Hardware-Based IPS for Embedded Systems

Transcription

1 Hardware-Baed IPS for Embedded Sytem Tomoaki SATO, C&C Sytem Center, Hiroaki Univerity Hiroaki Japan Shuya IMARUOKA and Maa-aki FUKASE Graduate School of Science and Technology, Hiroaki Univerity Hiroaki Japan ABSTRACT Some embedded ytem are ued with the Internet. In that cae, protection from unauthorized computer acce or attack i required, and the olution by oftware i difficult. Additionally, the olution with hardware ha limitation of conumption of power and hardware reource. In thi paper, Hardware-Baed IPS (Intruion Prevention Sytem) for Embedded Sytem i propoed. The IPS i compoed of Firewall Unit and DoS Attack Detection Unit. Power conumption of the IPS i reduced by Firewall Unit and wave-pipelining. Proceing peed of Firewall Unit and DoS Attack Detection Unit i evaluated. The reult how that they are able to correpond to Gigabit Ethernet. Keyword: IPS, Embedded Sytem, Firewall Unit, Wave-Pipelining 1. INTRODUCTION Variou embedded ytem are ued with the Internet connection. Connecting an embedded ytem with computer network enable it control and obervation from a remote place. Example of uing it are a recording reervation of a televiion program from a detination and obervation of a houe for ecurity, etc. Connecting an embedded ytem to computer network need to olve problem on network ecurity and it i very difficult. The low-power operation and the miniaturization of the embedded ytem are demanded. Baically, it i compoed by a low-peed CPU and a mall amount of memory. Therefore, Security oftware which i like anti-viru oftware or HIPS (Hot-baed Intruion Prevention Sytem) oftware cannot be ued on the embedded ytem. A mobile phone i generated in thi problem. In thi paper, the author propoe a HIPS for embedded ytem. The HIPS operate by mall circuit and low-power conumption. It i compoed by Firewall Unit and DoS Attack Detection Unit. Firewall Unit i needed for protecting unauthorized acce, reduction of detection circuit, and power control of the HIPS. Becaue a low-peed CPU cannot operate normally while having received DoS Attack, DoS Attack Detection Unit i epecially needed in the embedded ytem. Becaue ome embedded ytem ue FPGA, the author ue FPGA for development of HIPS circuit. 2. HIPS FOR EMBEDDED SYSTEMS Operation of IPS or IDS (Intruion Detection Sytem) [1] without a problem i indipenable to prevent information leakage or illegal operation. Conventional IPS and IDS are claified into network-baed and hot-baed depend on place where the ytem i et up and have following problem. Hot-baed IPS (HIPS) and Hot-baed IDS (HIDS) They conume CPU power and electric power of buttery by detection proceing. Network-baed IPS (NIPS) and Network-baed IDS (NIDS) They are not able to detect unauthorized computer acce that occur between computer in LAN. They are hard to proce all the packet analye with the increae of the amount of packet. A high performance computer i needed for them and expenive. In addition, intallation of IPS or IDS on an embedded ytem uch a a mobile phone and a PDA i difficult. A CPU of the embedded ytem operate more low-peed than PC and ultra low-power

2 conumption. And an old or low-peed PC ha a imilar problem. To olve thee problem, we have developed and H-HIPS (Hardware-baed HIPS) and H-HIDS (Hardware-baed HIDS) [2]. H-HIPS furnihing the function of both NIPS and HIPS i logic-baed HIPS achieved by FPGA (Field programmable gate array). Thi i reconfigurable hardware. Baic algorithm of conventional HIPS have been made ue of to the Netlit of FPGA. In deigning H-HIPS, we aim to achieve more advantageou feature with le power than conventional HIPS. However, H-HIPS i not applicable in an embedded ytem. The reaon i a follow. Power conumption of an embedded ytem i limited more than that of a PC. The pace of a proceor i limited. H-HIPS for Embedded Sytem which i hown in Fig. 1 i H-HIPS to olve thee problem. The IPS i compoed of Firewall Unit and DoS Attack Detection Unit. Power conumption of the IPS i reduced by Firewall Unit and wave-pipelining. multifunctional wave-pipeline, a wave-pipelined ALU ha recently appeared [6]-[9]. Then, a microproceor developed by uing wave-pipeline in part appeared [10]. It i 14-egment ULTRASPARC-III whoe econd and third intruction fetch egment have been wave-pipelined. Another example i an aynchronou wave-pipeline, though it i not compatible with conventional proceor. Wave-pipelined LFSR (Linear Feedback Shift Regiter) that i a equential circuit had not been achieved [5]. Circuit for CRC proceing and peudorandom number generation of WEP i required and alway operate in H-HIPS. They are compoed of LFSR circuit. Becaue LFSR circuit have a lot of regiter, deign for low-power and high-peed i indipenable. Therefore, we have developed wave-pipelined LFSR circuit. A reult, we have clarified that wave-pipelined LFSR circuit archive coexiting of low-power and high-peed operation [11]. NIC FPGA Ethernet Cable RJ-45 Connector Ethernet Controller NIOS CPU Function Clock Wave- Control Pipelined Firewall Unit DoS Attack Detection Unit Clock (a) Stage 1 Stage 2 Stage 2 Fig. 1 H-HIPS for Embedded Sytem regiter Critical path regiter 3. WAVE PIPELINING (b) Not only high clock frequency but alo low power diipation can be obtained at the ame time by wave-pipelining [3]-[5]. It exploit high throughput combinational logic block in which a many a data are launched unle they conflict. Although wave-pipelining wa attempted to the entire region of a proceor, it wa viewed peimitically becaue it require removing general regiter a well a pipeline regiter from proceor. It eem hard to eliminate general regiter playing fundamental role in equential circuit. The inufficient power of CAD tool o far developed i another reaon why wave-pipeline have been applied out of proceor. Accordingly, deign and evaluation method for wave-pipeline have not yet etablihed well compared with thoe for conventional pipeline. Motly wave-pipeline have been o far applied to imple unifunctional circuit uch a adder, multi-plier, counter, and DRAM. Regarding Fig. 2 Synchronization of pipeline (a) Wave-pipeline. (b) Conventional pipeline. Logic depth D MAX -path D MIN -path Time TCK D MAX + T OV Fig. 3 Wave model of Fig. 2 (a).

