Show simple item record

dc.contributor.authorFiessler, Andreasen
dc.contributor.authorHager, Svenen
dc.contributor.authorScheuermann, Björnen
dc.contributor.authorMoore, Andrewen
dc.date.accessioned2016-06-09T11:15:37Z
dc.date.available2016-06-09T11:15:37Z
dc.date.issued2016-03-17en
dc.identifier.urihttps://www.repository.cam.ac.uk/handle/1810/256224
dc.description.abstractWith network traffic rates continuously growing, security systems like firewalls are facing increasing challenges to process incoming packets at line speed without sacrificing protection. Accordingly, specialized hardware firewalls are increasingly used in high-speed environments. Hardware solutions, though, are inherently limited in terms of the complexity of the policies they can implement, often forcing users to choose between throughput and comprehensive analysis. On the contrary, complex rules typically constitute only a small fraction of the rule set. This motivates the combination of massively parallel, yet complexity-limited specialized circuitry with a slower, but semantically powerful software firewall. The key challenge in such a design arises from the dependencies between classification rules due to their relative priorities within the rule set: complex rules requiring software-based processing may be interleaved at arbitrary positions between those where hardware processing is feasible. We therefore discuss approaches for partitioning and transforming rule sets for hybrid packet processing, and propose HyPaFilter, a hybrid classification system based on tailored circuitry on an FPGA as an accelerator for a Linux netfilter firewall. Our evaluation demonstrates 30-fold performance gains in comparison to software-only processing.
dc.description.sponsorshipHorizon 2020 (Grant ID: SSICLOPS project, 644866)
dc.languageEnglishen
dc.language.isoenen
dc.publisherAssociation for Computing Machinery
dc.subjectpacket classificationen
dc.subjectFPGA hardware acceleratoren
dc.subjectfirewallen
dc.titleHyPaFilter: A Versatile Hybrid FPGA Packet Filteren
dc.typeConference Object
dc.description.versionThis is the author accepted manuscript. The final version is available from the Association for Computing Machinery via http://dx.doi.org/10.1145/2881025.2881033en
prism.endingPage36
prism.publicationDate2016en
prism.publicationNameANCS '16 Proceedings of the 2016 Symposium on Architectures for Networking and Communications Systemsen
prism.startingPage25
dc.identifier.doi10.17863/CAM.166
dcterms.dateAccepted2016-01-07en
rioxxterms.versionofrecord10.1145/2881025.2881033en
rioxxterms.versionAMen
rioxxterms.licenseref.urihttp://www.rioxx.net/licenses/all-rights-reserveden
rioxxterms.licenseref.startdate2016-03-17en
dc.contributor.orcidMoore, Andrew [0000-0002-5494-9305]
rioxxterms.typeConference Paper/Proceeding/Abstracten


Files in this item

Thumbnail

This item appears in the following Collection(s)

Show simple item record