An FPGA Architecture for ASIC-FPGA Co-Design to Streamline Processing of IDSs

Transcription

1 2016 International onference on ollaboration Technologies and Systems An FPGA Architecture for ASI-FPGA o-design to Streamline Processing of IDSs Tomoaki Sato Sorawat hivapreecha, Phichet Moungnoul Kohji Higuchi omputing and Networking Dept. of Telecommunications Engineering Graduate School of enter Faculty of Engineering Informatics and Engineering Hirosaki University KMITL UE Hirosaki, Japan Bangkok, Thailand hofu, Japan {sorawat, Abstract Novel methods for unauthorized access are always made. For cyber security measures in mobile devices, low-power and high-speed processing is very important. Despite these situations, a PU for mobile devices is a very low processing capacity in order to focus on low-power operations and does not have sufficient performance for processing detection processing for unauthorized access. In contrast, a field-programmable gate array (FPGA) can apply to cyber security processing on mobile devices. By using the FPGA, cyber security processing is able to use parallel processing, super pipeline and processing that is independent of a word width size. However, the FPGA has a problem that the delay times of arithmetic circuits are longer than that of an application specific integrated circuit (ASI) or PU. In this paper, the authors propose an FPGA architecture for ASI-FPGA co-design for addressing the problem. In order to evaluate the architecture, adders are enhanced by ASI-FPGA codesign and evaluated. As a result, it is shown that the problem with the delay times of arithmetic circuits is solved. Keywords-ASI-FPGA co-design; FPGA; ASI; IDS; mobile devices; RTL I. INTRODUTION yber security measures for mobile devices are very important [1]-[3]. The mobile devices are used in a variety of network environments such as a public Wi-Fi LAN service. In these environments, most of the monitoring of networks using an intrusion detection system (IDS) or intrusion prevention system (IPS) is not running. Additionally, users who use the network can hardly be identified. That is, the users may be attacked by a user who uses the same network. On the other hand, a personal computer (P) to be used at home uses a private address. The network is used only for a specific user. A P to be used in an organization has been monitored by the IDS or IPS and has been guarded by a firewall. The users of the network are identified by the authentication system. Therefore, security measures of mobile devices should be reinforced more than that of Ps or servers. When the IDS has detected unauthorized access, the IPS or next-generation firewall which has IDS functions to be shut off its communications. If false detection rate of the IPS or next-generation firewall is not 0%, it would stop normal communications. In order to improve the detection accuracy, a firewall policy for operating the IPS was studied []. However, it is not 0%. False positives and false negatives happen to every intrusion detection [5]. In order to solve the problem, to use machine learning [6], [7] led to improvement in the detection rate. Because these are network-based IDSs, power consumption of them is not as important as that of an IPS for mobile devices. In [8], the throughput of 12.9 Gbps was achieved by using an FPGA. Therefore, conventional FPGAs are suitable for developing the network-based IPS or next-generation firewall. In fact, they were used in commercial-based next-generation firewall [9]. Processing for unauthorized access detections in a mobile device cannot be executed on the PU for the mobile device. Because mobile devices need low-power operations due to the power supply by a battery, the capacity of the PU is much lower than that of PUs for Ps. In addition, processing using a PU has a large proportion of a transfer process between memory and registers. In order to solve these problems, it should be executed on a dedicated circuit. As to prevent unauthorized access on mobile devices, the authors have proposed the IDS or IPS on a field-programmable gate array (FPGA) [10]. The FPGA allows for parallel processing, super pipeline, processing that does not depend on a word width size like an application specific integrated circuit (ASI). Because it has a feature that can be re-configured, circuits for a new detecting process for unauthorized access can be added. This is very important because different unauthorized access methods are developed every day. Nevertheless, FPGAs have problem that the delay times of arithmetic circuits are longer than that of an ASI or PU. Also in terms of power consumption, the FPGA is a disadvantage than the ASI. Because the of the FPGA determines the specifications of the FPGA device, it dedicated to such IDS or IPS has not been realized. In other words, IDS or IPS designers cannot choose the architecture of a PU that is mounted on the FPGA device /16 $ IEEE DOI /TS