3 The ignal path of combinational circuit i uneven of delay time. The mot high-peed ignal in one group in a clock ha the poibility to collide with the low ignal in jut before clock. The problem wa olved to wave-pipelined combinational circuit hown in Fig. 2 (a) by the delay time of all ignal path i brought cloe at the delay time of critical path. The relation between the clock cycle and delay i obtained a follow [5]. T CK > ( D MAX - D MIN ) + T OV (1) Here, T CK : Clock cycle time T OV : Overhead time From Eq. (1), D MAX - D MIN hould be cloe to 0 a much a poible in order to obtain minimum T ck. One of olution to atify thi requirement can be conceived from Fig. 3 that how relation between time and logical depth. 100 MHz operation are confirmed. TABLE I CONTROLLED PORTS Function Port Number Binary NOP SMTP DNS HTTP POP HTTPS TABLE II DEVELOPMENT ENVIRONMENT OF FIREWALL UNIT CPU Intel Core 2 Duo E6600 (2.4GHz) Memory 2G Byte OS Micorooft Window XP Pro. SP3 Logic ynthei Altera Quartu II V FIREWALL UNIT Simulator Mentor Graphic ModelSim Altera 6.1g FPGA Device Altera Cyclone EP1C20F400C7 Fig. 4 how the outline of the firewall for H-HIPS [12]. In thi work, the controlled port are for uing a mobile computing, and they are at leat needed. Table I i the controlled port. Becaue the firewall unit i developed by FPGA, the change of port i very eay. Fig. 5 how yntheized circuit by uing development environment of Table II. Maximum delay time of the circuit i 17.9 n. The circuit can operate at 50 MHz by conventional operation. And, Minimum delay time i 12.3 n. According to Eq. (1), they can operate at 100MHz by wave-pipelined operation. The gate-level imulation are executed for confirming wave-pipelined operation. Fig. 6 how conventional operation and Fig. 7 how wave-pipelined operation. According to the reult of Fig. 7, Fig. 5 Firewall Unit. 20 n Fig. 4 Firewall for H-HIPS. Fig. 6 Conventional Operation (50MHz).

4 10 n 20 n START Initialization Timer=0; Data Sum=0; Timer tart Data Sum=Data Sum + Data length Fig. 7 Wave-Pipelined Operation (100MHz). 5. DOS ATTACK ANALYSIS UNIT no Set value < Timer ye Packet to client computer Timer=0; Data Sum=0; Set value < Data Sum no Detection of DoS Attack Notification of Max_IP,Max_DL Prevention of Do Attack END ye DoS attack end a large amount of packet to a computer, and it give the computer an over load. A a reult, the computer loe function. The ue of anti-viru oftware i one of the olution for protecting DoS attack. However, the protection of uing oftware conume CPU and memory reource. To olve thi problem, we propoe to build H-HIPS into Do Attack Analyi Unit [13]. The unit i compoed of FPGA a well a other analye and protecting unit. We develop the unit by uing the development environment hown in Table III. TABLE III DEVELOPMENT ENVIRONMENT OF DOS ATTACK ANALYSIS UNIT Platform Microoft Window 2000 CPU Intel Pentium III (1GHz) Main Memory 512 MByte CAD Altera Quartu II FPGA Altera Cyclone EP1C20F400C7 To protect Do attack, the unit need a ender IP addre and the number of packet. Becaue Do attack give a load to a computer by a great deal of packet of hort time, Do attack i judged by the number of packet each unit time. The flow chart of Do Attack Analyi Unit i hown in Fig, 8 and the hardware tructure i hown in Fig. 9. We imulate circuit of Fig. 9 at the gate level. Reult of Stored Unit i hown in Fig.10 and Reult of Detecting Unit i hown Fig. 11. According to reult, 56.8 MHz operation i confirmed. Becaue word ize of Circuit of Do Attack Analyi Unit i 48 bit, the unit can correpond to 2.6Gbp. RESET 1 CLK1 IP Addre Data Length 16 From NioII Fig. 8 Flow chart of Do Attack Analyi Unite. Stored unit IP Addre Max Data Length R_RAM2 48 Detecting unit Data Control Detection ignal 1 IP Addre Max Data Length 16 Data SUM 16 To Protection unit Fig. 9 Hardware tructure of Do Attack Analyi Unit.

