SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> C. TRUSTED COMPUTING <s> FPGA manufacturers have offered devices with bitstream protection for a number of years. This feature is currently primarily used to prevent IP piracy through cloning. However, in this paper we describe how protected bitstreams can also be used to create a root of trust for the clients of cloud computing services. Unlike related software-based solutions, this hardware-based approach solves a fundamental problem that currently impedes the greater adoption of cloud computing: how to secure client data and computation from both potential external attackers and an untrusted system administrator. We examine how this approach can be applied to the specific application of handling sensitive health data. This system maintains the advantages of the cloud with minimal additional hardware. We also describe how this system can be extended to provide a more generic secure cloud architecture. <s> BIB001 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> C. TRUSTED COMPUTING <s> Cloud computing is becoming a major trend for delivering and accessing infrastructure on demand via the network. Meanwhile, the usage of FPGAs (Field Programmable Gate Arrays) for computation acceleration has made significant inroads into multiple application domains due to their ability to achieve high throughput and predictable latency, while providing programmability, low power consumption and time-to-value. Many types of workloads, e.g. databases, big data analytics, and high performance computing, can be and have been accelerated by FPGAs. As more and more workloads are being deployed in the cloud, it is appropriate to consider how to make FPGAs and their capabilities available in the cloud. However, such integration is non-trivial due to issues related to FPGA resource abstraction and sharing, compatibility with applications and accelerator logics, and security, among others. In this paper, a general framework for integrating FPGAs into the cloud is proposed and a prototype of the framework is implemented based on OpenStack, Linux-KVM and Xilinx FPGAs. The prototype enables isolation between multiple processes in multiple VMs, precise quantitative acceleration resource allocation, and priority-based workload scheduling. Experimental results demonstrate the effectiveness of this prototype, an acceptable overhead, and good scalability when hosting multiple VMs and processes. <s> BIB002 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> C. TRUSTED COMPUTING <s> Data centers are experiencing an exponential increase in the amount of network traffic that they have to sustain due to cloud computing and several emerging web applications. To face this network load, large data centers are required with thousands of servers interconnected with high bandwidth switches. Current data center, based on general purpose processor, consume excessive power while their utilization is quite low. Hardware accelerators can provide high energy efficiency for many cloud applications but they lack the programming efficiency of processors. In the last few years, there several efforts for the efficient deployment of hardware accelerators in the data centers. This paper presents a thorough survey of the frameworks for the efficient utilization of the FPGAs in the data centers. Furthermore it presents the hardware accelerators that have been implemented for the most widely used cloud computing applications. Furthermore, the paper provides a qualitative categorization and comparison of the proposed schemes based on their main features such as speedup and energy efficiency. <s> BIB003 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> C. TRUSTED COMPUTING <s> Intel’s Software Guard Extensions (SGX) is a set of extensions to the Intel architecture that aims to provide integrity and confidentiality guarantees to securitysensitive computation performed on a computer where all the privileged software (kernel, hypervisor, etc) is potentially malicious. This paper analyzes Intel SGX, based on the 3 papers [14, 78, 137] that introduced it, on the Intel Software Developer’s Manual [100] (which supersedes the SGX manuals [94, 98]), on an ISCA 2015 tutorial [102], and on two patents [108, 136]. We use the papers, reference manuals, and tutorial as primary data sources, and only draw on the patents to fill in missing information. This paper’s contributions are a summary of the Intel-specific architectural and micro-architectural details needed to understand SGX, a detailed and structured presentation of the publicly available information on SGX, a series of intelligent guesses about some important but undocumented aspects of SGX, and an analysis of SGX’s security properties. <s> BIB004 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> C. TRUSTED COMPUTING <s> Editor’s note: In cloud computing framework, the data security and protection is one of the most important aspects for optimization and concrete implementation. This paper proposes a reliable yet efficient FPGA-based security system via crypto engines and Physical Unclonable Functions (PUFs) for big data applications. Considering that FPGA or GPU-based accelerators are popular in data centers, we believe the proposed approach is very practical and effective method for data security in cloud computing. —Gi-Joon Nam, IBM Research <s> BIB005 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> C. TRUSTED COMPUTING <s> We consider the problem of how to provide an execution environment where the application's