The security of computer systems and networks is severely threatened today by the combination of novel attack patterns and high traffic volumes. Together, this often exceeds the capabilities of purely software-based network security systems. As an alternative, hardware acceleration has been employed, e.g., for performing deep-packet inspection and pattern matching as well as general packet-header processing. While such implementations, capable of handling lower protocol layers, have been extensively studied in research and industry, their extension to higher communication layers has only rarely been addressed. Such capabilities, including the application level (OSI Layer 7), are the focus of this work. We present the NetStage platform, employing reconfigurable computing for high-throughput low-latency network processing, as well as associated development tools that allow networking domain experts to easily customize the system. As a use-case, we consider the realization of high-performance attack-resilient honeypots based on NetStage. To this end, we introduce the Malacoda language, its programming tools, and the generated target microarchitecture. We then evaluate the performance of Malacoda-generated vulnerability emulation handlers running on the NetStage platform.

While the use of reconfigurable computing for tasks such as packet header processing or deep packet-inspection in high-speed networks has been widely studied, efforts to extend the technology to application-level processing have only recently been made. One issue that has prevented wider use of reconfigurable platforms in that context is the unfamiliar programming environment: Such systems commonly require expertise in computer architecture and digital logic design generally foreign to networking experts. To make the technology more accessible to potential users, we present the high-level domain-specific language Malacoda for application-level network processing and an associated compiler that automatically translates Malacoda descriptions into high-performance hardware blocks for insertion into an FPGA-based processing platform. We evaluate our approach on the use-case of a hardware-accelerated secure honeypot-in-a-box, programmed in Malacoda, and implemented on the NetFPGA 10G board. Results from a live-test of the system connected to a 10G Internet uplink complete the evaluation.

Ballooning traffic volumes and increasing link-speeds require ever high compute power to perform complex real-time processing of network packets. FPGAs have already been successfully employed in the past to accelerate network infrastructure-operations at these line-speed processing rates. However, much of the prior work concentrated on single-FPGA platforms. To this end, we have studied how to extend an architecture for 10G application-level network processing into a scalable multi-device system. We present a ring-based approach, of which a quad-FPGA implementation will be evaluated on the BEE cube BEE3 computing platform.

Side-channel attacks have changed the design of secure cryptographic systems dramatically. Several published attacks on implementations of well known algorithms such as, e.g., AES, show the need to consider these aspects to build more resistant cryptographic systems. On the other hand, with the increasing use of cryptography in embedded systems a significant demand exists for cryptographic algorithms that are both resource-and power-efficient. These can be either modified existing or completely new ones. One of the candidates for such a new algorithm is the Tree Parity Machine Public Key Exchange, an algorithm based on artificial neural networks. While it has been evaluated in a number of practical applications in the past, its side-channel resistance has not been examined yet. We would like to close this gap and present a side-channel attack strategy as well as results gathered from measurements made on a real implementation.

Honeypots present networked computer systems with known security flaws to attackers and can serve to collect the executable code (malware) aiming to exploit the vulnerability. We describe and evaluate the proof-of-concept NetStage Architecture for a high-speed honeypot realized in reconfigurable logic. Dedicated hardware accelerators for the different network processing and detection layers allow the honeypot to operate at full speed of a 10 Gb/s connection and project the illusion of thousands of vulnerable systems at once. Furthermore, compromising the honeypot itself is significantly more difficult than in software honeypots, since all processing is handled by specialized hardware blocks instead of general purpose processors.

With the growing diversity of malware, researchers must be able to quickly collect many representative samples for study. This is commonly achieved by harvesting the malware from honeypots: Insecure systems presenting a wide attack surface to the public Internet, aiming to attract attackers. However, software-based honeypots have both performance issues in light of 10+ Gb/s networks, as well as difficulties in preventing the compromise of the honeypot system itself. We present an architecture for a honeypot using dedicated hardware instead of a general-purpose processor. Our system is fast enough to keep up with high-speed networks and more resilient against subversion attempts than existing software solutions. It consists of a high-speed implementation of the Internet protocol stack attached to hardware-based emulations of vulnerable applications. A specialized implementation of the TCP protocol, capable of managing hundreds of thousands of simultaneous connections, allows the system to span large honeynets. The practical feasibility of the approach has been demonstrated on a real FPGA platform connected to a 10 Gb/s network interface.