FPGA-based CASB high-speed engine
By using an FPGA-based hardware platform and a five-stage pipeline architecture, the performance bottlenecks and security issues of traditional CASB solutions are resolved, enabling efficient and secure packet processing that supports throughput of 100Gbps and latency of microseconds.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- BEIJING ZUOJIANG TECH
- Filing Date
- 2026-04-08
- Publication Date
- 2026-07-21
AI Technical Summary
Traditional CASB solutions based on general-purpose CPUs suffer from performance bottlenecks, high latency, poor scalability, and insufficient security in high-speed network environments.
A five-stage pipeline architecture is constructed using an FPGA-based hardware platform, including an FPGA accelerator card and external memory, to realize pipelined processing of data packets. This includes modules such as data packet scheduling and distribution, security policy matching, encryption and decryption coprocessing, and deep content inspection. Data processing is performed by leveraging the hardware parallelism and isolation of the FPGA.
It achieves extremely high processing performance, ultra-low latency, low power consumption and enhanced security, with a processing throughput of up to 100Gbps, microsecond-level latency, reduced operating costs, and flexibility and reconfigurability.
Smart Images
Figure CN122437677A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of cloud service technology, specifically relating to a high-speed CASB engine based on FPGA. Background Technology
[0002] As businesses increasingly migrate their operations to the cloud, it has become commonplace for employees to directly access cloud services (such as Office 365, Salesforce, and Alibaba Cloud) via the internet. The Cloud Access Security Broker (CASB), acting as the enforcement point for security policies between enterprise data and cloud services, needs to perform deep security inspections on all traffic entering and leaving the cloud environment, including but not limited to data encryption / decryption, data loss prevention (DLP), malware detection, and access control.
[0003] Traditional CASB solutions are primarily based on software implementations using general-purpose CPUs (central processing units), which have the following inherent drawbacks: 1. Performance bottleneck: In high-speed network environments (such as 10Gbps and above), operations such as deep parsing, encryption and decryption, and policy matching of data packets consume a lot of CPU resources, leading to increased processing latency and becoming a bottleneck for network throughput.
[0004] 2. High latency: Software processing requires multiple data copies and context switches, which increases data processing latency and makes it difficult to meet the real-time requirements of enterprise applications.
[0005] 3. Poor scalability: Performance improvements depend on increasing the number of CPU cores or servers, which is costly and has low energy efficiency.
[0006] 4. Security: Processing sensitive data (such as encryption keys) on a general-purpose server exposes it to the risk of being stolen by other malware on the same hardware.
[0007] Therefore, there is an urgent need in this field for a CASB processing solution that can provide high throughput, low latency, high security and excellent energy efficiency. Summary of the Invention
[0008] (a) Technical problems to be solved The technical problem this invention aims to solve is how to provide an FPGA-based high-speed CASB engine to address the performance bottlenecks and security issues of software CASB.
[0009] (II) Technical Solution To address the aforementioned technical problems, this invention proposes an FPGA-based high-speed CASB engine. The hardware platform of this high-speed CASB engine includes: FPGA accelerator card: Connects to the policy management server via PCIe interface and carries the core processing logic; External memory: provides large-capacity storage space for FPGA; The FPGA's logic architecture includes a five-stage pipeline, which consists of: Packet scheduling and distribution module: Receives and initially classifies network traffic; Security policy matching module: performs fast policy matching based on metadata; Encryption / decryption coprocessor module: performs hardware-accelerated decryption of encrypted traffic; Deep content inspection module: performs security scanning on plaintext content; Data encapsulation and transmission module: re-encapsulates and forwards the processed data; The multiple functional modules are interconnected through an on-chip high-speed bus or crossbar switch to form one or more parallel processing pipelines, realizing pipelined processing of data packets.
[0010] (III) Beneficial Effects This invention proposes a high-speed CASB engine based on FPGA. The advantages of this invention are: 1. Extremely high processing performance: By leveraging the hardware parallelism of FPGA, computationally intensive encryption / decryption, policy matching, and content detection tasks are embedded into the hardware logic, achieving a processing throughput far exceeding that of general-purpose CPUs (up to 100Gbps), completely eliminating performance bottlenecks.
[0011] 2. Ultra-low latency: Data is processed in a pipelined manner inside the FPGA, avoiding context switching and data copying of the operating system kernel, achieving microsecond-level processing latency.
