基于FPGA的龙芯防火墙设计与实现

发布时间：2018-11-01 14:25

【摘要】：当今互联网技术发展越来越快,互联网带宽出现跨越式增长。而防火墙作为网络安全的第一道坚实堡垒,已经由传统包过滤产品进阶为下一代防火墙。与此同时,持续不断的全球性信息安全事件又提醒着人们,如果缺乏自主可控的信息技术,无法确保网络安全,更难以在国际竞争中立足。本文在研究分析众多防火墙架构及龙芯平台的基础上,提出了一种安全、自主、可控的千兆龙芯防火墙解决方案——基于FPGA的龙芯防火墙的设计与实现。本文主要研究的关键预期目标是:实现千兆线速的龙芯防火墙。系统设计将龙芯架构作为防火墙的策略控制平台,采用FPGA技术利用硬件电路实现网络数据流的线速处理和安全过滤。主要工作有:1)基于对防火墙产品发展历史及不同架构平台的研究,对现有的龙芯单路防火墙系统的架构进行分析。完成下一代防火墙架构和FPGA技术的技术研究。2)因原有单路防火墙平台的性能羸弱和可扩展能力不足。首要工作需将龙芯防火墙系统升级到双路龙芯平台,经过重新编译内核并使得原有对单处理器的配置调整到双处理器平台的支持,以及对PMON、内核、驱动层等一系列优化实现工作,使得防火墙系统顺利运行在双路龙芯平台。同时,对双路平台进行了性能测试,比单路平台性能得到大幅提升,但还未达到预期目标。3)为了实现预期目标。设计系统框架并对关键技术进行说明,包括FPGA硬件数据流、五元组数据流处理及零拷贝加速设计;其次,通过控制、数据平面的联动实现,将防火墙系统的访问控制功能迁移到FPGA模块;零拷贝驱动的实现及连接状态跟踪表状态的同步,使FPGA模块成为龙芯防火墙的高性能网卡并实现完整的状态检测和包过滤功能。通过以上的研究,本文作者利用实际的测试验证了FPGA模块的加速效果。基于FPGA的龙芯双路防火墙在测试环境下得出理想的测试数据,吞吐量、最大并发连接数和新建连接数等防火墙性能指标均能稳定达到千兆线速。系统功能实现和性能提升都达到预期的效果。
[Abstract]:Nowadays the Internet technology develops more and more rapidly, the Internet bandwidth appears leaps and bounds growth. As the first solid fortress of network security, firewall has been advanced from traditional packet filtering products to the next generation firewall. At the same time, the continuous global information security events remind people that if they lack independent and controllable information technology, they can not ensure network security, and it is even more difficult to establish a foothold in international competition. Based on the research and analysis of many firewalls and their platforms, this paper puts forward a safe, autonomous and controllable gigabit firewall solution, which is based on the design and implementation of the Dragon Core Firewall based on FPGA. The key goal of this paper is to realize the Dragon Core Firewall with gigabit line speed. The system uses the core architecture as the policy control platform of the firewall, and adopts the FPGA technology to realize the line speed processing and security filtering of the network data flow by using the hardware circuit. The main work is as follows: 1) based on the research of firewall product development history and different architecture platforms, the architecture of the existing single-channel firewall system is analyzed. Complete the next generation firewall architecture and FPGA technology research. 2) the performance of the original single-way firewall platform is weak and scalability is insufficient. The most important work is to upgrade the Godson Firewall system to the dual-channel Godson platform, recompile the kernel and adjust the configuration of the single processor to the support of the dual-processor platform, as well as the PMON, kernel. A series of optimization work, such as driver layer, makes firewall system run smoothly on double channel core platform. At the same time, the performance of the dual-channel platform is tested, which is much better than that of the single-channel platform, but it has not reached the expected target. 3) in order to achieve the expected goal. The system framework is designed and the key technologies are described, including FPGA hardware data flow, five-tuple data stream processing and zero-copy acceleration design. Secondly, the access control function of firewall system is transferred to FPGA module through control and the linkage of data plane. The implementation of zero-copy driver and the synchronization of the state of the connected state tracking table make the FPGA module become the high-performance network card of the Dragon Core Firewall and realize the complete function of state detection and packet filtering. Through the above research, the author uses the actual test to verify the acceleration effect of the FPGA module. Under the test environment, the performance index of the dual-channel firewall based on FPGA can reach gigabit line speed stably, such as ideal test data, throughput, maximum concurrent connection number and new connection number. The system function realization and the performance enhancement all reach the anticipated effect.
【学位授予单位】：中国科学院大学(中国科学院工程管理与信息技术学院)
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【相似文献】