2 In this paper, the authors propose an FPGA architecture for ASI-FPGA co-design. This is achieved by using FPGAs designed by the RTL design methodology. The problem with the delay times of arithmetic circuits is solved by that they are configured on the ASI. Furthermore, a circuit which does not need to be changed can also be constructed on it. In this study, adders of the ASI are developed in the FPGA with 0.18m - MOS technology. The adders are evaluated for delay times. As a result, it is clarified that the problem with the delay times of arithmetic circuits on the FPGA can be solved. This paper is organized as follows. In Section II, the FPGA architecture for ASI-FPGA co-design is described. Adders on the FPGA are developed in Section III and the evaluations are done in Section IV. In Section V, the conclusions are made. II. FPGA ARHITETURE FOR ASI-FPGA O-DESIGN In this section, details of the FPGA architecture for ASI- FPGA co-design that the authors have developed are explained. Then, the portion of FPGAs in the architecture are described. The biggest feature of the FPGAs is developed through the RTL design methodology. Figure 1 shows the FPGA architecture for ASI-FPGA codesign. The FPGA architecture is composed of logic blocks (LBs) of Figure 2, switch blocks (SBs) of Figure 3, connection blocks (Bs) of Figure 4 and ASIs. The LB is also used in a conventional FPGA. The FPGA can be developed by the RTL design methodology [11]. However, the SB and B of the conventional FPGA are developed with a switch that is a transistor and their structures are different from Figure 3 and 4. The feature of this architecture is that it is possible to dispose an ASI anywhere. The feature of the FPGA is to be described it by using HDL like VHDL or Verilog HDL. These reasons facilitate ASI-FPGA co-design. The Bs are used for the connection between the ASI and the FPGA in Figure 1. This connection method facilitates replacing circuits composed by LBs with the ASI. If the ASI has a lot of ports, not only Bs but also SBs can be used. From the viewpoint of reducing the area, it is possible to connect LBs and the ASI directly. The logic synthesis results of Figure 2 are shown in Figure 5. The design environments of Table I are used for these logic synthesis. onstraints are not used. TABLE I. OS PU Memory Logic synthesis Technology Standard cell library DESIGN ENVIRONMENTS FOR ASIS AND THE FPGA ent OS 5.9 x86 Intel ore 2 Duo E6600 (2.4GHz) 2 GBytes Synopsys Design ompiler H SP2 Rohm 180 nm -MOS The library provided by Rohm X[0] (Selector) Flip-flop F X[3] X[2] X[1] 3-Input LUT D Q lock Figure 2. Structure of the LB. A B Figure 1. FPGA Architecture for ASI-FPGA o-design. Figure 3. Structure of the SB. 413

3 A B X3 X2 F X1 Figure 4. Structure of the B. III. DESIGNING ADDERS ON THE FPGA The structure of a 4-bit adder on the FPGA by ASI-FPGA o-design is shown in Figure 6. In this study, input and output ports of the adders are connected to LBs. Table II is the logic synthesis results of adders on the FPGA by ASI-FPGA codesign and obtained by the design environments of Table I. Almost all they are not used constraints and based on a ripplecarry adder (RA), except 4-bit adders. The maximum delay time of one of the 4-bit adders is longer than that of the 8-bit adder. Then, the 4-bit adder has the constraint which is a time of half of the 8-bit adder. The two 4-bit adders are shown in Figure 7. Figure 5. Structure of 4-bit adder on the FPGA by ASI-FPGA o- Design. TABLE II. LOGI SYNTHESIS RESULTS OF ADDERS ON THE FPGAS BY ASI-FPGA O-DESIGN Word width Max. delay times Area Max. delay times in ASIs onstraint conditions for ASIs 4 but 5.38 ns um ns None 4 bit 3.39 ns um ns Max. delay time < 1.04 ns 8 bit 4.44 ns um ns None 16 bit 6.49 ns um ns None 32 bit ns um ns None 64 bit ns um ns None 414

4 Figure 6. Logic synthesis results of the LB. (a) (b) Figure 7. Logic synthesis results of 4-bit adders for ASI-FPGA o-design (a) No constraints (b) With a delay time constraint. 415