secrets are safe even in the presence of malicious system software layers. We propose Iso-X-a flexible, fine-grained hardware-supported framework that provides isolation for security-critical pieces of an application such that they can execute securely even in the presence of untrusted system software. Isolation in Iso-X is achieved by creating and dynamically managing compartments (isolated software modules) to host critical fragments of code and associated data. Iso-X provides fine-grained isolation at the memory-page level, flexible allocation of memory, and a low-complexity, hardware-only trusted computing base. Iso-X requires minimal additional hardware, a small number of new ISA instructions to manage compartments, and minimal changes to the operating system which need not be in the trusted computing base. The run-time performance overhead of Iso-X is negligible and even the overhead of creating and destroying compartments is modest. An FPGA implementation of Iso-X runtime mechanisms shows a negligible impact on the processor cycle time. <s> BIB006 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> C. TRUSTED COMPUTING <s> Modern CPU designs are beginning to incorporate secure hardware features, but leave developers with little control over both the set of features and when and whether updates are available. Reconfigurable logic (e.g., FPGAs) has been proposed as an alternative as it is both hardware, so can have similar capabilities at a reasonable performance degradation, and programmable, allowing customization of the secure hardware. This programmability, however, opens new attack vectors that allow an adversary to re-program the FPGA. Past attempts to solve this rely on a party maintaining a shared key with the FPGA, but these business processes to keep that key secret have been shown to be quite vulnerable. In this paper, we propose a new mechanism which eliminates the trust dependence on third party processes. This new mechanism consists of a self-provisioning stage, where keys are generated internal to the FPGA and never exposed externally, coupled with a secure update mechanism which allows updates to be governed by a policy defined by the secure hardware application. To demonstrate, we fully implemented these mechanisms on a Xilinx Zynq UltraScale+ FPGA along with an example secure co-processor with remote attestation with a flexible root of trust (in contrast to Intel SGX which fixes the root of trust to be Intel). Our performance evaluation of two applications, a password manager and a contact matching application, illustrates using FPGAs is practical. <s> BIB007
Hashing functions also have a central role in establishing some form of trustworthiness in dedicated computing platforms, from embedded devices up to servers and cloud systems relying on heterogeneous accelerators. In the trusted computing jargon  , hashing is used to compute the so-called measurement of both hardware and software configurations, checking the full integrity of the system. These measurements can have various incarnations in real applications, beyond the strict definition given by trusted computing standards. Take as an example the emergence of FPGAs in the cloud. In the last few years, there has been an emerging interest in including reconfigurable hardware in cloud systems, as major cloud providers have started having FPGAs in their facilities BIB002 . This trend stems from the recognition that reconfigurable hardware implementations of commonly used algorithms can achieve better performance and improved power efficiency compared to classical CPU-based implementations BIB003 . Among the various challenges posed by the employment of reconfigurable hardware in cloud settings, there is the need to secure the provided bitstream. In fact, when the reconfigurable hardware is not under their direct control, users need to be guaranteed that the hardware accelerator synthesized on the remote FPGA is the one they submitted, and has not being tampered with, for example by adding backdoors for leaking user's data. This is particularly relevant when sensitive data is involved BIB001 . Moreover, it is also necessary to avoid that a single malicious FPGA brings down the entire facility BIB002 . Securing the provided bitstream implies that the accelerator running on the FPGA can be trusted, and therefore can operate with sensitive data with the guarantee that such data is properly handled. For example, BIB001 proposes an architecture for trusted FPGA in the cloud where a hardware SHA-2 accelerator is employed to authenticate the bitstream supplied to the FPGA. A similar system is employed in BIB005 , where the use of trusted accelerators on reconfigurable hardware is proposed for preventing software running on the CPU from accessing sensitive data by offloading them to the FPGA, although in the latter work the components of the secure system are synthesized on the programmable part of the FPGA along with the user's design, where they are included through a dedicated toolchain. Interestingly, reconfigurable hardware is also used to implement trusted execution environments (TEEs) similar to Intel SGX BIB004 , mainly aiming to avoid the need for the manufacturer, e.g. Intel, to directly verify the code running in the TEE BIB007 . An example of such approaches is proposed in BIB006 , where the case is made for hardware SHA-2 circuits into the trusted processor architecture in order to minimize the security overhead. Another proposal is outlined in BIB007 , where a SHA-512 accelerator is employed as a PRNG. 