Fast and reconfigurable packet classification engine in FPGA-based firewall

摘要

In data communication via internet, security is becoming one of the mostinfluential aspects. One way to support it is by classifying and filteringethernet packets within network devices. Packet classification is a fundamentaltask for network devices such as routers, firewalls, and intrusion detectionsystems. In this paper we present architecture of fast and reconfigurablePacket Classification Engine (PCE). This engine is used in FPGA-based firewall.Our PCE inspects multi-dimensional field of packet header sequentially based ontree-based algorithm. This algorithm simplifies overall system to a lower scaleand leads to a more secure system. The PCE works with an adaptation of singlecycle processor architecture in the system. Ethernet packet is examined withPCE based on Source IP Address, Destination IP Address, Source Port,Destination Port, and Protocol fields of the packet header. These are basicfields to know whether it is a dangerous or normal packet before inspecting thecontent. Using implementation of tree-based algorithm in the architecture,firewall rules are rebuilt into 24-bit sub-rules which are read as processorinstruction in the inspection process. The inspection process is comparing onesub-rule with input field of header every clock cycle. The proposed PCE shows91 MHz clock frequency in Cyclone II EP2C70F896C6 with 13 clocks throughputaverage from input to output generation. The use of tree-based algorithmsimplifies the multidimensional packet inspection and gives us reconfigurableas well as scalable system. The architecture is fast, reliable, and adaptableand also can maximize the advantages of the algorithm very well. Although thePCE has high frequency and little amount of clock, filtering speed of afirewall also depends on the other components, such as packet FIFO buffer. Fastand reliable FIFO buffer is needed to support the PCE. This PCE also is notcompleted with rule update mechanism yet. This proposed PCE is tested as acomponent of FPGA-based firewall to filter Ethernet packet with FPGA DE2 Boardusing NIOS II platform.