5 IV. EVALUATIONS omparison results of throughputs in 4-bit adders are shown in Figure 8. The 4-bit adder of ASI-FPGA co-design is synthesized in the constraint of the delay time. The adder on the PLD is designed by using the design environment of Table 3. Figure 9 shows the word width versus maximum delay times for adders on the FPGA by ASI-FPGA co-design, the ASI or the PLD. The logic synthesis of these adders does not have a constraint of a delay time. According to the results, the delay time of 64-bit adder on the FPGA is longer than that of the PLD. However, it can be greatly reduced by attaching the constraint on the maximum delay time. 300 Figure 9. The word width vs. maximum delay times for adders. 250 Operating Frequency [MHz] V. ONLUDING REMARKS In order to realize IDS processing for high-speed and lowpower operations, FPGAs designed by the RTL design methodology have been proposed. Although the FPGAs are very beneficial for high-speed packet processing, a processing speed of arithmetic circuits is very slow. In this paper, the FPGA architecture for ASI-FPGA co-design has been proposed for improvement of processing speed of arithmetic circuits. According to the results of evaluations, the architecture was revealed to contribute to the improvement of processing speed. In future works, the architecture will be fabricated to a chip and evaluated by measurement. 0 4-bit adder on the PLD 4-bit RA as the FPGA as an FPGA [5] Figure 8. Throughputs in 4-bit adders. 4-bit adder on the FPGA by ASI-FPGA co-design AKNOWLEDGMENT This work has been supported in part by VLSI Design and Education enter (VDE), the University of Tokyo in collaboration with Synopsys, Inc., Rohm orporation and Toppan Printing orporation and KAKENHI Grant Numbers and 16K TABLE III. DESIGN ENVIRONMENTS FOR THE PLD OS Windows 10 Pro 64-bit PU Intel ore i7 Q GHz Memory 8 GBytes Logic synthesis Altera Quartus II bit PLD Altera MAXII EPM2210F324I5 REFERENES [1] A. Lupia and F. D. Rango, "Trust management using probabilistic energyaware monitoring for intrusion detection in mobile ad-hoc networks," in Proc Wireless Telecommunications Symposium (WTS), pp. 1-6, [2]. Fachkha and M. Debbabi, "Darknet as a Source of yber Intelligence: Survey, Taxonomy, and haracterization," IEEE omm. Surveys & Tutorials, vol. 18, no. 2, pp , [3] R. Mitchell and I.-R. hen, "Effect of Intrusion Detection and Response on Reliability of yber Physical Systems," IEEE Trans. Reliability, vol. 62, no. 1, pp , [4] M. Q. Ali, E. Al-Shaer and T. Samak, Firewall Policy Reconnaissance: Techniques and Analysis, IEEE Trans. Information Forensics and Security, vol. 9, no. 2, pp , [5].-Y. Ho, Y.-. Lai, I.-W. hen, F.-Y. Wang and W.-H. Tai, "Statistical Analysis of False Positives and False Negatives from Real Traffic with Intrusion Detection/Prevention Systems,"IEEE ommunications Mag., vol. 50, no. 3, pp ,

6 [6] Q. A. Tran, F. Jiang and J. Hu, "A Real-Time NetFlow-based Intrusion Detection System with Improved BBNN and High-Frequency Field Programmable Gate Arrays," in Proc. the 2012 IEEE 11th International onference on Trust, Security and Privacy in omputing and ommunications, pp , [7] J. D. Ndibwile, A. Govardhan, K. Okada and Y. Kadobayashi, "Web Server Protection against Application Layer DDoS Attacks Using Machine Learning and Traffic Authentication," in Proc IEEE 39th Annual omputer Software and Applications onference, Vol. 3, pp , [8] A. Mitra, W. Najjar and L. Bhuyan, "ompiling PRE to FPGA for Accelerating SNORT IDS," in Proc. the 3rd AM/IEEE Symposium on Architecture for networking and communications systems, pp , [9] Palo Alto Networks, "PAN-OS Administrator's Guide," (Sept. 11, 2016). [10] T. Sato and M. Fukase, "Reconfigurable Hardware Implementation of Host-Based IDS," in Proc. the 9th Asia-Pacific onference on ommunication, vol. 2, pp , [11] T. Sato, S. hivapreecha, P. Moungnoul and K. Higuchi, RA on FPGAs Designed by the RTL Design Methodology and Wave-Pipelined Operation, Proc. of ETI-ON 21016, pp ,