[0012] 3. High energy efficiency: FPGAs are optimized for specific computing tasks, and consume far less power than general-purpose CPU servers when performing the same task, significantly reducing operating costs.
[0013] 4. Enhanced security: Encryption and decryption keys and core security logic are implemented inside the FPGA, isolated from the host operating system, effectively preventing keys from being stolen by malicious software and providing a higher hardware root of trust.
[0014] 5. Flexibility and reconfigurability: When security policies or algorithms need to be updated, functional upgrades can be achieved by reconfiguring the FPGA bitstream, combining the high performance of ASICs (Application-Specific Integrated Circuits) with the flexibility of software. Attached Figure Description
[0015] Figure 1 This is a system overall architecture block diagram according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the logic structure of the FPGA internal processing pipeline in an embodiment of the present invention; Figure 3This is a schematic diagram of the parallel architecture of the encryption / decryption coprocessing module in an embodiment of the present invention. Detailed Implementation
[0016] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.
[0017] The purpose of this invention is to overcome the shortcomings of the prior art and provide a high-speed CASB engine based on FPGA, which processes core security functions in a hardware-based and parallel manner, thereby completely solving the performance bottleneck and security problems of software CASB.
[0018] like Figure 1 As shown in the overall system architecture diagram, the external environment, control plane, and data plane of this invention, and the CASB high-speed engine are described as follows: 1. External environment Internet / Enterprise Intranet: The source of traffic; all traffic accessing cloud services originates from here.
[0019] Cloud services: the destination of traffic, including various SaaS applications and IaaS / PaaS platforms.
[0020] 2. Control plane Policy management server: Responsible for the formulation, distribution, and updating of security policies.
[0021] Log and Analysis System: Collects and analyzes security logs and events generated by the CASB engine.
[0022] 3. Data Plane - CASB High-Speed Engine Hardware platform: FPGA accelerator card: Connects to the policy management server via PCIe interface and carries the core processing logic.
[0023] External memory: provides large-capacity storage space for FPGA.
[0024] FPGA logic architecture (five-stage pipeline): Packet scheduling and distribution module: Receives and initially classifies network traffic.
[0025] Security policy matching module: performs fast policy matching based on metadata.
[0026] Encryption / decryption coprocessor module: performs hardware-accelerated decryption of encrypted traffic.
[0027] Deep content inspection module: performs security scanning on plaintext content.
[0028] Data encapsulation and transmission module: Re-encapsulates and forwards the processed data.
[0029] The multiple functional modules are interconnected through an on-chip high-speed bus or crossbar switch to form one or more parallel processing pipelines, realizing pipelined processing of data packets.
[0030] like Figure 2 As shown in the logic structure of the FPGA's internal processing pipeline, the FPGA implements the following high-speed processing: Pipeline processing: Data packets sequentially pass through five modules: data packet scheduling and distribution, security policy matching, encryption and decryption coprocessing, deep content inspection, and data encapsulation and sending, forming a high-efficiency pipeline.
[0031] Parallel branching: The policy matching module makes decisions based on rules, causing data packets to enter different processing paths, such as direct passage, scanning after decryption, or only data loss protection DLP scanning, thus optimizing resource utilization.
[0032] Hardware acceleration: The two most time-consuming tasks, encryption / decryption coprocessing and deep content inspection, are performed by dedicated hardware modules, which is key to achieving high performance.
[0033] The internal logic of the FPGA chip is divided into the following functional modules: 1. Packet scheduling and distribution module: Connected to the high-speed network interface, it receives network data streams, performs preliminary parsing (such as identifying protocol types and extracting metadata), and distributes the packets to the corresponding processing pipelines according to the preset flow table.
[0034] 2. Security Policy Matching Module: Connected to the packet scheduling and distribution module, it integrates a policy rule base. This module performs high-speed parallel matching based on packet metadata (such as 5-tuple, user identity, application identifier) to determine the security action (such as allow, deny, decrypt, DLP scan) to be performed on the data stream.
[0035] 3. Encryption / Decryption Coprocessing Module: Connected to the security policy matching module, it is used to perform hardware-level encryption and decryption operations on the data payload according to the policy execution result. This module integrates multiple independent encryption and decryption engine cores in parallel, supporting Chinese national cryptographic algorithms (such as SM2, SM3, SM4) and internationally used algorithms (such as AES, RSA, SHA-256).
