Person | TU Delft Repository

Design for a TCP/IP transparent FPGA-based network diode

To what extent is it possible to implement a network diode on an FPGA under realistic network environments, using the Transmission Control Protocol?

Master thesis (2021) - J. Kerkhof, J.S.S.M. Wong, A.J. van Genderen, T.G.R.M. van Leuken, A.D. Wiersma

The urgency for high-security products for industrial networks is increasing as malicious hackers are improving their accessibility tools. A common practice for a company to protect its sensitive data is network segmentation. The network is segmented in different domains with dis ...

The urgency for high-security products for industrial networks is increasing as malicious hackers are improving their accessibility tools. A common practice for a company to protect its sensitive data is network segmentation. The network is segmented in different domains with distinctive security levels. The sensitive data is stored and managed within the domain of the highest security level. To access this domain from another domain of a lower security level, a highly reliable connection is required. You want to have full control over the incoming and outgoing data flow between these network segments. A variety of solutions provide a highly-secured connection to link those segments which differ in range of features and control. An upcoming trend is the network diode. This device will allow data flow in only one direction. All the flows going into the opposite direction are being blocked. However, to feature an arbitrary flow between two network segments, the diode should consist of a numerous amount of properties. To narrow down the optional features a network diode should provide, this thesis will focus on TCP streams. TCP is one of the most common protocols used in internet traffic. Furthermore, TCP is a challenging protocol as it is a connection-oriented bidirectional protocol, which is intrinsic controversial with the concept of the data diode. To ensure the security of the data diode, this thesis will focus on a complete hardware design of the data diode. Software inside the data diode is still a risk for a security breach. This thesis will investigate the critical operations of TCP to implement them in the data diode. The aim is to utilise TCP's characteristic operations of the acknowledgement managing, the sliding window system, the congestion control algorithm, and explores the advantage of existing TCP options. To evaluate the feasibility of a high performance data diode featuring TCP, the system is broken down to project the behaviour of a TCP stream on a one-way connection device. This results in two separate TCP connections, with only the precious data as common shared information. This model requires a buffer at one side of the diode to transmit data in a TCP stream. To analyse and examine the influence of the diode configuration to the size of the buffer, a diode module is created to simulate in a OMNeT++ environment. From this simulation tool, a minimal set of parameters can be extracted that are essential to configure the data diode. With the assumption of having control on the network management at the trusted side of the diode, a configuration without a congestion control algorithm and without adding radical TCP options is recommended to minimise the required buffer size. Thereafter, this thesis proposes a high-level hardware design to implement the data diode on a hardware project. The design focuses on the high data rate which should be available to satisfy the data diode's requirements. Finally, this thesis concludes with an elaboration on the assumptions of the limitations of the network environments and recommends features to implement in future work.

Design for a TCP/IP transparent FPGA-based network diode

To what extent is it possible to implement a network diode on an FPGA under realistic network environments, using the Transmission Control Protocol?

Master thesis (2021) - J. Kerkhof, J.S.S.M. Wong, A.J. van Genderen, T.G.R.M. van Leuken, A.D. Wiersma

The urgency for high-security products for industrial networks is increasing as malicious hackers are improving their accessibility tools. A common practice for a company to protect its sensitive data is network segmentation. The network is segmented in different domains with dis ...

The urgency for high-security products for industrial networks is increasing as malicious hackers are improving their accessibility tools. A common practice for a company to protect its sensitive data is network segmentation. The network is segmented in different domains with distinctive security levels. The sensitive data is stored and managed within the domain of the highest security level. To access this domain from another domain of a lower security level, a highly reliable connection is required. You want to have full control over the incoming and outgoing data flow between these network segments. A variety of solutions provide a highly-secured connection to link those segments which differ in range of features and control. An upcoming trend is the network diode. This device will allow data flow in only one direction. All the flows going into the opposite direction are being blocked. However, to feature an arbitrary flow between two network segments, the diode should consist of a numerous amount of properties. To narrow down the optional features a network diode should provide, this thesis will focus on TCP streams. TCP is one of the most common protocols used in internet traffic. Furthermore, TCP is a challenging protocol as it is a connection-oriented bidirectional protocol, which is intrinsic controversial with the concept of the data diode. To ensure the security of the data diode, this thesis will focus on a complete hardware design of the data diode. Software inside the data diode is still a risk for a security breach. This thesis will investigate the critical operations of TCP to implement them in the data diode. The aim is to utilise TCP's characteristic operations of the acknowledgement managing, the sliding window system, the congestion control algorithm, and explores the advantage of existing TCP options. To evaluate the feasibility of a high performance data diode featuring TCP, the system is broken down to project the behaviour of a TCP stream on a one-way connection device. This results in two separate TCP connections, with only the precious data as common shared information. This model requires a buffer at one side of the diode to transmit data in a TCP stream. To analyse and examine the influence of the diode configuration to the size of the buffer, a diode module is created to simulate in a OMNeT++ environment. From this simulation tool, a minimal set of parameters can be extracted that are essential to configure the data diode. With the assumption of having control on the network management at the trusted side of the diode, a configuration without a congestion control algorithm and without adding radical TCP options is recommended to minimise the required buffer size. Thereafter, this thesis proposes a high-level hardware design to implement the data diode on a hardware project. The design focuses on the high data rate which should be available to satisfy the data diode's requirements. Finally, this thesis concludes with an elaboration on the assumptions of the limitations of the network environments and recommends features to implement in future work.

