Cloud Runtime FPGA Binary Protection via Authorization Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The use of Field Programmable Gate Arrays (FPGAs) in cloud environments poses security challenges due to the inability of existing software license mechanisms to protect FPGA binary files, which are valuable and sensitive, as they are hardware configuration data rather than software, and cannot be encrypted, leading to unauthorized access and duplication.
Innovation Solution
A method and apparatus that involve uploading a monitoring module and protection data configuration to the runtime environment to prevent users with low authorization levels from accessing sensitive data, such as FPGA binary files, by monitoring data input and output based on the protection configuration, ensuring secure isolation of sensitive data during application execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If FPGA binary files are stored unencrypted in the cloud runtime environment for easy access and execution, then ease of operation is improved, but security deteriorates as users can duplicate and access sensitive binary files
Solution Approach 1:
The system segments users into different authorization levels (high and low). High authorization users can access and manage FPGA binary files, while low authorization users are restricted to executing applications without accessing the binary files. This segmentation resolves the contradiction by providing ease of operation for execution while maintaining security through authorization-based access control.
2Ease of operation
If standard API is used to configure FPGA binary files in shared hardware, then ease of operation is improved, but security deteriorates as no encryption measures are taken
Solution Approach 1:
The system introduces an intermediary authorization mechanism between the standard API and the FPGA binary files. The authorization module intercepts API calls and enforces access control policies, allowing the standard API to remain easy to use while adding security layer that prevents unauthorized access to sensitive binary files.
3Reliability
If software license mechanism is used to protect FPGA binary files, then security is improved, but applicability deteriorates as FPGA binary files are hardware configuration data not software
Solution Approach 1:
The system changes the protection parameter from software-based licensing to hardware-based authorization levels. Instead of using software license files or keys, the system implements authorization levels that are enforced at the hardware access level, making the protection mechanism compatible with FPGA binary files while maintaining security.
Data Source
AI summary
Embodiments of the present disclosure provide a method, apparatus and computer program product for executing an application in clouds. In the method according to an embodiment of the present disclosure, an application execution request from a user for executing an application in clouds is received. In response to the application execution request, a monitoring module and a protection data configuration are uploaded into a runtime environment, the protection data configuration defining sensitive data which are not allowed to be accessed by a user of low authorization level. By the monitoring module, data input and data output of the user during execution of the application are monitored based on the protection data configuration to prevent the user of low authorization level from accessing the sensitive data. Embodiments of the present disclosure can achieve effective protection for sensitive data during the process of executing the application.