Christopher E. Neely

An Extensible, System-On-Programmable-Chip, Content-Aware Internet Firewall

An extensible firewall has been implemented that performs packet filtering, content scanning, and per-flow queuing of Internet packets at Gigabit/second rates. The firewall uses layered protocol wrappers to parse the content of Internet data. Packet payloads are scanned for keywords using parallel regular expression matching circuits. Packet headers are compared to rules specified in Ternary Content Addressable Memories (TCAMs). Per-flow queuing is performed to mitigate the effect of Denial of Service attacks. All packet processing operations were implemented with reconfigurable hardware and fit within a single Xilinx Virtex XCV2000E Field Programmable Gate Array (FPGA). The single-chip firewall has been used to filter Internet SPAM and to guard against several types of network intrusion. Additional features were implemented in extensible hardware modules deployed using run-time reconfiguration.

Automated tools to implement and test Internet systems in reconfigurable hardware

Tools have been developed to automatically integrate and test networking systems in reconfigurable hardware. These tools dynamically generate circuits for Field Programmable Gate Arrays (FPGAs). A library of hardware-accelerated modules has been developed that processes Internet Protocol (IP) packets, performs header rule matching, scans pocket payloads, and implements per-flow queueing. Other functions can be added to the library as extensible modules.An integration tool was developed to enable a network administrator to specify how a customized system should examine, drop, buffer, and/or modify packets. This tool joins together modules from the library to create a composite circuit that performs multiple functions. The tool allows additional modules to be quickly added to the library and integrated into systems. The integration tool has been used to create circuits that perform Internet firewall, network intrusion detection, network intrusion prevention, and Denial of Service (DoS) attack protection functions.A test tool was developed to automatically verify that circuits created by the integration tool run properly in reconfigurable hardware. Circuits created by the integration tool are deployed into a Field-programmable Port Extender (FPX) platform. As new modules were added to the library, the test tool reconfigured the logic on the FPX, injected traffic, and monitored the resulting packets.By using hardware, not software, networking system can process millions of packets per second. Together, the integration and test tools simplify the otherwise difficult task of developing reconfigurable hardware for networking systems and testing them at Gigabit per second rates.

ShapeUp: A High-Level Design Approach to Simplify Module Interconnection on FPGAs

The latest generation of FPGA devices offers huge resource counts that provide the headroom to implement large-scale and complex systems. However, this poses increasing challenges for the designer, not just because of pure size and complexity, but also to harness effectively the flexibility and programmability of the FPGA. A central issue is the need to integrate modules (IP blocks) from diverse sources to promote modular design and reuse. In this paper, we introduce ShapeUp: a high-level approach for designing systems by interconnecting modules, which gives a ‘plug and play’ look and feel to the designer and is supported by tools that carry out implementation and verification functions. The emphasis is on the inter-module connections and abstracting the communication patterns that are typical between modules – for example, the streaming of data that is common in many FPGA based DSP or networking systems, or the reading and writing of data to and from memory modules. The details of wiring and signaling are hidden from view, via metadata associated with individual modules. The ShapeUp tool suite includes an implementation capability that automatically generates wiring between blocks, possibly including additional bridging blocks, and a simulation capability that allows multi-level verification of systems of interconnected modules. The methodology and tools have been validated on Xilinx customer design projects.

Mutable codesign for embedded protocol processing

This paper addresses exploitation of the capabilities of platform FPGAs to implement embedded networking for systems on chip. In particular, a methodology for exploring trade-offs between the placement of protocol handling functions in programmable logic and on an embedded processor is demonstrated. This is facilitated by two new design tool capabilities: first, being able to describe programmable logic based functions in a more software-like manner; and second, being able automatically to generate efficient interfaces between a programmable logic fabric and an embedded processor. The methodology is illustrated by an example of a simple web server, targeted at Xilinx Virtex-II Pro or Virtex-4 FX platform FPGAs. Trade-offs both of complete protocol placement and of within-protocol placement are systematically investigated in terms of resources used and packet handling latency. This provides an excellent range of service times, corresponding to differing logic fabric and memory resource requirements. The work points the way to highly fluid allocation of functions to implementations, beyond conventional static codesign.

ReShape: Towards a High-Level Approach to Design and Operation of Modular Reconfigurable Systems

The latest FPGA devices provide the headroom to implement large-scale and complex systems. A key requirement is the integration of modules from diverse sources to promote modular design and reuse. A contrary factor is that using dynamic partial reconfiguration typically requires low-level planning of the system implementation. In this article, we introduce ReShape: a high-level approach for designing reconfigurable systems by interconnecting modules, which gives a “plug and play” look and feel, is supported by tools that carry out implementation functions, and is carried through to support system reconfiguration during operation. The emphasis is on the inter-module connections and abstracting the communication patterns that are typical between modules: for example, the streaming of data, or the reading and writing of data to and from memory modules. The details of wiring and signaling are hidden from view, via metadata associated with individual modules. This setting allows system reconfiguration at the module level, both by supporting type checking of replacement modules and by managing the overall system implementation, via metadata associated with its FPGA floorplan. The methodology and tools have been implemented in a prototype targeted to a domain-specific setting---high-speed networking---and have been validated on real telecommunications design projects.

Internet-based tool for system-on-chip integration

A tool has been created for use in a design course to automate integration of new components into a System-On-Chip(SOC). Students used this tool to implement a complete SOC Internet firewall, which was prototyped and tested using a field-programmable gate array (FPGA). Common components of the framework were completed as machine problem assignments throughout the first half of the semester. During the second half of the semester, students worked in small groups to design extensible modules, which included additional packet filters, a packet encryption engine, and replacement schedulers to enhance the functionality of the SoC firewall. The integration tool was used to manage project submissions and to synthesize designs for testing and project evaluation.

Flexible and Modular Support for Timing Functions in High Performance Networking Acceleration

Field programmable logic is increasingly used to provide the high performance and flexible acceleration needed for network processing functions at multiple gigabit/second rates. Almost all such functions feature the use of clocks and timers in control and/or data roles, and these are typically implemented in an ad hoc manner. This paper introduces a set of three configurable timing modules that are based on abstractions of the prevalent timing paradigms observed in network protocols. The modules fit within the experimental ShapeUp methodology for modular FPGA-based system design, and so can be easily integrated with other modules that are tailored for specific networking functions. The use and benefits of the new modular approach are demonstrated by an example of a flexible FPGA reference design that has been made available for real-life use by telecommunication equipment providers.