Protecting accelerators from malicious network functions

1. A method to protect accelerators from malicious network functions, comprising:

analyzing an application runtime to automatically generate a plurality of phase-specific security restrictions by:

initializing the application runtime in an offline environment;

measuring a resource utilization by the application runtime at different time steps;

recording system calls made by the application runtime at the different time steps; and

using the measured resource utilization and the recorded system calls to identify a plurality of distinct operational phases for the application runtime; and

enforcing one of the plurality of phase-specific security restrictions at one of the plurality of distinct operational phases.

2. The method of claim 1 , wherein identifying one of the plurality of distinct operational phases comprises determining whether a cosine distance between is greater than a predetermined threshold.

3. The method of claim 1 , wherein the analyzing further comprises using the measured resource utilization and the recorded system calls to calculate a signature for each of the plurality of distinct operational phases.

4. The method of claim 3 , wherein enforcing the one of the plurality of phase-specific security restrictions at each of the plurality of distinct operational phases comprises:

using the signatures to automatically detect a current operational phase for the application runtime.

5. The method of claim 1 , wherein automatically generating the plurality of phase-specific security restrictions comprises:

measuring resources consumed by the application runtime in the offline environment at each of the plurality of distinct operational phases for the application runtime;

using the measured resources to build a model of the resources that the application runtime is allowed to access during each of the distinct operational phases; and

generating a set of security restrictions for each of the distinct operational phases using the model.

6. The method of claim 1 , wherein enforcing one of the plurality of phase-specific security restrictions comprises:

automatically identifying a first of the plurality of distinct operational phases for the application runtime; and

enforcing a first of the plurality of phase-specific security restrictions during the first of the plurality of distinct operational phases.

7. The method of claim 6 , wherein enforcing one of the plurality of phase-specific security restrictions comprises:

automatically identifying a second of the plurality of distinct operational phases for the application runtime; and

selecting a second of the plurality of phase-specific security restrictions during the first of the plurality of distinct operational phases, wherein the first and the second of the plurality of phase-specific security restrictions are different.

8. The method of claim 1 , wherein the measured resource utilization comprises CPU, memory, disk, network, and Power Management Controller (PMC).

9. A computer program product for protecting accelerators from malicious network functions, the computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to:

analyzing an application runtime to automatically generate a plurality of phase-specific security restrictions, wherein the analyzing comprises:

initializing the application runtime in an offline environment;

at each of a plurality of time steps:

measuring a resource utilization by the application runtime; and recording system calls made by the application runtime;

using the measured resource utilization and the recorded system calls to:

identify a plurality of distinct operational phases for the application runtime, wherein identifying one of the plurality of distinct operational phases comprises determining whether a cosine distance between is greater than a predetermined threshold; and

calculate a signature for each of the plurality of distinct operational phases;

build a model of the resources that the application runtime is allowed to access during each of the plurality of distinct operational phases; and generate a set of security restrictions for each of the plurality of distinct operational phases using the model;

enforcing one of the plurality of phase-specific security restrictions at each of the plurality of distinct operational phases, wherein the enforcing comprises:

using the signatures to automatically detect a first of the plurality of distinct operational phases for the application runtime; and

enforcing a first of the plurality of phase-specific security restrictions during the first of the plurality of distinct operational phases;

using the signatures to automatically detect a second of the plurality of distinct operational phases for the application runtime; and

selecting a second of the plurality of phase-specific security restrictions during the first of the plurality of distinct operational phases, wherein the first and the second of the plurality of phase-specific security restrictions are different.

10. A system for protecting accelerators from malicious network functions, comprising:

one or more processors; and

one or more non-transitory computer-readable storage media collectively storing instructions to cause the processor to perform a method comprising:

analyzing an application runtime to automatically generate a plurality of phase-specific security restrictions by:

initializing the application runtime in an offline environment;

measuring a resource utilization by the application runtime at different time steps;

recording system calls made by the application runtime at the different time steps; and

using the measured resource utilization and the recorded system calls to identify a plurality of distinct operational phases for the application runtime; and

enforcing one of the plurality of phase-specific security restrictions at one of the plurality of distinct operational phases.

11. The system of claim 10 , wherein identifying a distinct operational phase comprises determining whether a cosine distance between is greater than a predetermined threshold.

12. The system of claim 10 , wherein the analyzing further comprises using the measured resource utilization and the recorded system calls to calculate a signature for each of the plurality of distinct operational phases.

13. The system of claim 12 , wherein enforcing the one of the plurality of phase-specific security restrictions at each of the plurality of distinct operational phases comprises:

using the signatures to automatically detect a current operational phase for the application runtime.

14. The system of claim 11 , wherein automatically generating the plurality of phase-specific security restrictions comprises:

measuring resources consumed by the application runtime in the offline environment at each of the plurality of distinct operational phases for the application runtime;

using the measured resources to build a model of the resources that the application runtime is allowed to access during each of the distinct operational phases; and

generating a set of security restrictions for each of the distinct operational phases using the model.

15. The system of claim 10 , wherein enforcing one of the plurality of phase-specific security restrictions comprises:

automatically identifying a first of the plurality of distinct operational phases for the application runtime; and

enforcing a first of the plurality of phase-specific security restrictions during the first of the plurality of distinct operational phases.

16. The system of claim 15 , wherein enforcing one of the plurality of phase-specific security restrictions comprises:

automatically identifying a second of the plurality of distinct operational phases for the application runtime; and

selecting a second of the plurality of phase-specific security restrictions during the first of the plurality of distinct operational phases, wherein the first and the second of the plurality of phase-specific security restrictions are different.

17. The system of claim 16 , wherein the application runtime is executed on an accelerator, wherein the accelerator comprises a SmartNIC, the SmartNIC including an offloaded application.

18. The system of claim 10 , wherein the measured resource utilization comprises CPU, memory, disk, network, and Power Management Controller (PMC).