Dynamic Hardware Monitors for Network Processor Protection

Abstract

The importance of the Internet for society is increasing. To ensure a functional Internet, its routers need to operate correctly. However, the need for router flexibility has led to the use of softwareprogrammable network processors in routers, which exposes these systems to data plane attacks. Recently, hardware monitors have been introduced into network processors to verify the expected behavior of processor cores at run time. If instruction-level execution deviates from the expected sequence, an attack is identified, triggering processor core recovery efforts. In this manuscript, we describe a scalable network processor monitoring system that supports the reallocation of hardware monitors to processor cores in response to workload changes. The scalability of our monitoring architecture is demonstrated using theoretical models, simulation, and router system-level experiments implemented on an FPGA-based hardware platform. For a system with four processor cores and six monitors, the monitors result in a 6% logic and 38% memory bit overhead versus the processor's core logic and instruction storage. No slowdown of system throughput due to monitoring is reported.Index Terms-network security, network infrastructure, data plane attack, hardware monitor, multicore processor, FPGA 0018-9340 (c)

NATRA: Network ACK-Based Traffic Reduction Algorithm

“…Packet capture takes place in the NIC, which can either be a network processor [19] or a general-purpose device [28]. The NIC usually receives traffic from a SPAN port or splitter.…”