High-performance hardware monitors to protect network processors from data plane attacks
| Autor: | Deepak Unnikrishnan, Harikrishnan Kumarapillai Chandrikakutty, Tilman Wolf, Russell Tessier |
|---|---|
| Jazyk: | angličtina |
| Rok vydání: | 2012 |
| Předmět: |
Router
QA Mathematics::QA75 Electronic computers. Computer science [Q Science] Computer science business.industry Network packet Network processor T Technology (General) [T Technology] Packet processing Packet drop attack Q Science (General) [Q Science] Embedded system TK Electrical engineering. Electronics Nuclear engineering [T Technology] Forwarding plane The Internet business Harvard architecture Computer hardware Computer network TA Engineering (General). Civil engineering (General) [T Technology] |
| Zdroj: | IMDEA Networks Institute Digital Repository IMDEA Networks Institute DAC instname |
| Popis: | http://dx.doi.org/10.1145/2463209.2488832 The Internet represents an essential communication infrastructure that needs to be protected from malicious attacks. Modern network routers are typically implemented using embedded multi-core network processors that are inherently vulnerable to attack. Hardware monitor subsystems, which can verify the behavior of a router's packet processing system at runtime, can be used to identify and respond to an ever-changing range of attacks. While hardware monitors have primarily been described in the context of general-purpose computing, our work focuses on two important aspects that are relevant to the embedded networking domain: We present the design and prototype implementation of a high-performance monitor that can track each processor instruction with low memory overhead. Additionally, our monitor is capable of defending against attacks on processors with a Harvard architecture, the dominant contemporary network processor organization. We demonstrate that our monitor architecture provides no network slowdown in the absence of an attack and provides the capability to drop attack packets without otherwise affecting regular network traffic when an attack occurs. TRUE pub |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|