Scalable Architecture of Network Security Systems

In order to improve the flexibility of computer protection on relay protection and to simplify the development process, this paper presents a new method which a programmable logic is applied to relay protection in form of software and hardware platform. The method can better satisfy the needs of relay protection. Aiming at the shortage of traditional relay protection deceive, this paper mainly discuss how to realize the modularization of the new hardware and software platform and to make the theoretical analysis about logic hardware and software platform.

A hardware and software platform is presented enabling the design, and realisation via printing, of smart fabrics. The cultural and creative industries are an important economic area within which designers frequently utilise fabrics. Smart fabrics offer further creative opportunities to the cultural and creative industries, but designers often lack the required specialist knowledge, in electronics, software and materials, to produce smart fabrics. The software platform offers the ability to perform design, layout and visualisation of a smart fabric using a library of standard smart fabric functions (e.g. electroluminescence) so specialist expertise is not needed. Operation of the smart fabric can be simulated, and parameters can be set for smart fabric control electronics, which consists of standard circuit board modules. The software also provides driver code for the hardware platform to print the smart fabric. The hardware platform consists of a bespoke dispenser printer; functional inks are deposited via a pneumatic syringe controlled by the driver software, allowing bespoke rapid prototyped smart fabrics to be printed. Operation of the software and hardware system is demonstrated by the realisation of an interactive smart fabric consisting of electroluminescent lamps controlled by a proximity sensor. The modular electronics are used to control the smart fabric operation using embedded code generated by the software platform. For example, the blink rate of the electroluminescent lamp can be adjusted by the proximity of a hand. This control is achieved by the use of intuitive drop-down menus and input/output selections by the creative user. At present, the platform allows the design, print and implementation of smart fabrics incorporating the functions of colour change, electroluminescence, sound emission and proximity sensing. The platform can be expanded to add additional functions in the future and the printer will be compatible with new inks developed for screen and inkjet printing.

A small-size software defined cognitive radio equipment that is composed of a hardware platform and a software platform has been introduced. The hardware platform is composed of a multiband/tunable RF unit with multiple switching circuits, and the signal processing unit is composed of FPGA and CPU boards. The software platform is composed of several managers that manage spectrum sensing and reconfiguration of communication systems and is worked on the Linux. The developed cognitive radio prototype combined by hardware and software platforms senses the signal level (RSSI) over 400 MHz-6 GHz bands and moreover identifies the system by using reconfiguration of software packages and checks RSSI, BER, connectivity, and so on. The software packages can configure specified wireless communication systems and consist of physical layer, MAC/DLC layer, IP layer, and application layer part of the systems. This paper also describes the sensing time and reconfiguration time.

A software defined cognitive radio prototype that consists of a hardware platform and a software platform has been developed. The hardware platform consists of a multi-band antenna supported from UHF band and 2-5 GHz band, multiband RF unit, signal processing unit consists of FPGA and CPU boards. The software platform consists of several managers that manage spectrum sensing and reconfiguration of communication systems by changing software packages. The software packages (called as "waveform") configure specified wireless communication systems and consist of physical layer, MAC/DLC layer, IP layer, and application layer part of the systems. This paper introduces the configuration of the hardware and software platforms and addresses a measurement result of spectrum sensing period and reconfiguration period by using software packages of W-CDMA and IEEE802.11a.

This paper describes the implementation of temperature controller based on fuzzy logic intended for industrial application in software and hardware platform. C++ is chosen as the software platform while VHDL is chosen as the hardware platform. The system is built of four major modules called fuzzification, inference, implication and defuzzification. The composition method selected for the fuzzy model is the max-min composition while the Mamdani min operator was chosen as the implication method. Following the successful simulation, verification, analysis and comparison were performed for both implementations. It is shown that both implementations produce similar results in term of functionalities and outputs with the maximum of 1.18% deviations. This shows the algorithm advantage for dual implementations which is the objective of this work.

Passive bistatic radar is a novel radar technology that passively detects targets without actively emitting signals. Since passive bistatic radar entails larger data volumes and computations compared to traditional active radiation radar, the development of hardware and software platforms capable of efficiently processing signals from passive bistatic radar has emerged as a research focus in this field. This research investigates the signal processing flow of passive bistatic radar based on its characteristics and devises a parallel signal processing scheme under graphic processing unit (GPU) architecture for computation-intensive tasks. The proposed scheme utilizes high-computing-power GPU as the hardware platform and compute unified device architecture (CUDA) as the software platform and optimizes the extensive cancellation algorithm batches (ECA-B), range Doppler and constant false alarm detection algorithms. The detection and tracking of a single target are realized on the passive bistatic radar dataset of natural scenarios, and experiments show that the design of this algorithm can achieve a maximum acceleration ratio of 113.13. Comparative experiments conducted with varying data volumes revealed that this method significantly enhances the signal processing rate for passive bistatic radar.