Design for a TCP/IP transparent FPGA-based network diode

To what extent is it possible to implement a network diode on an FPGA under realistic network environments, using the Transmission Control Protocol?

Master thesis (2021) - J. Kerkhof, J.S.S.M. Wong, A.J. van Genderen, T.G.R.M. van Leuken, A.D. Wiersma

The urgency for high-security products for industrial networks is increasing as malicious hackers are improving their accessibility tools. A common practice for a company to protect its sensitive data is network segmentation. The network is segmented in different domains with dis ...

The urgency for high-security products for industrial networks is increasing as malicious hackers are improving their accessibility tools. A common practice for a company to protect its sensitive data is network segmentation. The network is segmented in different domains with distinctive security levels. The sensitive data is stored and managed within the domain of the highest security level. To access this domain from another domain of a lower security level, a highly reliable connection is required. You want to have full control over the incoming and outgoing data flow between these network segments. A variety of solutions provide a highly-secured connection to link those segments which differ in range of features and control. An upcoming trend is the network diode. This device will allow data flow in only one direction. All the flows going into the opposite direction are being blocked. However, to feature an arbitrary flow between two network segments, the diode should consist of a numerous amount of properties. To narrow down the optional features a network diode should provide, this thesis will focus on TCP streams. TCP is one of the most common protocols used in internet traffic. Furthermore, TCP is a challenging protocol as it is a connection-oriented bidirectional protocol, which is intrinsic controversial with the concept of the data diode. To ensure the security of the data diode, this thesis will focus on a complete hardware design of the data diode. Software inside the data diode is still a risk for a security breach. This thesis will investigate the critical operations of TCP to implement them in the data diode. The aim is to utilise TCP's characteristic operations of the acknowledgement managing, the sliding window system, the congestion control algorithm, and explores the advantage of existing TCP options. To evaluate the feasibility of a high performance data diode featuring TCP, the system is broken down to project the behaviour of a TCP stream on a one-way connection device. This results in two separate TCP connections, with only the precious data as common shared information. This model requires a buffer at one side of the diode to transmit data in a TCP stream. To analyse and examine the influence of the diode configuration to the size of the buffer, a diode module is created to simulate in a OMNeT++ environment. From this simulation tool, a minimal set of parameters can be extracted that are essential to configure the data diode. With the assumption of having control on the network management at the trusted side of the diode, a configuration without a congestion control algorithm and without adding radical TCP options is recommended to minimise the required buffer size. Thereafter, this thesis proposes a high-level hardware design to implement the data diode on a hardware project. The design focuses on the high data rate which should be available to satisfy the data diode's requirements. Finally, this thesis concludes with an elaboration on the assumptions of the limitations of the network environments and recommends features to implement in future work.

Hardware-Based Methods for Memory Acquisition

Analysis and Improvements

Master thesis (2021) - R. van Leenen, M. Taouil, M.L.J. van Beusekom, N. van Heijningen, S. Hamdioui, T.G.R.M. van Leuken, J. Rongen

Some server hosters facilitate cyber crime either intentionally (so called “bulletproof hosters”) or unintentionally (“bad hosters”). When dealing with uncooperative hosters during forensic investigations, it may sometimes be necessary to collect data or info ...

Hardware-Based Methods for Memory Acquisition

Analysis and Improvements

Master thesis (2021) - R. van Leenen, M. Taouil, M.L.J. van Beusekom, N. van Heijningen, S. Hamdioui, T.G.R.M. van Leuken, J. Rongen

Some server hosters facilitate cyber crime either intentionally (so called “bulletproof hosters”) or unintentionally (“bad hosters”). When dealing with uncooperative hosters during forensic investigations, it may sometimes be necessary to collect data or info ...

Hardware-Based Methods for Memory Acquisition

Analysis and Improvements

Master thesis (2021) - R. van Leenen, M. Taouil, M.L.J. van Beusekom, N. van Heijningen, S. Hamdioui, T.G.R.M. van Leuken, J. Rongen

Some server hosters facilitate cyber crime either intentionally (so called “bulletproof hosters”) or unintentionally (“bad hosters”). When dealing with uncooperative hosters during forensic investigations, it may sometimes be necessary to collect data or info ...

