【作者】 明幼林；

【导师】 吴谨；

【作者基本信息】 武汉科技大学 ， 电路与系统， 2010， 硕士

【摘要】 随着网络应用范围的迅速扩大和网络性能的不断提高,安全网关的吞吐量从原来的几十兆/每秒迅速增长到几百兆/每秒甚至几千兆/每秒。另外,安全网关从传统的防火墙应用扩展到UTM、在线流量分析监控、Web访问管理等领域。因此,网络管理设备需要有更加强大的CPU处理能力、更强大的数据报文分析能力和流量转发能力来支撑整个网络的高速运转。在实际应用过程中,转发工作往往消耗了过多的服务器CPU资源,使得CPU没有足够的资源对高速数据报文进行分析,影响了网络的性能,制约了网络的应用。因此,本文设计了一种网络安全加速卡来有效解决网络数据包处理的瓶颈问题。本文首先介绍了课题的研究背景,概述了网络安全方面的威胁和对策、网络加速方面的常见技术。接着,对多种处理器的实现方式进行比较,得出了本文的主要研究内容。通过对网络隔离原理的分析,总结了网络安全隔离的要求;对数据包分类字段、TCAM的硬件查找原理和规则管理算法做深入的研究,总结出一种合适的硬件规则管理方法。在此基础上,设计一种基于FPGA的网络安全加速卡,该卡采用硬件数据包分类和硬件转发的方式来分担CPU的数据分析和转发工作量。另外,通过对匹配条目的具体配置,和对网络数据报文的采样,能够有效地拦截有威胁的报文,具备网络安全功能。网络安全加速卡的设计包括:总体框架设计、网络接口模块设计、硬件查找模块设计、硬件转发模块设计、PCIE总线接口设计、电源时钟设计、掉电保护电路设计、FPGA设计。最后,就网络应用的主要性能,与软件加速方法做了具体的比较。本设计在用硬件方式实现数据报文分析、规则匹配、报文转发等功能的基础上,还为未来可能的新应用保留了升级的空间。在保持现有硬件平台不变的基础上,通过软件的升级可以实现地址转换、状态跟踪和Qos等功能。本设计具有比较好的可扩展性和应用价值。更多还原

【Abstract】 With the rapid expansion of the network applications and the continuous improvement of network performance, security gateway’s throughput rapidly grows from the original scores of megabytes per second to several megahertz or multi-gigabit per second. Moreover, the security gateway is extending from the traditional firewall applications to the UTM, online data stream analysis, web access management and other fields. Therefore, the network management device needs to have a more powerful capability of CPU processing, data analysis and flow packet forwarding to support high-speed running of the entire network. In practical applications, the forward work often consumes too much server CPU resources, and makes the CPU not have enough resources to analyze high-speed data packet, limiting the network performance and application. A network security accelerator is designed to effectively solve the bottlenecks in network packet processing.Firstly, the background of the research is introduced. An overview of threats and countermeasures about network security, and the common technology about network acceleration is given. Then, implementations based on multi processors are compared, obtaining the main contents of this paper. By analyzing the principles of network isolation, the network security requirement of the separation is summed up. Algorithms that search for hardware principles and rules management for Packet Classification, TCAM is studied deeply. An appropriate hardware rules management is summed up. On above basis, a network security accelerator card based on FPGA is designed. The accelerator shares data analysis and forwarding workload for CPU, through hardware packet classification and sharing. At last, by matching the specific configuration items, and network data packet sampling, threatening messages can be effectively blocked with network security features.The design of network security accelerator card includes the overall framework, network interface, hardware search module, the hardware forwarding module, PCIE bus interface, power clock, power-down protection circuit, FPGA design. Finally, the main performance for network applications is compared with the software accelerated method.In this design, space for upgrade is reserved based on data packet analysis, rule matching, packet forwarding and other functions with hardware. While maintaining the existing hardware platform unchanged, functions of the address translation, state tracking and Qos can be achieved through software upgrades. This design is of better scalability and application.更多还原