This paper introduces a proof-of-concept 6LoWPAN
\ntestbed to study the integration of programmable network
\ntechnologies in relaxed throughput and low-power IoT devices.
\nOpen source software and hardware platforms are used in
\nthe implemented testbed to increase the possibility of future
\nnetwork extension. The proposed architecture offers end-to-end
\nconnectivity via the 6LoWPAN gateway to integrate IPv6 hosts
\nand the low data rate devices directly. Nowadays, SoftwareDefined
\nNetworking (SDN) and Network Function Virtualization
\n(NFV) are the most promising technologies for dealing with the
\nmassive increase in M2M devices and achieving agile traffic. The
\ndeveloped approach in this paper is entitled tailored Software
\nDefined-Network Function Virtualization (SD-NFV), which is
\naimed at reducing the end-to-end delay and improving the
\nenergy depletion in sensor nodes. Experimental scenarios of
\nthe implemented testbed are conducted using a simple sensing
\napplication and the obtained results indicate that the introduced
\napproach is appropriate for constrained IoT devices. By utilizing
\nSD-NFV scheme in 6LoWPAN network, the data delivery ratio
\nincreased by 5-14%, the node operational time prolonged by
\n70%, the end-to-end latency for gathering sensor data minimized
\nby ≈160%, and the latency for transmitting control messages
\nto a specified node diminished by ≈63% when compared to a
\ntraditional (non SDN-enabled) 6LoWPAN network.

Of late, most types of AC motors can be operated using Variable Frequency Drives (VFDs) by merely selecting the type of motor and the corresponding control method using sophisticated all-in-one software platform. As technology improves, the VFD is becoming more of a plug and play, software based electrical equipment. There have been no comparable technological advancement/improvements in the hardware realm except for the potential use of wide band gap devices (Si-C or Ga-N) to reduce losses. The idea being proposed here is a hardware platform which is similar to an all-in-one software platform. By reconfiguring the hardware platform, one could achieve totally new or additional features that can enhance the overall performance of a VFD. It is shown that by adding one small hardware device as part of the main VFD, the unit can be reconfigured to provide four distinct features/functions as desired. An off-the-shelf VFD is used as an example to illustrate the various configurations achievable based on the proposed hardware modification. The proposed topology's cost, size, and features are compared with a traditional VFD with externally added components to achieve similar features/functions.

Aim. Threats of a non-physical nature have a significant effect on the security of intelligent transportation systems (ITS). They may have the form of unlawful interference in the development and implementation of ITS. The creation of a trusted framework for the development and implementation of ITS is examined as in the case of intelligent water transportation systems (IWTS). Problems. By decree of the President of the Russian Federation, ITS, telecommunications and security of information processing are among the priority areas of scientific and technological development. ITS technologies, as well as those involved in the creation of trusted, secure system and application software are among the most important critical high technologies. The operation of ITS involves wide use of computerised systems that implement the latest information and telecommunication technologies, automated and automatic control technologies, artificial intelligence that can pose security threats. ITS are to be developed and operated in a trusted environment. Methods. The paper used the methodology for ensuring the security of IWTS, development of secure hardware and software platforms for secure automated systems, methods of system analysis, dependability theory, information protection, and law. Results. The paper defines the problem of creating a trusted framework for the development and implementation of IWTS, the applicable terminology is developed. The author examined the effect of IWTS on the security of critical information infrastructure (CII) and national security, developed a model of relationships between the IWTS security domains taking into account threats of physical and non-physical origin. Examples of computer incidents within IWTS that caused consequences at the national and international levels are given. The composition of the IWTS facilities attributed to CII is defined, critical processes implemented by standard CII facilities as part of the IWTS are set forth. The author lists conceptual problems of IWTS security, defines the principles of creating a trusted framework for the development and implementation of IWTS. Conclusion. Ensuring the security of IWTS against modern threats requires solving a number of problems associated with the creation of a trusted framework for the development and implementation of IWTS. For the purpose of improving the timeliness and quality of their solution, the paper proposes an intuitive terminology that reflects the subject area and helps finding a common understanding of the security domain by experts from various industries. IWTS facilities have an effect on CII security and national security in general. That is taken into account in the model of relationships between IWTS security domains, demonstrated using cases of computer incidents within IWTS that caused consequences at the national and international level. Given the above, the paper lists IWTS facilities attributed to CII and sets forth examples of critical processes implemented by standard CII facilities as part of the IWTS. The defined list of conceptual IWTS security problems take into account the growing landscape of IWTS security threats that includes insecure software, hardware and software platforms, software and hardware systems and emerging technologies. When developing the principles for the creation of a trusted IWTS development and implementation framework, the author took into account the best practice of implementing the methodology for creating national secure hardware and software platforms of CII facilities that enables the creation of secure automated systems for various applications that are based on domestically-developed solutions. The examined matters are of a systemic nature, which allows using the findings in the development and implementation of ITS in other modes of transportation.

