A Scalable High Throughput Firewall in FPGA

High end network security applications demand high speed operation and large rule set support. Packet classification is the core functionality that demands high throughput in such applications. This paper proposes a packet classification architecture to meet such high throughput. We have implemented a Firewall with this architecture in reconflgurable hardware. We propose an extension to Distributed Crossproducting of Field Labels (DCFL) technique to achieve scalable and high performance architecture. The implemented Firewall takes advantage of inherent structure and redundancy of rule set by using our DCFL Extended (DCFLE) algorithm. The use of DCFLE algorithm results in both speed and area improvement when it is implemented in hardware. Although we restrict ourselves to standard 5-tuple matching, the architecture supports additional fields. High throughput classification invariably uses Ternary Content Addressable Memory (TCAM) for prefix matching, though TCAM fares poorly in terms of area and power efficiency. Use of TCAM for port range matching is expensive, as the range to prefix conversion results in large number of prefixes leading to storage inefficiency. Extended TCAM (ETCAM) is fast and the most storage efficient solution for range matching. We present for the first time a reconfigurable hardware implementation of ETCAM. We have implemented our Firewall as an embedded system on Virtex-II Pro FPGA based platform, running Linux with the packet classification in hardware. The Firewall was tested in real time with 1 Gbps Ethernet link and 128 sample rules. The packet classification hardware uses a quarter of logic resources and slightly over one third of memory resources of XC2VP30 FPGA. It achieves a maximum classification throughput of 50 million packet/s corresponding to 16 Gbps link rate for the worst case packet size. The Firewall rule update involves only memory re-initialization in software without any hardware change.

A Scalable High Throughput Firewall in FPGA

High end network security applications demand high speed operation and large rule set support. Packet classification is the core functionality that demands high throughput in such applications. This paper proposes a packet classification architecture to meet such high throughput. We have Implemented a Firewall with this architecture in reconfigurable hardware. We propose an extension to Distributed Crossproducting of Field Labels (DCFL) technique to achieve scalable and high performance architecture. The implemented Firewall takes advantage of inherent structure and redundancy of rule set by using, our DCFL Extended (DCFLE) algorithm. The use of DCFLE algorithm results In both speed and area Improvement when It is Implemented in hardware. Although we restrict ourselves to standard 5-tuple matching, the architecture supports additional fields.High throughput classification Invariably uses Ternary Content Addressable Memory (TCAM) for prefix matching, though TCAM fares poorly In terms of area and power efficiency. Use of TCAM for port range matching is expensive, as the range to prefix conversion results in large number of prefixes leading to storage inefficiency. Extended TCAM (ETCAM) is fast and the most storage efficient solution for range matching. We present for the first time a reconfigurable hardware Implementation of ETCAM. We have implemented our Firewall as an embedded system on Virtex-II Pro FPGA based platform, running Linux with the packet classification in hardware. The Firewall was tested in real time with 1 Gbps Ethernet link and 128 sample rules. The packet classification hardware uses a quarter of logic resources and slightly over one third of memory resources of XC2VP30 FPGA. It achieves a maximum classification throughput of 50 million packet/s corresponding to 16 Gbps link rate for file worst case packet size. The Firewall rule update Involves only memory re-initialiization in software without any hardware change.

Bayesian and Decision Tree Approaches for Pattern Recognition Including Feature Measurement Costs

The minimum cost classifier when general cost functionsare associated with the tasks of feature measurement and classification is formulated as a decision graph which does not reject class labels at intermediate stages. Noting its complexities, a heuristic procedure to simplify this scheme to a binary decision tree is presented. The optimizationof the binary tree in this context is carried out using ynamicprogramming. This technique is applied to the voiced-unvoiced-silence classification in speech processing.

