Firewall Processor based on Self-Timed Pipeline Circuit

本研究项目旨在建立一种灵活的嵌入式防火墙处理器，采用自定时流水线电路实现，因为自定时电路具有设计简单、功耗低、并行处理能力强等优点。近年来，随着手机、PDA等个人移动设备的普及，对个人防火墙和网络防火墙的需求也越来越大。然而，由于大多数个人防火墙都是由软件实现的，如果其操作系统受到某种病毒的感染，它将根本无法工作。本项目开发的嵌入式防火墙处理器独立于操作系统，对恶意攻击具有较强的健壮性。嵌入式防火墙处理器的基本体系结构为了获得高性能，必须在第三层到第七层表示各种过滤算法所固有的流水线并行性。为此，我们重点研究了过滤过程的非严格性和流数据的层次结构，并在此基础上提出了一种新的流流图(SFG)来显式地表示它们。此外，为了直接并行执行SFG描述，提出了一种基于动态数据驱动处理机制的流驱动多处理器体系结构。专用自定时硬件模块的LSI设计我们设计了一个签名匹配引擎，实现了AC-FAIL和AC-OPT算法的混合算法，用于检测HTTP和SMTP高层报文的内容。它的FPGA实现达到了2.3Gb/S以上，只需要180MB的内存。此外，我们还设计了一种更先进的自定时数据传输控制电路，使两条流水线之间能够进行交互。结果表明，该电路在0.18微米的CMOS线上传输数据的速度超过400M包/秒。

This research project aimed at establishing a flexible embedded firewall processor realized by the self-timed pipeline circuit because the self-timed circuit provides smart advantages such as easy-to-design, low power, and parallel processing capabilities. Recently, personal firewall as well as network firewall is demanded along with widespread of personal mobile devices such as mobile phone and PDA. However, since most of personal firewall is realized by software, it will not work at all if its operating system is infected by some virus. The embedded firewall processor developed in this project is independent of the OS so that it is robust against malicious attacks.1. Basic architecture of embedded firewall processorIn order to achieve high performance, it is essential to represent pipelined parallelism inherent in various filtering algorithms in layer 3 to 7. We therefore focused on the non-strictness of the filtering process and hierarchical structure of stream data and then formulated a novel stream flow graph (SFG) which can express them explicitly. Furthermore, we proposed a novel stream-driven multiprocessor architecture based on the dynamic data-driven processing scheme in order to execute SFG descriptions directly in parallel.2. LSI design of dedicated self-timed hardware modulesWe designed a signature matching engine realizing a hybrid algorithm of both AC-Fail and AC-Opt algorithms to inspect content of higher layer packets for HTTP and SMTP. Its FPGA implementation achieved over 2.3 G b/s with only 180 MB memory requirement. Furthermore, we design a more advanced self-timed data-transfer control circuit which enable to interact between two pipelines each other. It is revealed that this circuit transfers data over 400 M packets per second under 0.18 um CMOS.