MRI: Acquisition of Equipment for Research in Cyber Security Processor Design

Polytechnic University Of New York, Brooklyn NY

Investigators

Abstract

This project, building a cyber security processor with functions to protect part of the Internet from various attacks, designs an integrated CYber SEcurity Processor (CYSEP) to accelerate encryption, decryption, authentication, shallow and deep packet inspection, and DDoS security function. The work aims at demonstrating that security engines can scale in throughput to 10 Gbps and beyond. The encryption/decryption engine supports message confidentiality VPN function. This engine will support both block and stream modes of operation. It can accelerate application, transport, network, and data link layer VPN protocols. The authentication engine implements message integrity VPN function and an extremely fast scalable universal hash function-based Message Authentication CODE (MAC) hardware architecture. The DDoS detection and protection engine uses a novel Packet-Score scheme to estimate the legitimacy of suspicious packets avoiding the problems associated with conventional binary rule-based filtering. By implementing packet classification and multi-packet content inspection at line speed without fragmentation, the FIrewall and INtrusion Detection (FIND) engine detects attacks and filters unwanted content.