The scope of modern power plant controls usually includes plant DCS, boiler control and protection, steam/gas turbine governor and protection, auxiliaries control, automatic voltage controller, automatic synchronizer and operator/engineering stations. Usually these control packages come from different manufacturers (OEM). They are typically based on various electronic hardware and software platforms. Different communication protocols often present problems during system integration; and maintenance costs of these various electronic hardware and software platforms are normally greater than that of a stand alone system. Advantages of an integrated, distributed, open architecture, digital system, (Fig. 1) which covers all the power plant needs are discussed in this paper. A common electronic hardware/ software platform allows optimization of the new constructions and upgrades, shorten delivery and commissioning time, and improve availability and safety of the new and upgraded power plants. Specific benefits of this concept are presented in the Mt. Poso controls upgrade Case Study. The common electronic hardware/ software platform installed at Mt. Poso allowed optimization of the upgrade, shortened commissioning time, improved availability, reliability and safety and reduced maintenance cost of the control systems.

The new generation of smart meters need to realize the requirements of flexible expansion of advanced applications and transplantation of application software across hardware platforms. The software platform composed of operating system and middle layer service components is conducive to reducing the cost of software and hardware development and management. This paper first introduces the research and development background of the new generation smart meter, then introduces its overall software and hardware architecture and management unit hardware development platform, then introduces the construction of development environment and development tools and the basic functions based on the software platform, and finally introduces the development practice of application software. The large-scale promotion of the new generation of smart meters has become a development trend. This paper has a good reference for the application software development based on the new generation of smart meter software platform and is conducive to promoting the large-scale application of the new generation of smart meters.

In Electroencephalography (EEG) classifiers, processing of EEG signals consists of extracting features from EEG signal and then processing those features to classify the signals. As of today, in most EEG processing systems, the classification part is done on software platform even though the feature extraction is done on hardware. Hence this require an operating system which limits the development of portable medical devices. This paper presents the design and implementation of feature classification in EEG signal processing system on Field Programmable Gate Array (FPGA) hardware platform. The classification is done with two-class Linear Discriminant Analysis (LDA), based on the features extracted using Discrete Wavelet Transform (DWT), for EEG signals obtained through PhysioNet website. The final design has minimum resource utilization, hence is able to implement on Basys 3 Artix-7 FPGA Board platform using SystemVerilog with SO % hardware accuracy. From this result, it is concluded that this design is suitable for developing low cost, marketable products like sleep detectors for automobile divers. Nevertheless, ultimate the goal is to design a full system, which extracts features and classify EEG signals, that can be implemented without using software platform.

Side-channel analysis (SCA) is launched by exploiting the information leaking from the implementation a cryptographic algorithm, e.g., power consumption information. Recently, deep learning-based SCA techniques have also facilitated SCA against software and hardware implementations of various cryptographic algorithms. In this work, we perform SCA using various deep learning (DL) techniques such as Multi-layered Perceptron (MLP), Convolutional Neural Network (CNN), and Recurrent Neural Network (RNN) on the datasets collected from hardware and software platforms. The objective of this work is to identify the performance of DL techniques in performing SCA for secret key recovery and finding out the best settings for the model to optimize the attack performance in terms of on computation time and SCA efficiency. In our study, we have focused on two open-source AES-128 encryption algorithm databases, ASCAD and DPA contest v2 (DPAv2), where ASCAD database consists of the power traces captured from a software implementation of the AES and DPAv2 database consists of the power traces captured a hardware implementation of the AES. For the first time, we applied hyperparameter tuning with Bayesian Optimization and distributed computing on ASCAD database and we investigated the impact of MLP and RNN along with the distributed computing and hyperparameter tuning with Bayesian optimization on DPAv2 database. Our results show that the CNNs are the best models for performing the attack on software implementation while MLPs are the best for attacking hardware implementation of cryptographic algorithms.

