Firewall Processor based on Self-Timed Pipeline Circuit

本研究计画的目的在于建立一个灵活的嵌入式防火墙处理器，利用自定时管线电路来实现，因为自定时电路具有设计容易、低功率、以及平行处理能力等优点。近年来，随着移动的电话、PDA等个人移动的设备的普及，人们对个人防火墙和网络防火墙的需求也沿着增加。然而，由于个人防火墙大多是由软件实现的，如果操作系统感染了病毒，它将无法正常工作。本项目开发的嵌入式防火墙处理器独立于操作系统，具有很强的抗恶意攻击能力.嵌入式防火墙处理器的基本体系结构为了实现高性能，必须在第3层到第7层中表示各种过滤算法所固有的流水线并行性。因此，我们专注于过滤过程的非严格性和流数据的层次结构，然后制定了一种新的流流图（SFG），可以明确地表示它们。在此基础上，提出了一种基于动态数据驱动处理机制的流驱动多处理器体系结构，以直接并行执行SFG描述.专用自定时硬件模块的大规模集成电路设计我们设计了一个签名匹配引擎，实现了AC-Fail和AC-Opt算法的混合算法来检测HTTP和SMTP的高层数据包内容。其FPGA实现达到了超过2.3 G B/s，只有180 MB的内存需求。此外，我们还设计了一个更先进的自定时数据传输控制电路，使两个流水线之间的相互作用。在0.18 μ mCMOS下，数据传输速率超过400 M/s。

This research project aimed at establishing a flexible embedded firewall processor realized by the self-timed pipeline circuit because the self-timed circuit provides smart advantages such as easy-to-design, low power, and parallel processing capabilities. Recently, personal firewall as well as network firewall is demanded along with widespread of personal mobile devices such as mobile phone and PDA. However, since most of personal firewall is realized by software, it will not work at all if its operating system is infected by some virus. The embedded firewall processor developed in this project is independent of the OS so that it is robust against malicious attacks.1. Basic architecture of embedded firewall processorIn order to achieve high performance, it is essential to represent pipelined parallelism inherent in various filtering algorithms in layer 3 to 7. We therefore focused on the non-strictness of the filtering process and hierarchical structure of stream data and then formulated a novel stream flow graph (SFG) which can express them explicitly. Furthermore, we proposed a novel stream-driven multiprocessor architecture based on the dynamic data-driven processing scheme in order to execute SFG descriptions directly in parallel.2. LSI design of dedicated self-timed hardware modulesWe designed a signature matching engine realizing a hybrid algorithm of both AC-Fail and AC-Opt algorithms to inspect content of higher layer packets for HTTP and SMTP. Its FPGA implementation achieved over 2.3 G b/s with only 180 MB memory requirement. Furthermore, we design a more advanced self-timed data-transfer control circuit which enable to interact between two pipelines each other. It is revealed that this circuit transfers data over 400 M packets per second under 0.18 um CMOS.