilization and increases in power consumption and costs. The primary reason is the lack of secured and stable approaches to enable the sharing of FPGA-resources among multiple cloud tenants, many of whom could be malicious.This project aims at addressing the problem of multi-tenancy in FPGA-accelerated clouds and datacenters by providing the architecture and mechanisms for the efficient sharing of FPGA devices among multiple users. Specifically, the investigators will design and implement 1) hardware and software virtualization technologies for the integration of segments of the same hardware into cloud hypervisors, 2) isolation framework based on the NSA-developed Flux Advanced Security Kernel (FLASK) to extend domain separation from software threads and virtual machines down to provisioned hardware accelerators, and 3) temporal and spatial management approaches of the hardware resources, from the admission control to the execution on the FPGA device. The resulting cloud management framework will be made available to schools, colleges, communities and commercial entities to facilitate the adoption of heterogeneous cloud infrastructure that incorporates FPGAs. While the 20-node FPGA-accelerated cloud installed at the University of Florida will be used as testbed throughout the project, it will also serve as a vehicle to develop new classes and provide training to students, both on and off-campus. In this regard, the investigators will increase efforts to recruit and engage under-represented groups using existing resources such as the George Washington Carver Research program and the Florida-Caribbean Louis Stokes Regional Center of Excellence.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.