The rapid growth of internet technology combined with affordable storage capabilities has lead to many challenges for efficient retrieval of information especially images for real time applications. One way of supplementing the software approaches is to provide hardware support to the system architecture. We propose an algorithm and architecture to implement trace transform based CBIR system. The proposed algorithm is optimized for time and space parameters by reducing the addressing complexity of the feature extraction phase. Further optimization is achieved in the similarity phase by using hamming distance measure and threshold based sorting algorithm, which is possible because the identifier is a binary string. Synthesis results show that the above optimizations have led to reduction in the response time of the retrieval process and we are able to process 8389 images per second. A speed up factor of 1079 is achieved on the hardware platform when compared to the implementation of the proposed algorithm on the software platform.

The correct implementation of network policies (e.g., routing, NAT, VPNs, load balancing, and IDS/IPS) for underlying network functions is critical, as it determines the security, availability and performance of a production network. However, it is notoriously known that making sure network policies are correctly implemented is challenging, even for basic reachability policies. This becomes more challenging in cloud environments featured with SDN-enabled NFV, where multiple tenants are hosted with richer in-network services in the form of chained, virtualized network functions with dynamic, customized network policies. To address this problem, existing approaches have been proposed to model network behaviors, generate synthetic network traffic, and verify network policies. However, these solutions face a fundamental challenge in SDN-enabled NFV --- lack of capturing dynamics of the production system. For example, virtual network functions (running in virtual machines) can be arbitrarily composed to realize service chaining on the fly; the chained network functions create more complex unpredictable network policies. Further, the on-demand cloud service model compounds this complexity with dynamic loads and varying network function requirements. One (seemingly straightforward) solution may be to extend existing network models to capture dynamic system behaviors, and thus generate test traffic with broader coverage. However, despite the possibility of doing so, such model-based approaches will easily result in state-space explosion, which will take extensive time for completing a simple network verification task even for a small network. On the other hand, focusing on a subset of intended polices may reduce the state space, but could fail to catch some critical sources of violations in practice --- in most cases, it is even hard (or impossible) to know the polices without really operating network functions in a production environment (e.g., with improvised changes in NFV configurations/policies). Ideally, conducting network verification in a live production environment --- complementary to model-based verification approaches --- is attractive, as production traffic captures the most exact, realistic dynamic state of the system that model-based verification tools cannot provide. However, doing so brings potential risks of impacting or even damaging a live production environment, as mis-configured inline test network functions could wrongly manipulate network traffic --- numerous network outrages are actually caused by (tiny) mis-configurations of a live production system. It becomes more problematic in multi-tenant cloud, as such misbehaviors could impact other tenants. In this paper, we present ShadeNF, a novel online verification platform for testing in-cloud network functions in a production-like environment, without disrupting the live production system. ShadeNF enables such a production-like test environment (i.e., the shadow system) with an exact clone of the production network functions (to be tested), which captures the dynamic state and vulnerabilities of the live production system. Further, ShadeNF delicately steers live production traffic to the shadow system as the test traffic, which captures the dynamic state of the production workloads. The actual verification is operated in a completely isolated environment with desired resources (e.g., CPU, memory and storage), thus not interfering with the production system. We make three key contributions in ShadeNF: First, ShadeNF introduces a new live, consistent snapshot approach to clone chained, dependent network functions by leveraging SDN virtual switches. This approach both preserves a consistent snapshot and reduces performance overhead with no modifications to VMs software and legacy network flows. Second, to capture the dynamics of the production workloads, ShadeNF creates a new traffic forwarding plane, which selectively, unidirectionally steers the production traffic to the test system with new programmable forwarding pipes. These forwarding pipes also enable the autochaining of arbitrary network functions. Last, to explore broader test coverage, ShadeNF advances existing model-based approaches by taking patterns of real production traffic into consideration --- ShadeNF populates synthetic test traffic with realistic traffic patterns that are captured and provided automatically. We have implemented a ShadeNF platform prototype upon OpenStack. Our evaluation in a real cloud testbed shows that: (1) ShadeNF captures the dynamics of a production system without affecting the production system; (2) ShadeNF can effectively detect a variety of policy violations.