Population Step Forward Encoding Algorithm

Improving the signal encoding accuracy and efficiency of spike encoding algorithms

Master thesis (2021) - L. de Gelder, T.G.R.M. van Leuken, Amir Zjajo

Conversion from digital information to spike trains is needed for Spiking Neural Networks. Moreover, it is one of the most important steps for Spiking Neural Networks. This conversion could lead to much information loss depending on which encoding algorithm is used. Another major ...

Population Step Forward Encoding Algorithm

Improving the signal encoding accuracy and efficiency of spike encoding algorithms

Master thesis (2021) - L. de Gelder, T.G.R.M. van Leuken, Amir Zjajo

Conversion from digital information to spike trains is needed for Spiking Neural Networks. Moreover, it is one of the most important steps for Spiking Neural Networks. This conversion could lead to much information loss depending on which encoding algorithm is used. Another major ...

Physical Characterization of Asynchronous Logic Library

A Design of AER Transmitter and Its Characterization and Back-end Design Flow

Master thesis (2021) - P. Li, T.G.R.M. van Leuken, Amir Zjajo

Neuromorphic electronic systems have used asynchronous logic combined with continuous-time analog circuits to emulate neurons, synapses, and learning algorithms. It is attractive because of its low power consumption and feasible implementation. Typically, the neuron firing rates ...

N-shot Training Methodology

For Spiking Neural Networks(SNNs)

Master thesis (2019) - N. Joshi, T.G.R.M. van Leuken, Z. Al-Ars, S.S. Kumar, Amir Zjajo

Traditional Artificial Neural Networks(ANNs)like CNNs have shown tremendous opportunities in various domains like autonomous cars, disease diagnosis, etc. Proven learning algorithms like backpropagation help ANNs in achieving higher accuracy. But there is a serious challenge with ...

N-shot Training Methodology

For Spiking Neural Networks(SNNs)

Master thesis (2019) - N. Joshi, T.G.R.M. van Leuken, Z. Al-Ars, S.S. Kumar, Amir Zjajo

Traditional Artificial Neural Networks(ANNs)like CNNs have shown tremendous opportunities in various domains like autonomous cars, disease diagnosis, etc. Proven learning algorithms like backpropagation help ANNs in achieving higher accuracy. But there is a serious challenge with ...

Source-Synchronous Interface with All-Digital Data Recovery

A Low-cost Efficient Design

Master thesis (2017) - S. Zhang, T.G.R.M. van Leuken

This thesis proposes a low-cost high-efficiency source-synchronous interface for high-speed inter-chip communication. The interface is composed of LVDS transceivers as external I/O buffers, and an all-digital data recovery, which can calibrate the received data phase to be aligne ...

ρ-VEX ASIC

The Design of an ASIC for a Dynamically Reconfigurable VLIW Processor with 24-port Register File

Master thesis (2017) - L. van Bremen, J.S.S.M. Wong, T.G.R.M. van Leuken, Z. Al-Ars

The ρ-VEX is a runtime reconfigurable VLIW processor. It is able to exploit both ILP as well as TLP by running one program in multiple lanes, or several programs concurrently. To accurately quantify its performance compared to other processors, it is implemented as an IC.
A f ...

The ρ-VEX is a runtime reconfigurable VLIW processor. It is able to exploit both ILP as well as TLP by running one program in multiple lanes, or several programs concurrently. To accurately quantify its performance compared to other processors, it is implemented as an IC.
A fully automatic scripted flow is described, constructing an optimized, error-free ASIC. The design area is limited to 3.5 um², to allow it to be manufactured with the cheapest 65 nm prototyping run available at IMEC. In order to achieve this small design area, a new 24-port register file design has to be devised. In its current state, it is implemented using standard logic cells. Clever optimizations involving cell padding and minimum overhead power routing are necessary to reduce a total routing overcongestion from 7% to zero.
This implementation is expected achieve a clock speed of 141 MHz, only limited by the ρ-VEX reconfiguration logic. By lowering the frequency to 100 MHz, the energy dissipation is reduced by 96%, to a total of 367 uW/MHz. This is comparable to similar VLIW designs. Using LVDS communication clocked at four times the core frequency, a data bandwidth of 4 Gbit/s is achieved using only 26 external pins. This allows the main data and instruction memory to reside off-chip.
To ensure a correct design, it is verified using DRC, LVS, and ERC. For improved reliability, IR-drop is kept within 1% of the core voltage, using minimal power routing. Furthermore, the effect of electromigration is kept extremely low such that the mean time to failure on nets is 90 years.
The scripted flow will aid in prototyping, allowing accurate estimates to be calculated in a mere 7% of the original time. Proposals for a future design are expected to reduce the register file area and power dissipation by more than 40%. By improving the pipeline and shortening the critical path, a two to four fold improvement in clock speed can be expected, without adversely affecting power dissipation.

