Accelerating Firewall

摘要

In this paper, we propose a new approach to ameliorate the performance degradation of firewall through a kind of load sharing technique. In the proposed approach, a firewall acceleration engine takes over some part of the jobs of firewall. Instead of sharing load in session unit as in the existing load sharing techniques, the proposed acceleration engine shares the jobs with a firewall that the firewall has to process in a session such as connection search, packet filtering and content filtering. For example, the firewall acceleration engine takes over connection management and packet filtering from a firewall. And the firewall only does content filtering for the packets belonging to the sessions that the acceleration engine permits. The design issues for the acceleration engine are discussed and the performance on an implemented embedded system is evaluated.