Ken Eguro

FPGAs for trusted cloud computing

FPGA manufacturers have offered devices with bitstream protection for a number of years. This feature is currently primarily used to prevent IP piracy through cloning. However, in this paper we describe how protected bitstreams can also be used to create a root of trust for the clients of cloud computing services. Unlike related software-based solutions, this hardware-based approach solves a fundamental problem that currently impedes the greater adoption of cloud computing: how to secure client data and computation from both potential external attackers and an untrusted system administrator. We examine how this approach can be applied to the specific application of handling sensitive health data. This system maintains the advantages of the cloud with minimal additional hardware. We also describe how this system can be extended to provide a more generic secure cloud architecture.

SIRC: An Extensible Reconfigurable Computing Communication API

Reconfigurable computing applications often need to divide computation between software running on a conventional desktop processor and hardware mapped to an FPGA. However, the reconfigurable computing development platforms available today either do not provide a sufficient mechanism for the communication and synchronization that is needed or else employ a complex & proprietary API specific to a given toolflow or device, limiting code portability. The Simple Interface for Reconfigurable Computing (SIRC) project provides a straightforward, portable and extensible open-source communication and synchronization API. It consists of both a software-side interface and a hardware-side interface that allows C++ code running on a host PC to communicate and synchronize with a Verilog-based circuit mapped to a FPGA. One key feature of this API is that both the hardware and software user interfaces can remain consistent across all platforms and future releases. This allows applications built for existing systems to migrate to different platforms without significant modification to user code.

A Karatsuba-Based Montgomery Multiplier

Modular multiplication of long integers is an important building block for cryptographic algorithms. Although several FPGA accelerators have been proposed for large modular multiplication, previous systems have been based on

Secure database-as-a-service with Cipherbase

O(N^2)

Random decision tree body part recognition using FPGAs

algorithms. In this paper, we present a Montgomery multiplier that incorporates the more efficient Karatsuba algorithm which is

Groundhog - A Serial ATA Host Bus Adapter (HBA) for FPGAs

O(N^{(\log 3/\log 2)})

Transaction processing on confidential data using cipherbase

. This system is parameterizable to different bit-widths and makes excellent use of both embedded multipliers and fine-grained logic. The design has significantly lower LUT-delay product and multiplier-delay product compared with previous designs. Initial testing on a Virtex-6 FPGA showed that it is 60-190 times faster than an optimized multi-threaded software implementation running on an Intel Xeon 2.5 GHz CPU. The proposed multiplier system is also estimated to be 95-189 times more energy efficient than the software-based implementation. This high performance and energy efficiency makes it suitable for server-side applications running in a datacenter environment.

A secure coprocessor for database applications

Data confidentiality is one of the main concerns for users of public cloud services. The key problem is protecting sensitive data from being accessed by cloud administrators who have root privileges and can remotely inspect the memory and disk contents of the cloud servers. While encryption is the basic mechanism that can leveraged to provide data confidentiality, providing an efficient database-as-a-service that can run on encrypted data raises several interesting challenges. In this demonstration we outline the functionality of Cipherbase --- a full fledged SQL database system that supports the full generality of a database system while providing high data confidentiality. Cipherbase has a novel architecture that tightly integrates custom-designed trusted hardware for performing operations on encrypted data securely such that an administrator cannot get access to any plaintext corresponding to sensitive data.

FPGA side-channel receivers

Random decision tree classification is used in a variety of applications, from speech recognition to Web search engines. Decision trees are used in the Microsoft Kinect vision pipeline to recognize human body parts and gestures for a more natural computer-user interface. Tree-based classification can be taxing, both in terms of computational load and memory bandwidth. This makes highly-optimized hardware implementations attractive, particularly given the strict power and form factor limitations of embedded or mobile platforms. In this paper we present a complete architecture that interfaces the Kinect depth-image sensor to an FPGA-based implementation of the Forest Fire pixel classification algorithm. Key performance parameters, algorithmic improvements and design trade-off are discussed.

Automated dynamic reconfiguration for high-performance regular expression searching

This paper describes Groundhog, an open-source SATA host bus adapter (HBA) for FPGAs. This system makes it easy for FPGA-based applications to directly interact with permanent storage devices. This allows reconfigurable computing devices to be used in new applications that require bulk storage and presents additional opportunities to increase performance, reduce power consumption and improve system integration. In addition to standard disk sector read/write commands, this framework also supports more advanced concepts such as native command queuing (NCQ) introduced with SATA II. We test the system with latest-generation SSDs and demonstrate the potential performance advantages and trade-offs of direct hardware access to bulk storage devices.