An Adaptive Scheme for Learning the Probability Threshold in Pattern Recognition

The statistical minimum risk pattern recognition problem, when the classification costs are random variables of unknown statistics, is considered. Using medical diagnosis as a possible application, the problem of learning the optimal decision scheme is studied for a two-class twoaction case, as a first step. This reduces to the problem of learning the optimum threshold (for taking appropriate action) on the a posteriori probability of one class. A recursive procedure for updating an estimate of the threshold is proposed. The estimation procedure does not require the knowledge of actual class labels of the sample patterns in the design set. The adaptive scheme of using the present threshold estimate for taking action on the next sample is shown to converge, in probability, to the optimum. The results of a computer simulation study of three learning schemes demonstrate the theoretically predictable salient features of the adaptive scheme.

Relaxation Labeling with Learning Automata

Relaxation labeling processes are a class of mechanisms that solve the problem of assigning labels to objects in a manner that is consistent with respect to some domain-specific constraints. We reformulate this using the model of a team of learning automata interacting with an environment or a high-level critic that gives noisy responses as to the consistency of a tentative labeling selected by the automata. This results in an iterative linear algorithm that is itself probabilistic. Using an explicit definition of consistency we give a complete analysis of this probabilistic relaxation process using weak convergence results for stochastic algorithms. Our model can accommodate a range of uncertainties in the compatibility functions. We prove a local convergence result and show that the point of convergence depends both on the initial labeling and the constraints. The algorithm is implementable in a highly parallel fashion.

Paramagnetic probes in membrane biophysics

The use of paramagnetic probes in membrane research is reviewed. Electron paramagnetic resonance studies on model and biological membranes doped with covalent and non-covalent spin-labels have been discussed with special emphasis on the methodology and the type of information obtainable on several important phenomena like membrane fluidity, lipid flip-flop, lateral diffusion of lipids, lipid phase separation, lipid bilayer phase transitions, lipid-protein interactions and membrane permeability. Nuclear magnetic resonance spectroscopy has also been effectively used to study the conformations of cation mediators across membranes and to analyse in detail the transmembrane ionic motions at the mechanistic level.

Learning with a mutualistic teacher

The concept of a “mutualistic teacher” is introduced for unsupervised learning of the mean vectors of the components of a mixture of multivariate normal densities, when the number of classes is also unknown. The unsupervised learning problem is formulated here as a multi-stage quasi-supervised problem incorporating a cluster approach. The mutualistic teacher creates a quasi-supervised environment at each stage by picking out “mutual pairs” of samples and assigning identical (but unknown) labels to the individuals of each mutual pair. The number of classes, if not specified, can be determined at an intermediate stage. The risk in assigning identical labels to the individuals of mutual pairs is estimated. Results of some simulation studies are presented.

Surface cathepsin B protects cytotoxic lymphocytes from self-destruction after degranulation.

The granule exocytosis cytotoxicity pathway is the major molecular mechanism for cytotoxic T lymphocyte (CTL) and natural killer (NK) cytotoxicity, but the question of how these cytotoxic lymphocytes avoid self-destruction after secreting perforin has remained unresolved. We show that CTL and NK cells die within a few hours if they are triggered to degranulate in the presence of nontoxic thiol cathepsin protease inhibitors. The potent activity of the impermeant, highly cathepsin B-specific membrane inhibitors CA074 and NS-196 strongly implicates extracellular cathepsin B. CTL suicide in the presence of cathepsin inhibitors requires the granule exocytosis cytotoxicity pathway, as it is normal with CTLs from gld mice, but does not occur in CTLs from perforin knockout mice. Flow cytometry shows that CTLs express low to undetectable levels of cathepsin B on their surface before degranulation, with a substantial rapid increase after T cell receptor triggering. Surface cathepsin B eluted from live CTL after degranulation by calcium chelation is the single chain processed form of active cathepsin B. Degranulated CTLs are surface biotinylated by the cathepsin B-specific affinity reagent NS-196, which exclusively labels immunoreactive cathepsin B. These experiments support a model in which granule-derived surface cathepsin B provides self-protection for degranulating cytotoxic lymphocytes.

Data mining approaches to software fault diagnosis

Automatic identification of software faults has enormous practical significance. This requires characterizing program execution behavior and the use of appropriate data mining techniques on the chosen representation. In this paper, we use the sequence of system calls to characterize program execution. The data mining tasks addressed are learning to map system call streams to fault labels and automatic identification of fault causes. Spectrum kernels and SVM are used for the former while latent semantic analysis is used for the latter The techniques are demonstrated for the intrusion dataset containing system call traces. The results show that kernel techniques are as accurate as the best available results but are faster by orders of magnitude. We also show that latent semantic indexing is capable of revealing fault-specific features.

