Reconfigurable Architectures and Design Automation Tools for Application-Level Network Security

Book excerpt: The relevance of the Internet has dramatically grown in the past decades. However, the enormous financial impact attracts many types of criminals. Setting up proper security mechanisms (e.g., Intrusion Detection Systems (IDS)) has therefore never been more important than today. To further compete with today's data transfer rates (10 to 100 Gbit/s), dedicated hardware accelerators have been proposed to offload compute intensive tasks from general purpose processors. As one key technology, reconfigurable hardware architectures, e.g., the Field Programmable Gate Array (FPGA), are of particular interest to this end. This work addresses the use of such FPGAs in the context of interactive communication applications, which goes beyond the regular packet level operations often seen in this area. To support rapid prototyping, a novel FPGA platform (NetStage) has been designed and developed, which provides a communication core for Internet communication and a flexible connection bus for attaching custom applications modules. A hardware honeypot (the MalCoBox) has been set up as a proof-of-concept application. Furthermore, to address the ongoing issue of hardware programming complexity, the domain-specific Malacoda language for abstractly formulating honeypot packet communication dialogs is presented and discussed. An associated compiler translates Malacoda into high-performance hardware modules for NetStage. Together, NetStage and Malacoda address some of the productivity deficiencies often recognized as major hindrances for the more widespread use of reconfigurable computing in communications applications. Finally, the NetStage platform has been evaluated in a real production environment.