A Scalable High Throughput Firewall in FPGA

Jedhe, Gajanan S and Ramamoorthy, Arun and Varghese, Kuruvilla (2008) A Scalable High Throughput Firewall in FPGA. In: 16th Annual IEEE Symposium on Field-Programmable Custom Computing Machines, APR 14-15, 2008, Stanford, CA, pp. 43-52.

PDF PDF.pdf - Published Version Restricted to Registered users only Download (422kB) | Request a copy

Abstract

High end network security applications demand high speed operation and large rule set support. Packet classification is the core functionality that demands high throughput in such applications. This paper proposes a packet classification architecture to meet such high throughput. We have implemented a Firewall with this architecture in reconflgurable hardware. We propose an extension to Distributed Crossproducting of Field Labels (DCFL) technique to achieve scalable and high performance architecture. The implemented Firewall takes advantage of inherent structure and redundancy of rule set by using our DCFL Extended (DCFLE) algorithm. The use of DCFLE algorithm results in both speed and area improvement when it is implemented in hardware. Although we restrict ourselves to standard 5-tuple matching, the architecture supports additional fields. High throughput classification invariably uses Ternary Content Addressable Memory (TCAM) for prefix matching, though TCAM fares poorly in terms of area and power efficiency. Use of TCAM for port range matching is expensive, as the range to prefix conversion results in large number of prefixes leading to storage inefficiency. Extended TCAM (ETCAM) is fast and the most storage efficient solution for range matching. We present for the first time a reconfigurable hardware implementation of ETCAM. We have implemented our Firewall as an embedded system on Virtex-II Pro FPGA based platform, running Linux with the packet classification in hardware. The Firewall was tested in real time with 1 Gbps Ethernet link and 128 sample rules. The packet classification hardware uses a quarter of logic resources and slightly over one third of memory resources of XC2VP30 FPGA. It achieves a maximum classification throughput of 50 million packet/s corresponding to 16 Gbps link rate for the worst case packet size. The Firewall rule update involves only memory re-initialization in software without any hardware change.

Item Type:	Conference Paper
Publication:	16th International Symposium on Field-Programmable Custom Computing Machines
Series.:	Annual IEEE Symposium on Field-Programmable Custom Computing Machines
Publisher:	IEEE
Additional Information:	Copyright belongs to IEEE. Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE.
Department/Centre:	Division of Electrical Sciences > Electronic Systems Engineering (Formerly Centre for Electronic Design & Technology)
Date Deposited:	14 Dec 2009 12:32
Last Modified:	19 Sep 2010 05:30
URI:	http://eprints.iisc.ac.in/id/eprint/19803

Actions (login required)

View Item