Phenomenological Ginzburg-Landau-like theory for superconductivity in the cuprates

We propose and develop here a phenomenological Ginzburg-Landau-like theory of cuprate high-temperature superconductivity. The free energy of a cuprate superconductor is expressed as a functional F of the complex spin-singlet pair amplitude psi(ij) equivalent to psi(m) = Delta(m) exp(i phi(m)), where i and j are nearest-neighbor sites of the square planar Cu lattice in which the superconductivity is believed to primarily reside, and m labels the site located at the center of the bond between i and j. The system is modeled as a weakly coupled stack of such planes. We hypothesize a simple form FDelta, phi] = Sigma(m)A Delta(2)(m) + (B/2)Delta(4)(m)] + C Sigma(< mn >) Delta(m) Delta(n) cos(phi(m) - phi(n)) for the functional, where m and n are nearest-neighbor sites on the bond-center lattice. This form is analogous to the original continuum Ginzburg-Landau free-energy functional; the coefficients A, B, and C are determined from comparison with experiments. A combination of analytic approximations, numerical minimization, and Monte Carlo simulations is used to work out a number of consequences of the proposed functional for specific choices of A, B, and C as functions of hole density x and temperature T. There can be a rapid crossover of from small to large values as A changes sign from positive to negative on lowering T; this crossover temperature T-ms(x) is identified with the observed pseudogap temperature T*(x). The thermodynamic superconducting phase-coherence transition occurs at a lower temperature T-c(x), and describes superconductivity with d-wave symmetry for positive C. The calculated T-c(x) curve has the observed parabolic shape. The results for the superfluid density rho(s)(x, T), the local gap magnitude , the specific heat C-v(x, T) (with and without a magnetic field), as well as vortex properties, all obtained using the proposed functional, are compared successfully with experiments. We also obtain the electron spectral density as influenced by the coupling between the electrons and the correlation function of the pair amplitude calculated from the functional, and compare the results successfully with the electronic spectrum measured through angle resolved photoemission spectroscopy (ARPES). For the specific heat, vortex structure, and electron spectral density, only some of the final results are reported here; the details are presented in subsequent papers.

Conformational changes of the chaperone SecB upon binding to a model substrate - bovine pancreatic trypsin inhibitor (BPTI)

SecB is a homotetrameric cytosolic chaperone that forms part of the protein translocation machinery in E. coli. Due to SecB, nascent polypeptides are maintained in an unfolded translocation-competent state devoid of tertiary structure and thus are guided to the translocon. In vitro SecB rapidly binds to a variety of ligands in a non-native state. We have previously investigated the bound state conformation of the model substrate bovine pancreatic trypsin inhibitor (BPTI) as well as the conformation of SecB itself by using proximity relationships based on site-directed spin labeling and pyrene fluorescence methods. It was shown that SecB undergoes a conformational change during the process of substrate binding. Here, we generated SecB mutants containing but a single cysteine per subunit or an exposed highly reactive new cysteine after removal of the nearby intrinsic cysteines. Quantitative spin labeling was achieved with the methanethiosulfonate spin label (MTS) at positions C97 or E90C, respectively. Highfield (W-band) electron paramagnetic resonance (EPR) measurements revealed that with BPTI present the spin labels are exposed to a more polar/hydrophilic environment. Nanoscale distance measurements with double electron-electron resonance (DEER) were in excellent agreement with distances obtained by molecular modeling. Binding of BPTI also led to a slight change in distances between labels at C97 but not at E90C. While the shorter distance in the tetramer increased, the larger diagonal distance decreased. These findings can be explained by a widening of the tetrameric structure upon substrate binding much like the opening of two pairs of scissors.

