|
|
Accelerating an Application for DDoS Mitigation
Vojanec, Kamil ; Kekely, Lukáš (referee) ; Kučera, Jan (advisor)
This thesis focuses on optimizing and accelerating an application used for mitigating Denial of Service attacks. The goal is to analyze the existing implementation of DDoS Protector and to identify components which are suitable for optimization or hardware acceleration. Based on the analysis, improved algorithms and data structures utilizing the DPDK open-source framework are designed together with a proposal to offload certain computation elements into hardware using the RTE Flow library. The result of this thesis is a set of modules and an implementation of classification components intended to be used within the DDoS Protector application. The resulting components are then properly tested. Finally, the performance results of the original and new implementations are compared. The application shows as much as five-times improvement in terms of packet rate when using 256 classification rules.
|
|
|
Acceleration of Open vSwitch in DPDK
Vodák, David ; Kučera, Jan (referee) ; Martínek, Tomáš (advisor)
Virtual switch is a software that connects virtual machines to the internet, which makes it a crucial part of virtualization on servers. Nevertheless, it can be rather ineffective when it comes to high speed traffic, since it switches all frames in the software. This thesis is about hardware acceleration of the virtual switch called Open vSwitch. The acceleration prototype, which is the goal of this thesis, is based on the RTE flow interface, the SR-IOV standard, and Intel PAC N3000 card. In the scope of this master's thesis, all necessary technologies were described and the acceleration prototype was designed, implemented, and tested. Results of executed measurements indicate increased throughput when rules of the acceleration prototype were offloaded to hardware.
|
|
|
Hardware Acceleration of Encryption Algorithms Using Xilinx Zynq Technology
Linner, Marek ; Fukač, Tomáš (referee) ; Kořenek, Jan (advisor)
The main concern of this paper are two world standard encryption algorithms Data Encryption Standard DES (DES for short) and Advanced Encryption Standard (further mentioned as AES). For these two respective algorithms, three publicly available implementations are integrated into a benchmarking code in C programming language. The code has been executed, implementations measured with three different input block lengths and bitrate calculated for each implementation. The thesis also includes hardware implementation of both encryption algorithms DES and AES using VHDL language, simulation of the synthesised circuits and calculation of the hardware implementations' bitrate using Vivado simulator's timing reports. These measured bitrates are then compared with the bitrates of benchmarked software implementations. Paper includes all source codes of the benchmarking C program and VHDL implementation, along with program written in C# used to generate VHDL components and another C# program used for automated testing.
|
|
|
Construction of Effective Automata for Regex Matching in HW
Frejlach, Jakub ; Havlena, Vojtěch (referee) ; Češka, Milan (advisor)
This thesis is motivated by the application of REs in domains requiring fast matching such has deep packet inspections. To ensure sufficient speed a HW acceleration is typically employed. During the acceleration, REs are in the form of NFA synthesized on FPGA. Although HW acceleration solves the speed problems, it suffers from increased consumption of the FPGA components, specifically LUT. The goal of this thesis is to design, implement and experimentally evaluate heuristic method for approximation of FA in context of HW accelerated RE matching. The purpose of this approximation is to lower consumption of LUT components during FPGA synthesis. The key idea of the method is to add some transitions allowing to construct a smaller number of character classes and thus to reduce the number of LUT implementing the transition relation while reducing the error by modifying only less significant parts of FA. Proposed method together with evaluation pipeline is implemented in TOFA tool. Technique was evaluated on both synthetic and real data. Results of experiments shows, that transitional approximation works especially well on automatas with large number of equivalence character classes.
|
|
|
Protection Against DoS Attacks Using P4 Language
Vojanec, Kamil ; Fukač, Tomáš (referee) ; Kučera, Jan (advisor)
This thesis focuses on reimplementation of existing DoS (Denial of Service) attack mitigation device with high-level P4 programming language. The main reason for using P4 is to enhance adaptability and functionality to different types of DoS attacks. The created device is designed in a modular way and enables easy alterations by using interchangeable components. The target platform for this thesis is an FPGA acceleration card. The work results in designing several DoS mitigation components and implementing applications composed of these components. Pats of this work have been presented at IEEE ANCS (Symposium on Architectures for Networking and Communication Systems) in September 2019 at University of Cambridge.
|
|
|
Acceleration of Open vSwitch
Vodák, David ; Orsák, Michal (referee) ; Martínek, Tomáš (advisor)
Virtual switch is a program, which is used for connecting virtual machines to network and that is why it is a crucial part of server virtualization. However virtual switch is consuming too much performance of the server which it is running on. A measurement of Open vSwitch (OvS) indicates that for data speed of 10 Gb/s, approximately 4 cores of the processor are fully occupied. As the consumption of performance is directly proportional to transmission speed, it may eventually get to the point where the consumption of performance cannot be handled. This bachelor thesis is about acceleration of the Open vSwitch with the help of the DPDK Poll Mode Driver extended by support of the SR-IOV virtualization technology as well as the interface for offloading classification rules to hardware called RTE flow. In the scope of this thesis the SR-IOV is implemented and then tested on OvS. Furthermore, the RTE flow support was designed and partially implemented.