[0036] 4. Deep Content Detection Module: Connected to the encryption / decryption coprocessing module, this module performs a deep scan of the decrypted plaintext data. It employs a hardware state machine or Bloom filter to perform keyword matching, regular expression matching, and file fingerprint recognition in parallel to perform data loss prevention (DLP) and malicious code detection.
[0037] 5. Data Encapsulation and Transmission Module: Connected to the deep content detection module, this module re-encapsulates the processed data according to the original protocol and transmits it via a high-speed network interface. The processed data includes reset packets generated after allowing, modifying, or blocking data.
[0038] For example, if the security policy matching module determines the policy decision as allow / no processing required, it will directly output the data through the data encapsulation and sending module. If the strategy decision is that only DLP scanning is required, the deep content detection module processes the data and determines whether a threat is detected. If a threat is detected, a blocking signal is generated and a reset packet is generated. If no threat is detected, the data is output through the data encapsulation and sending module. If the strategy decision indicates that decryption is required, the encryption / decryption coprocessor module first decrypts the data, and then the deep content detection module processes the data to determine whether a threat is detected. If a threat is detected, a blocking signal is generated, and a reset packet is generated. If no threat is detected, the data is output through the data encapsulation and sending module.
[0039] like Figure 3 As shown in the parallel architecture of the encryption / decryption coprocessor module, the core design, high-concurrency principle, and flexible support of this module are as follows: Core design: The module contains a parallel algorithm engine pool, which includes multiple homogeneous or heterogeneous encryption and decryption engine cores (such as a core specifically for AES, a core for SM4, etc.).
[0040] High concurrency principle: The input arbiter and dispatcher allocates different data streams or data blocks to idle algorithm engine cores for parallel processing, which greatly improves throughput. The parallel processing results are output through the output arbiter and collector.
[0041] Flexible support: This architecture can flexibly support a variety of encryption algorithms and can linearly improve the processing performance of specific algorithms by increasing the number of similar engine cores.
[0042] The multiple functional modules are interconnected through an on-chip high-speed bus or crossbar switch to form one or more parallel processing pipelines, realizing pipelined processing of data packets.
[0043] The external memory is used to store a large-scale policy rule base, DLP feature base, and intermediate state data during encryption and decryption operations.
[0044] The configuration management interface is used to receive policy configuration, status monitoring and log reporting instructions from the external control plane; the FPGA chip also has a lightweight management core inside, which is used to parse and execute these instructions.
[0045] When security policies or algorithms need to be updated, functional upgrades are achieved by reconfiguring the FPGA bitstream.
[0046] Effects of the invention: 1. Extremely high processing performance: By leveraging the hardware parallelism of FPGA, computationally intensive encryption / decryption, policy matching, and content detection tasks are embedded into the hardware logic, achieving a processing throughput far exceeding that of general-purpose CPUs (up to 100Gbps), completely eliminating performance bottlenecks.
[0047] 2. Ultra-low latency: Data is processed in a pipelined manner inside the FPGA, avoiding context switching and data copying of the operating system kernel, achieving microsecond-level processing latency.
[0048] 3. High energy efficiency: FPGAs are optimized for specific computing tasks, and consume far less power than general-purpose CPU servers when performing the same task, significantly reducing operating costs.
[0049] 4. Enhanced security: Encryption and decryption keys and core security logic are implemented inside the FPGA, isolated from the host operating system, effectively preventing keys from being stolen by malicious software and providing a higher hardware root of trust.
[0050] 5. Flexibility and reconfigurability: When security policies or algorithms need to be updated, functional upgrades can be achieved by reconfiguring the FPGA bitstream, combining the high performance of ASICs (Application-Specific Integrated Circuits) with the flexibility of software.
[0051] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.
Claims
1. A high-speed CASB engine based on FPGA, characterized in that, The hardware platform for this CASB high-speed engine includes: FPGA accelerator card: Connects to the policy management server via PCIe interface and carries the core processing logic; External memory: provides large-capacity storage space for FPGA; The FPGA's logic architecture includes a five-stage pipeline, which consists of: Packet scheduling and distribution module: Receives and initially classifies network traffic; Security policy matching module: performs fast policy matching based on metadata; Encryption / decryption coprocessor module: performs hardware-accelerated decryption of encrypted traffic; Deep content inspection module: performs security scanning on plaintext content; Data encapsulation and transmission module: re-encapsulates and forwards the processed data; The multiple functional modules are interconnected through an on-chip high-speed bus or crossbar switch to form one or more parallel processing pipelines, realizing pipelined processing of data packets.
