基于FPGA的组件化抗重放攻击设计  

Design of Component-based Anti-replay Attacks Based on FPgA

作　　者：曹宝[1] 郭爽[1] 陈洋 何远杭[1] CAO Bao;GUO Shuang;CHEN Yang(No.30 Institute of CETC,Chengdu Sichuan 610041,China)

机构地区：[1]中国电子科技集团公司第三十研究所,四川成都610041

出　　处：《通信技术》2022年第7期956-961,共6页Communications Technology

基　　金：国家自然科学基金(重点)(U21B2019)。

摘　　要：针对数据中心面临的重放攻击威胁,分析了重放攻击的危害和常用的防御手段,并针对软件实现抗重放攻击模块的不足,提出了一种基于现场可编程逻辑门阵列(Field Programmable Gate Array,FPGA)的组件化抗重放设计。采用组件化的设计思想,针对两种典型的业务数据包,设计了抗重放攻击模块的FPGA功能架构、检测关键数据包的状态机和表项配置模块。用较少的FPGA资源实现高带宽、低时延的数据包重放攻击检测和处理,具有可用性高、可配置、可扩展、移植性好等特点。经过验证,该设计适用于企业级的数据中心边界安全防护,可满足未来安全防护设备对安全资源服务化的需求。Under the threat of replay attacks of data center,this paper analyzes the damage and commonly used defense methods of replay attacks,and aiming at the deficiencies of the software-based implementation of anti-replay attack module,proposes a componentized anti-replay design based on FPGA(Field Programmable Gate Array).Following the thought of componentization,for two typical data packages,this design puts forward FPGA function architecture of anti-replay attacks,state machine of key data packet check and table configuration module.It has features of high-bandwidth,low-delay on replay packets check and dealing at low cost of FPGA resource,and has features of high availability,configurability,extendibility,and easy transportation.By validation,the design is suitable for enterprise-level data center boundary security protection,and can meet the needs of service-oriented secure resource for future safety protection equipment.

关 键 词：数据中心 重放攻击 FPGA设计 组件化 

分 类 号：TN402[电子电信—微电子学与固体电子学]