MAPS: midline analysis and propagation of segmentation

Scenic word images undergo degradations due to motion blur, uneven illumination, shadows and defocussing, which lead to difficulty in segmentation. As a result, the recognition results reported on the scenic word image datasets of ICDAR have been low. We introduce a novel technique, where we choose the middle row of the image as a sub-image and segment it first. Then, the labels from this segmented sub-image are used to propagate labels to other pixels in the image. This approach, which is unique and distinct from the existing methods, results in improved segmentation. Bayesian classification and Max-flow methods have been independently used for label propagation. This midline based approach limits the impact of degradations that happens to the image. The segmented text image is recognized using the trial version of Omnipage OCR. We have tested our method on ICDAR 2003 and ICDAR 2011 datasets. Our word recognition results of 64.5% and 71.6% are better than those of methods in the literature and also methods that competed in the Robust reading competition. Our method makes an implicit assumption that degradation is not present in the middle row.

Effect of signal peptide on stability and folding of escherichia coli thioredoxin

The signal peptide plays a key role in targeting and membrane insertion of secretory and membrane proteins in both prokaryotes and eukaryotes. In E. coli, recombinant proteins can be targeted to the periplasmic space by fusing naturally occurring signal sequences to their N-terminus. The model protein thioredoxin was fused at its N-terminus with malE and pelB signal sequences. While WT and the pelB fusion are soluble when expressed, the malE fusion was targeted to inclusion bodies and was refolded in vitro to yield a monomeric product with identical secondary structure to WT thioredoxin. The purified recombinant proteins were studied with respect to their thermodynamic stability, aggregation propensity and activity, and compared with wild type thioredoxin, without a signal sequence. The presence of signal sequences leads to thermodynamic destabilization, reduces the activity and increases the aggregation propensity, with malE having much larger effects than pelB. These studies show that besides acting as address labels, signal sequences can modulate protein stability and aggregation in a sequence dependent manner.

Maltose Binding Protein Is Partially Structured in Its Molten Globule State

Seven double cysteine mutants of maltose binding protein (MBP) were generated with one each in the active cleft at position 298 and the second cysteine distributed over both domains of the protein. These cysteines were spin labeled and distances between the labels in biradical pairs determined by pulsed double electron-electron resonance (DEER) measurements. The values were compared with theoretical predictions of distances between the labels in biradicals constructed by molecular modeling from the crystal structure of MBP without maltose and were found to be in excellent agreement. MBP is in a molten globule state at pH 3.3 and is known to still bind its substrate maltose. The nitroxide spin label was sufficiently stable under these conditions. In preliminary experiments, DEER measurements were carried out with one of the mutants yielding a broad distance distribution as was to be expected if there is no explicit tertiary structure and the individual helices pointing into all possible directions.

Traffic engineered NoC for streaming applications

Streaming applications demand hard bandwidth and throughput guarantees in a multiprocessor environment amidst resource competing processes. We present a Label Switching based Network-on-Chip (LS-NoC) motivated by throughput guarantees offered by bandwidth reservation. Label switching is a packet relaying technique in which individual packets carry route information in the form of labels. A centralized LS-NoC Management framework engineers traffic into Quality of Service (QoS) guaranteed routes. LS-NoC caters to the requirements of streaming applications where communication channels are fixed over the lifetime of the application. The proposed NoC framework inherently supports heterogeneous and ad hoc system-on-chips. The LS-NoC can be used in conjunction with conventional best effort NoC as a QoS guaranteed communication network or as a replacement to the conventional NoC. A multicast, broadcast capable label switched router for the LS-NoC has been designed. A 5 port, 256 bit data bus, 4 bit label router occupies 0.431 mm(2) in 130 nm and delivers peak bandwidth of 80 Gbits/s per link at 312.5 MHz. Bandwidth and latency guarantees of LS-NoC have been demonstrated on traffic from example streaming applications and on constant and variable bit rate traffic patterns. LS-NoC was found to have a competitive AreaxPower/Throughput figure of merit with state-of-the-art NoCs providing QoS. Circuit switching with link sharing abilities and support for asynchronous operation make LS-NoC a desirable choice for QoS servicing in chip multiprocessors. (C) 2013 Elsevier B.V. All rights reserved.