Wyniki wyszukiwania - BazTech

1

Szybka filtracja portów sieciowych w sprzętowym systemie bezpieczeństwa typu Firewall

Twardy M., Sułkowski G., Wiatr K.

Pomiary Automatyka Kontrola

|

2009

|

R. 55, nr 8

615-617

PL

W niniejszym artykule autorzy przedstawiają wyniki prac badawczych związanych z budową sprzętowego klasyfikatora portów sieciowych. Opracowana koncepcja filtru portów opiera się na wykorzystaniu elementarnych pamięci RAM16X1D dostępnych w układach FPGA z rodziny Virtex firmy Xilinx. Uzyskana wydajność przetwarzania danych, przekraczająca 160 milionów pakietów na sekundę oraz pozytywnie rezultaty wstępnych testów praktycznych, stwarzają możliwości zastosowania rozwiązania we współczesnych sieciach teleinformatycznych o dużych przepustowościach.

EN

The paper presents the results of practical realization of the network ports classifier based on cascades of RAM16X1D memory available in Xilinx Virtex FPGA chips. The first section introduces a packet classification subject. The second one describes the packet classifier internal structure, characterizing in details each of the elements included in the classifier, according to the block diagram of Fig. 1. The network port filter architecture (shown in Fig. 2) assumed by the authors is discussed in the section 3. The section 4 contains details concerning the basic filtering element functionality and implementation method. The last section summarizes the results obtained. The new architecture of the ports classifier based on RAM16X1D storage elements adopted by the authors allows achieving the high speed data processing. The estimated maximum operating frequency for the ports filter is 160 MHz. It means that the module can analyze about 160 million packets per second. The research work is in line with the rapidly developing trend towards using reprogrammable logic for securing data transfer in information technology networks.

2

Filtrowanie adresów sieciowych w sprzętowym systemie bezpieczeństwa typu Firewall

Twardy M., Sułkowski G., Wiatr K.

Pomiary Automatyka Kontrola

|

2009

|

R. 55, nr 7

479-481

PL

W niniejszym artykule zaprezentowano wyniki praktycznej realizacji sprzętowego klasyfikatora adresów sieciowych opartego o dedykowaną pamięć TCAM (ang. Ternary Content-Addressable Memory). Opracowana metoda implementacji pamięci TCAM charakteryzuje się dużą szybkością pracy oraz znacznie efektywniejszym wykorzystaniem zasobów układów FPGA w porównaniu do komercyjnych wersji oferowanych przez firmę Xilinx.

EN

The paper presents the results of practical realization of a network address and protocol type classifier based on Ternary Content-Addressable Memory (TCAM). The first section deals with a subject of packet classification. The second one describes the packet classifier internal structure, characterizing in details each of the elements included in the classifier, according to the block diagram of Fig. 1. The address filter architecture (shown in Fig. 2) assumed by the authors is discussed in the third section. The fourth section contains some details concerning the TCAM cells array functionality and implementation method. The last section summarizes the results obtained. The new TCAM architecture based on RAM16X1S storage elements adopted by the authors is much more effective than the commercial solution generated by the Xilinx COREGenerator software. The device resources requirements are over two times lower than the resources required by the COREGenerator version. This significant reduction causes improvements in overall timing characteristics. The estimated maximum operating frequency for the address and protocol type filter is 160 MHz. It means that the module can analyze about 160 million packets per second. The research work is in line with the rapidly developing trend towards using reprogrammable logic for securing data transfer in information technology networks.

3

Implementation of the Hardware Packet Classification System

Sułkowski G., Twardy M., Wiatr K.

Journal of Applied Computer Science

|

2009

|

Vol. 17, nr 2

97-111

EN

This article presents the results of research related to the construction of a complete packet classifier, constituting the main element of a hardware-based firewall security system. The developed solution is based on two filter blocks operating in parallel: address filters and network ports filters. The proposed method of filtering network addresses using dedicated TCAM memory is characterized by fast operational speeds and a much more effective usage of FPGA chip resources as compared to commercial versions offered by Xilinx. Similarly, in order to verify network ports, especially taking into account rules that define port ranges, the authors proposes a novel concept based on cascades of elementary RAM16X1D memory available in Xilinx’s Virtex FPGA family circuits. The resulting data processing speed in excess of 160 million of packets per second, coupled with positive results of preliminary tests, make it possible to use the classification system in modern wide bandwidth telecommunications networks.