5 RESET CLK Write Enable IP Addre Data length R_A_1 IP Addre Data Length RAM1_OUT R_A_2 RAM2_OUT W_A_2 W_D_2 W_E_2 N_P Fig. 10 Simulation reult of Stored Unit. Non-DoS ThreholdData Sum= 700Byte RESET CLK W_E DataLeng thw_e_2 W_D_2 Data_Sum Div_5 Div_10 T_Time Detect Clear Max_DL Max_IP 200Byte 200Byte 200Byte ThrehouldTime = Threhold Time DoS RESET CLK W_E DataLength W_E_2 W_D_2 Data_Sum Div_5 Div_10 T_Time Detect Clear Max_DL Max_IP ThreholdData Sum= 500Byte 200Byte 200Byte 200Byte ThrehouldTime = Byte 500Byte 600Byte 400Byte 700Byte Max IP : Max DL: 400Byte Fig. 11 Simulation reult of Detecting Unit. 6. CONCLUDING REMARKS Thi paper ha decribed the propoal of H-HIPS for Embedded Sytem. The ytem i compoed of Firewall Unit and DoS Attack Detection Unit. Firewall Unit operate by wave-pipelining and it i ued for the clock control. Becaue the unit doe not have a regiter, it hardly conume electric power. And the clock peed of the unit correpond to Giga-bit Ethernet. DoS Attack Detection Unit i deigned by uing FPGA which i low-peed operation. However, according to the gate-level imulation, throughput of the unit i 2.6 GHz. Our future work are evaluation of power and performance at ytem-level.

6 ACKNOWLEDGMENT Thi work ha been upported in part by Grant-in-Aid for Young Scientit (B) ( ) from Minitry of Education, Culture, Sport, Science and Technology, Japan. of ISPACS 2008, pp , [13] Tomoaki Sato, Kazuhira Kikuchi, Syuya Imaruoka, and Maa-aki Fukae, "DoS Attack Analyi for H-HIPS," Proc. of IMETI, Vol. II, pp , REFERENCES [1] Keiji TAKEDA and Hirohi Iozaki, Network Intruion Detection, Soft Bank Pub., [2] T. Sato, R. Sakuma, D. Miyamori, and M. Fukae, Hardware Security-Embedded Wirele LAN Proceor, Proc. of ECTI-CON 2006, Vol. II, pp , [3] L. Cotton, Maximum rate pipelining ytem, Proc. AFIPS Spring Joint Computer Conference, pp , [4] F. Kla and M. J. Flynn, COMPARATIVE STUDIES OF PIPELINED CIRCUITS, Stanford Univerity Technical Report, No. CSL-TR , July [5] W. P. Burleon, M. Cieielki, F. Kla, and W. Liu, Wave-Pipelining: A Tutorial and Reearch Survey, IEEE Tran. on Very Large Scale Integration (VLSI) Sytem, Vol. 6, No. 3, pp , Sept [6] T. Sato, M. Fukae, and T. Nakamura, Performance analyi of a wave-pipelined ALU, Technical Report of IEICE, CPSY 2000, Vol. 100, No. 20, pp. 1-6, [7] M. Fukae, T. Sato, R. Egawa, and T. Nakamura, Scaling up of Wave Pipeline, THE FOURTEENTH INTERNATIONAL CONFERENCE ON VLSI DESIGN, Jun [8] M. Fukae, T. Sato, R. Egawa, and T. Nakamura, Breakthrough of Supercalar Proceor by Multifunctional Wave-Pipeline, Proc. of 9th NASA Sympoium on VLSI Deign, pp , Nov [9] M. Fukae, T. Sato, R. Egawa, and T. Nakamura, Deigning a Wave-Pipelined Vector Proceor, Proc. of the Tenth Workhop on Synthei and Sytem Integration of Mixed Technologie, pp , Oct [10] Tim Horel and Gary Lauterbach, UltraSPARC-III: Deigning Third-Generation 64-Bit Performance, IEEE Micro, Vol. 19, No. 3, pp , [11] T. Sato, R. Sakuma, D. Miyamori, and M. Fukae, Waved-LFSR Circuit for Hardware-baed Intruion Detection Sytem, Proc. of ECTI-CON2006, pp , [12] Tomoaki Sato, Syuya Imaruoka, and Maa-aki Fukae, Reconfigurable Firewall Unit by Wave-Pipelined Operation, proc.