Christopher K. Zuver

An Extensible, System-On-Programmable-Chip, Content-Aware Internet Firewall

An extensible firewall has been implemented that performs packet filtering, content scanning, and per-flow queuing of Internet packets at Gigabit/second rates. The firewall uses layered protocol wrappers to parse the content of Internet data. Packet payloads are scanned for keywords using parallel regular expression matching circuits. Packet headers are compared to rules specified in Ternary Content Addressable Memories (TCAMs). Per-flow queuing is performed to mitigate the effect of Denial of Service attacks. All packet processing operations were implemented with reconfigurable hardware and fit within a single Xilinx Virtex XCV2000E Field Programmable Gate Array (FPGA). The single-chip firewall has been used to filter Internet SPAM and to guard against several types of network intrusion. Additional features were implemented in extensible hardware modules deployed using run-time reconfiguration.

Automated tools to implement and test Internet systems in reconfigurable hardware

Tools have been developed to automatically integrate and test networking systems in reconfigurable hardware. These tools dynamically generate circuits for Field Programmable Gate Arrays (FPGAs). A library of hardware-accelerated modules has been developed that processes Internet Protocol (IP) packets, performs header rule matching, scans pocket payloads, and implements per-flow queueing. Other functions can be added to the library as extensible modules.An integration tool was developed to enable a network administrator to specify how a customized system should examine, drop, buffer, and/or modify packets. This tool joins together modules from the library to create a composite circuit that performs multiple functions. The tool allows additional modules to be quickly added to the library and integrated into systems. The integration tool has been used to create circuits that perform Internet firewall, network intrusion detection, network intrusion prevention, and Denial of Service (DoS) attack protection functions.A test tool was developed to automatically verify that circuits created by the integration tool run properly in reconfigurable hardware. Circuits created by the integration tool are deployed into a Field-programmable Port Extender (FPX) platform. As new modules were added to the library, the test tool reconfigured the logic on the FPX, injected traffic, and monitored the resulting packets.By using hardware, not software, networking system can process millions of packets per second. Together, the integration and test tools simplify the otherwise difficult task of developing reconfigurable hardware for networking systems and testing them at Gigabit per second rates.

Sensor fusion and correlation

The sensor fusion architecture is a General-purpose Aggregation Processor (GAP) designed to bridge the gap between low-level sensor data and the high-level knowledge needed by the backbone. By examining both the incoming data from attached sensor nodes and the interests of users on the network, the model reduces overall transmission costs by keeping local event information at the source, only reporting the higher-level alerts and knowledge to interested parties. The sensor fusion architecture possesses three distinct advantages worth noting.

Internet-based tool for system-on-chip integration

A tool has been created for use in a design course to automate integration of new components into a System-On-Chip(SOC). Students used this tool to implement a complete SOC Internet firewall, which was prototyped and tested using a field-programmable gate array (FPGA). Common components of the framework were completed as machine problem assignments throughout the first half of the semester. During the second half of the semester, students worked in small groups to design extensible modules, which included additional packet filters, a packet encryption engine, and replacement schedulers to enhance the functionality of the SoC firewall. The integration tool was used to manage project submissions and to synthesize designs for testing and project evaluation.