2. The FPGA-based CASB high-speed engine as described in claim 1, characterized in that, The external environment of this CASB high-speed engine includes: the Internet / corporate intranet and cloud services; The Internet / corporate intranet is the source of traffic, and all traffic accessing cloud services originates from here; Cloud services are the destination of traffic, including various SaaS applications and IaaS / PaaS platforms.
3. The FPGA-based CASB high-speed engine as described in claim 2, characterized in that, The control plane of the CASB high-speed engine includes: Policy management server: Responsible for the formulation, distribution, and updating of security policies; Log and Analysis System: Collects and analyzes security logs and events generated by the CASB engine.
4. The FPGA-based CASB high-speed engine as described in claim 3, characterized in that, FGPA achieves the following high-speed processing: Pipeline processing: Data packets sequentially pass through five modules: data packet scheduling and distribution, security policy matching, encryption and decryption coprocessing, deep content inspection, and data encapsulation and sending, forming a high-efficiency pipeline; Parallel Branching: The policy matching module makes decisions based on rules, causing data packets to enter different processing paths, including: direct passage, scanning after decryption, or DLP scanning with only data loss protection, thus optimizing resource utilization; Hardware acceleration: Encryption and decryption coprocessing and deep content detection are the most time-consuming tasks, which are performed by dedicated hardware modules.
5. The FPGA-based CASB high-speed engine as described in claim 3, characterized in that, The packet scheduling and distribution module is connected to the high-speed network interface to receive network data streams, perform preliminary parsing, and distribute the packets to the corresponding processing pipelines according to the preset flow table. The security policy matching module is connected to the packet scheduling and distribution module and integrates a policy rule base. This module performs high-speed parallel matching based on packet metadata to determine the security actions to be performed on the data stream, including: allow, deny, decrypt, and DLP scan. The encryption / decryption coprocessing module is connected to the security policy matching module and is used to perform hardware-level encryption / decryption operations on the data payload based on the policy execution result. This module integrates multiple independent encryption / decryption engine cores in parallel, supporting Chinese national cryptographic algorithms and internationally accepted algorithms. The deep content detection module is connected to the encryption / decryption coprocessing module and is used to perform deep scanning on the decrypted plaintext data. This module uses a hardware state machine or Bloom filter to implement keyword matching, regular expression matching, and file fingerprint recognition in parallel to perform data loss prevention (DLP) and malicious code detection. The data encapsulation and sending module is connected to the deep content detection module and is used to re-encapsulate the processed data according to the original protocol and send it out through the high-speed network interface. The processed data includes reset packets generated after allowing, modifying or blocking.
6. The FPGA-based CASB high-speed engine as described in claim 5, characterized in that, If the security policy matching module determines the policy decision as allow / no processing required, then the data is directly output through the data encapsulation and sending module. If the strategy decision is that only DLP scanning is required, the deep content detection module processes the data and determines whether a threat is detected. If a threat is detected, a blocking signal is generated and a reset packet is generated. If no threat is detected, the data is output through the data encapsulation and sending module. If the strategy decision indicates that decryption is required, the encryption / decryption coprocessor module first decrypts the data, and then the deep content detection module processes the data to determine whether a threat is detected. If a threat is detected, a blocking signal is generated, and a reset packet is generated. If no threat is detected, the data is output through the data encapsulation and sending module.
7. The FPGA-based CASB high-speed engine as described in claim 3, characterized in that, The encryption / decryption coprocessing module contains a parallel algorithm engine pool, which includes multiple homogeneous or heterogeneous encryption / decryption engine cores. The input arbitrator and dispatcher allocates different data streams or data blocks to idle algorithm engine cores for parallel processing, and the parallel processing results are output through the output arbitrator and collector. By setting up multiple encryption algorithms, the processing performance of a specific algorithm can be linearly improved by increasing the number of similar engine cores.
8. The FPGA-based CASB high-speed engine as described in claim 3, characterized in that, The external memory is used to store a large-scale policy rule base, DLP feature base, and intermediate state data during encryption and decryption operations.
9. The FPGA-based CASB high-speed engine as described in claim 3, characterized in that, The configuration management interface is used to receive policy configuration, status monitoring and log reporting instructions from the external control plane; the FPGA chip also has a lightweight management core inside, which is used to parse and execute these instructions.
10. The FPGA-based CASB high-speed engine as described in claim 3, characterized in that, When security policies or algorithms need to be updated, functional upgrades are achieved by reconfiguring the FPGA bitstream.