Firewall Processor based on Self-Timed Pipeline Circuit

由于自定时电路具有易于设计、低功耗和并行处理能力等智能优势，本课题旨在建立一种由自定时流水线电路实现的柔性嵌入式防火墙处理器。近年来，随着手机、PDA等个人移动设备的普及，对个人防火墙和网络防火墙的需求越来越大。但是，由于大多数个人防火墙都是通过软件实现的，如果其操作系统感染了某种病毒，它将根本无法工作。本课题开发的嵌入式防火墙处理器独立于操作系统，对恶意攻击具有较强的鲁棒性。嵌入式防火墙处理器的基本架构为了实现高性能，必须在第3层到第7层表示各种过滤算法固有的流水线并行性。因此，我们将重点放在过滤过程的非严格性和流数据的分层结构上，然后制定了一种新的流流图（SFG），可以显式地表达它们。此外，为了直接并行执行SFG描述，我们提出了一种基于动态数据驱动处理方案的流驱动多处理器架构。我们设计了一个签名匹配引擎，实现了AC-Fail和AC-Opt算法的混合算法，用于检测HTTP和SMTP的更高层数据包的内容。其FPGA实现实现超过2.3 G /s，仅需要180 MB内存。此外，我们还设计了一种更先进的自定时数据传输控制电路，使两个管道之间能够相互交互。结果表明，该电路在0.18 um CMOS下每秒传输数据超过400m数据包。

This research project aimed at establishing a flexible embedded firewall processor realized by the self-timed pipeline circuit because the self-timed circuit provides smart advantages such as easy-to-design, low power, and parallel processing capabilities. Recently, personal firewall as well as network firewall is demanded along with widespread of personal mobile devices such as mobile phone and PDA. However, since most of personal firewall is realized by software, it will not work at all if its operating system is infected by some virus. The embedded firewall processor developed in this project is independent of the OS so that it is robust against malicious attacks.1. Basic architecture of embedded firewall processorIn order to achieve high performance, it is essential to represent pipelined parallelism inherent in various filtering algorithms in layer 3 to 7. We therefore focused on the non-strictness of the filtering process and hierarchical structure of stream data and then formulated a novel stream flow graph (SFG) which can express them explicitly. Furthermore, we proposed a novel stream-driven multiprocessor architecture based on the dynamic data-driven processing scheme in order to execute SFG descriptions directly in parallel.2. LSI design of dedicated self-timed hardware modulesWe designed a signature matching engine realizing a hybrid algorithm of both AC-Fail and AC-Opt algorithms to inspect content of higher layer packets for HTTP and SMTP. Its FPGA implementation achieved over 2.3 G b/s with only 180 MB memory requirement. Furthermore, we design a more advanced self-timed data-transfer control circuit which enable to interact between two pipelines each other. It is revealed that this circuit transfers data over 400 M packets per second under 0.18 um CMOS.