Specialized Hardware for Deep Network Packet Filtering

摘要: Many computer network provide limited security through simple firewall feature in router and switch. Some networks that require higher use deep packet filter to capture packets can not be detected by firewall. Deep filters list of rules for determining safety packets. There is a high degree parallelism processing these because each rule represent independent pattern matching process. We find the underlying architecture existing software hardware firewalls do fully take advantage this parallelism. Thus, we design filtering on field programmable gate array (FPGA) while retaining its programmability. Our implementation capable over 2.88 gigabits per second stream an Altera EP20K series FPGA without manual optimization.