The NADIA: A Network Acceleration System with Defense against Network Invasion and Attack

Abstract

Information security plays a critical role in the design of high-speed network systems, and much attention is focused on the Network Intrusion Prevention System (NIPS) which combines both a firewall and a Network Intrusion Detection System (NIDS). However, the current generation of NIDS/NIPS has several limitations on performance and effectiveness. In this paper, we describe the Network Accelerator with Defense against Invasion and Attack (NADIA) architecture as a network security card. The NADIA system consists of NADIA hardware for network and security processing and NADIA software for a device driver and a management agent. The goal of the network acceleration hardware is to reduce the overhead of the host CPU for network processing. And, the security function hardware performs operations such as network ACL, DPI, DDoS blocking, and session control, in order to check whether the received packets are malicious or not. Based on the performance evaluation, we can confirm that NADIA can reduce the CPU overhead of the network and security processing by a factor of 5~14.

Keywords:

• DDoS
• Gigabit/Home network
• Network offloading
• Network intrusion detection system
• Network intrusion prevention system
• Snort rule
• TCP/IP overhead

Additional information

Notes on contributors

Sunwook Kim

Sunwook Kim received the B.S. degree from Chungbuk National University, Korea, the M.S degree from Hanyang University, Korea in 1996 and 2001 respectively, all in computer science. And he is Ph.D. candidate in Korea University. He joined Electronics and Telecommunications Research Institute (ETRI) in Daejeon, Korea in 2001 and he is working as a senior research staff. He developed a linux device driver of InfiniBand HCA (Host Channel Adapter) and TOE (TCP Offloading Engine). His research interests include network acceleration for 10Gb, I/O Virtualization and Desktop Virtualization. E-mail: [email protected]

Byunggu Kim

Byunggu Kim received the B.S. and M.S. degrees in Information and Communication Engineering from Sungkyunkwan University in 1999 and 2001, respectively. Since 2001, he has stayed in Security Gateway System Team, Electronics and Telecommunications Research Institute(ETRI) of Korea to study Network Security related Topics. E-mail: [email protected]

Seongwoon Kim

Seongwoon Kim received the B.S. degree from Pukyong Natinal University, Korea, the M.S degree from Chungnam National University, Korea in 1987 and 1998 respectively. He received his Ph.D. degree from Chungnam National University, Korea in 2006. He joined Electronics and Telecommunications Research Institute (ETRI) in Daejeon, Korea in 1989 and he is working as a chief of team. His current interests include network acceleration for 10Gb, I/O Virtualization and Power Management. E-mail: [email protected]

Jinwon Park

Jinwon Park graduated from Seoul National University in Korea. He received Ph.D. degree from The Ohio State University in USA in 1987, majoring in industrial and systems engineering. He had been working at University of Southern Colorado (1987–1988) in USA and working at Electronics and Telecommunications Research Institute (ETRI) in Korea (1988–1999). He is currently working at Hongik University in Korea. His research interest is in the areas of storage systems and computer simulation for system optimization. E-mail: [email protected]

Yongwha Chung

Yongwha Chung received his B.S. and M.S. degrees from Hanyang University, Korea in 1984 and 1986, respectively. He received his Ph.D. degree from the University of Southern California, USA in 1997. He joined ETRI in 1986 and he was working for developing high-performance computing systems. Since 2003, he has been a professor at Korea University. His research interests include parallel architecture/algorithm for multimedia and security applications. E-mail: [email protected]