|
|
|
Hardware acceleration of packet classification using TC Flower
Benc, Marek ; Fujcik, Lukáš (referee) ; Libich, Jiří (advisor)
Sdružení CESNET vyvíjí vysokorychlostní programovatelné síťové karty COMBO (aktuálně až s dvěma 100Gbps porty) zaměřené na analýzu a zpracování síťových dat. Karty obsahují FPGA čip, který dovoluje uživatelům přesně definovat způsob, jakým má být síťový provoz zpracován. Jedno z možných využití těchto karet je jako síťový přepínač pro virtuální stroje v data centru. Tato práce je zaměřená na implementaci podpory TC Flower offloadu pro karty COMBO (software a FPGA firmware). Jedná se o všeobecné rozhraní pro instalaci flow pravidel typu shoda+akce do SmartNICů, a dovoluje nám použít je pro správu síťového provozu mezi virtuálními stroji a vnějším světem. Cílem je úspora procesorových cyklů hostitelského stroje.
|
|
|
Software-Controlled Network Traffic Monitoring
Kekely, Lukáš ; Antichi, Gianni (referee) ; Lhotka,, Ladislav (referee) ; Kořenek, Jan (advisor)
Tato disertační práce se zabývá návrhem nového způsobu softwarově řízené (definované) hardwarové akcelerace pro moderní vysokorychlostní počítačové sítě. Hlavním cílem práce je formulace obecného, flexibilního a jednoduše použitelného konceptu akcelerace použitelného pro různé bezpečnostní a monitorovací aplikace, který by umožnil jejich reálné nasazení ve 100 Gb/s a rychlejších sítích. Disertační práce začíná rozborem aktuálního stavu poznání v oborech síťového monitorování, bezpečnosti a způsobů akcelerace zpracování vysokorychlostních síťových dat. Na základě tohoto rozboru je formulován a navržen zcela nový koncept s názvem Softwarově definované monitorování (SDM). Klíčová funkcionalita uvedeného konceptu je postavená na hardwarově akcelerované, aplikačně specifické (řízené), na tocích založené, informované redukci a distribuci zachycených síťových dat. Toto je zajištěno spojením vysokorychlostního hardwarového zpracování s flexibilním softwarovým řízením, které tak společně umožňují jednoduchou tvorbu různých komplexních a vysoce výkonných síťových aplikací. Pokročilé optimalizace a vylepšení základního SDM konceptu a jeho vybraných komponent jsou v práci též zkoumány, což vede k návrhu zcela unikátní a obecně použitelné FPGA architektury modulárního analyzátoru hlaviček paketů a vysoce výkonného klasifikátoru paketů založeného na kukaččím hashovaní. Nakonec je vytvořen vysokorychlostní SDM prototyp postavený nad FPGA akcelerační síťovou kartou, který je podrobně ověřen v podmínkách nasazení do reálných sítí. Jsou změřeny a diskutovány dosažitelné zlepšení výkonností v několika vybraných monitorovacích a bezpečnostních případech užití. Vytvořený SDM prototyp je rovněž nasazen v produkčním monitorování reálné páteřní sítě sdružení Cesnet a byl komercializován společností Netcope Technologies.
|
|
|
A Hardware-acceleration Protocol Design for Demanding Computations over Multiple Cores
Bareš, Jan ; Dvořák, Vojtěch (referee) ; Šťáva, Martin (advisor)
This work deals with design of communication protocol for data transmission between control computer and computing cores implemented on FPGA chips. The purpose of the communication is speeding the performance demanding software algorithms of non-stream data processing by their hardware computation on accelerating system. The work defines a terminology used for protocol design and analyses current solutions of given issue. After that the work designs structure of the accelerating system and communication protocol. In the main part the work describes the implementation of the protocol in VHDL language and the simulation of implemented modules. At the end of the work the aplication of designed solution is presented along with possible extension of this work.
|
|
|
Framework for Hardware Acceleration of 400Gb Networks
Hummel, Václav ; Matoušek, Jiří (referee) ; Kořenek, Jan (advisor)
The NetCOPE framework has proven itself as a viable framework for rapid development of hardware accelerated wire-speed network applications using Network Functions Virtualization (NFV). To meet the current and future requirements of such applications the NetCOPE platform has to catch up with upcoming 400 Gigabit Ethernet. Otherwise, it may become deprecated in following years. Catching up with 400 Gigabit Ethernet brings many challenges bringing necessity of completely different way of thinking. Multiple network packets have to be processed each clock cycle requiring a new concept of processing. Advanced memory management is used to ensure constant memory complexity with respect to the number of DMA channels without any impact on performance. Thanks to that, even more than 256 completely independent DMA channels are feasible with current technology. A lot of effort was made to create the framework as generic as possible allowing deployment of 400 Gigabit Ethernet and beyond. Emphasis is put on communication between the framework and host computer via PCI Express technology. Multiple Ethernet ports are also considered. The proposed system is prepared to be deployed on the family of COMBO cards, used as a reference platform.
|
guest ::