ρ-VEX ASIC

The Design of an ASIC for a Dynamically Reconfigurable VLIW Processor with 24-port Register File

Master thesis (2017) - L. van Bremen, J.S.S.M. Wong, T.G.R.M. van Leuken, Z. Al-Ars

The ρ-VEX is a runtime reconfigurable VLIW processor. It is able to exploit both ILP as well as TLP by running one program in multiple lanes, or several programs concurrently. To accurately quantify its performance compared to other processors, it is implemented as an IC.
A f ...

The ρ-VEX is a runtime reconfigurable VLIW processor. It is able to exploit both ILP as well as TLP by running one program in multiple lanes, or several programs concurrently. To accurately quantify its performance compared to other processors, it is implemented as an IC.
A fully automatic scripted flow is described, constructing an optimized, error-free ASIC. The design area is limited to 3.5 um², to allow it to be manufactured with the cheapest 65 nm prototyping run available at IMEC. In order to achieve this small design area, a new 24-port register file design has to be devised. In its current state, it is implemented using standard logic cells. Clever optimizations involving cell padding and minimum overhead power routing are necessary to reduce a total routing overcongestion from 7% to zero.
This implementation is expected achieve a clock speed of 141 MHz, only limited by the ρ-VEX reconfiguration logic. By lowering the frequency to 100 MHz, the energy dissipation is reduced by 96%, to a total of 367 uW/MHz. This is comparable to similar VLIW designs. Using LVDS communication clocked at four times the core frequency, a data bandwidth of 4 Gbit/s is achieved using only 26 external pins. This allows the main data and instruction memory to reside off-chip.
To ensure a correct design, it is verified using DRC, LVS, and ERC. For improved reliability, IR-drop is kept within 1% of the core voltage, using minimal power routing. Furthermore, the effect of electromigration is kept extremely low such that the mean time to failure on nets is 90 years.
The scripted flow will aid in prototyping, allowing accurate estimates to be calculated in a mere 7% of the original time. Proposals for a future design are expected to reduce the register file area and power dissipation by more than 40%. By improving the pipeline and shortening the critical path, a two to four fold improvement in clock speed can be expected, without adversely affecting power dissipation.

Rene Leuken

Authored

Design for a TCP/IP transparent FPGA-based network diode

To what extent is it possible to implement a network diode on an FPGA under realistic network environments, using the Transmission Control Protocol?

Hardware­-Based Methods for Memory Acquisition

Analysis and Improvements

Population Step Forward Encoding Algorithm

Improving the signal encoding accuracy and efficiency of spike encoding algorithms

N-shot Training Methodology

For Spiking Neural Networks(SNNs)

Source-Synchronous Interface with All-Digital Data Recovery

A Low-cost Efficient Design

ρ-VEX ASIC

The Design of an ASIC for a Dynamically Reconfigurable VLIW Processor with 24-port Register File

Contributed

Design for a TCP/IP transparent FPGA-based network diode

To what extent is it possible to implement a network diode on an FPGA under realistic network environments, using the Transmission Control Protocol?

Design for a TCP/IP transparent FPGA-based network diode

To what extent is it possible to implement a network diode on an FPGA under realistic network environments, using the Transmission Control Protocol?

Design for a TCP/IP transparent FPGA-based network diode

To what extent is it possible to implement a network diode on an FPGA under realistic network environments, using the Transmission Control Protocol?

Hardware­-Based Methods for Memory Acquisition

Analysis and Improvements

Hardware­-Based Methods for Memory Acquisition

Analysis and Improvements

Hardware­-Based Methods for Memory Acquisition

Analysis and Improvements

Population Step Forward Encoding Algorithm

Improving the signal encoding accuracy and efficiency of spike encoding algorithms

Population Step Forward Encoding Algorithm

Improving the signal encoding accuracy and efficiency of spike encoding algorithms

Physical Characterization of Asynchronous Logic Library

A Design of AER Transmitter and Its Characterization and Back-end Design Flow

N-shot Training Methodology

For Spiking Neural Networks(SNNs)

N-shot Training Methodology

For Spiking Neural Networks(SNNs)

Source-Synchronous Interface with All-Digital Data Recovery

A Low-cost Efficient Design

ρ-VEX ASIC

The Design of an ASIC for a Dynamically Reconfigurable VLIW Processor with 24-port Register File

ρ-VEX ASIC

The Design of an ASIC for a Dynamically Reconfigurable VLIW Processor with 24-port Register File

Hardware-Based Methods for Memory Acquisition

Hardware-Based Methods for Memory Acquisition

Hardware-Based Methods for Memory Acquisition

Hardware-Based Methods for Memory Acquisition