摘要
随着网络应用范围的迅速扩大和网络性能的不断提高,安全网关的吞吐量从原来的几十兆/每秒迅速增长到几百兆/每秒甚至几千兆/每秒。另外,安全网关从传统的防火墙应用扩展到UTM、在线流量分析监控、Web访问管理等领域。因此,网络管理设备需要有更加强大的CPU处理能力、更强大的数据报文分析能力和流量转发能力来支撑整个网络的高速运转。在实际应用过程中,转发工作往往消耗了过多的服务器CPU资源,使得CPU没有足够的资源对高速数据报文进行分析,影响了网络的性能,制约了网络的应用。因此,本文设计了一种网络安全加速卡来有效解决网络数据包处理的瓶颈问题。
本文首先介绍了课题的研究背景,概述了网络安全方面的威胁和对策、网络加速方面的常见技术。接着,对多种处理器的实现方式进行比较,得出了本文的主要研究内容。通过对网络隔离原理的分析,总结了网络安全隔离的要求;对数据包分类字段、TCAM的硬件查找原理和规则管理算法做深入的研究,总结出一种合适的硬件规则管理方法。在此基础上,设计一种基于FPGA的网络安全加速卡,该卡采用硬件数据包分类和硬件转发的方式来分担CPU的数据分析和转发工作量。另外,通过对匹配条目的具体配置,和对网络数据报文的采样,能够有效地拦截有威胁的报文,具备网络安全功能。
网络安全加速卡的设计包括:总体框架设计、网络接口模块设计、硬件查找模块设计、硬件转发模块设计、PCIE总线接口设计、电源时钟设计、掉电保护电路设计、FPGA设计。最后,就网络应用的主要性能,与软件加速方法做了具体的比较。
本设计在用硬件方式实现数据报文分析、规则匹配、报文转发等功能的基础上,还为未来可能的新应用保留了升级的空间。在保持现有硬件平台不变的基础上,通过软件的升级可以实现地址转换、状态跟踪和Qos等功能。本设计具有比较好的可扩展性和应用价值。
With the rapid expansion of the network applications and the continuous improvement of network performance, security gateway's throughput rapidly grows from the original scores of megabytes per second to several megahertz or multi-gigabit per second. Moreover, the security gateway is extending from the traditional firewall applications to the UTM, online data stream analysis, web access management and other fields. Therefore, the network management device needs to have a more powerful capability of CPU processing, data analysis and flow packet forwarding to support high-speed running of the entire network. In practical applications, the forward work often consumes too much server CPU resources, and makes the CPU not have enough resources to analyze high-speed data packet, limiting the network performance and application. A network security accelerator is designed to effectively solve the bottlenecks in network packet processing.
Firstly, the background of the research is introduced. An overview of threats and countermeasures about network security, and the common technology about network acceleration is given. Then, implementations based on multi processors are compared, obtaining the main contents of this paper. By analyzing the principles of network isolation, the network security requirement of the separation is summed up. Algorithms that search for hardware principles and rules management for Packet Classification, TCAM is studied deeply. An appropriate hardware rules management is summed up. On above basis, a network security accelerator card based on FPGA is designed. The accelerator shares data analysis and forwarding workload for CPU, through hardware packet classification and sharing. At last, by matching the specific configuration items, and network data packet sampling, threatening messages can be effectively blocked with network security features.
The design of network security accelerator card includes the overall framework, network interface, hardware search module, the hardware forwarding module, PCIE bus interface, power clock, power-down protection circuit, FPGA design. Finally, the main performance for network applications is compared with the software accelerated method.
In this design, space for upgrade is reserved based on data packet analysis, rule matching, packet forwarding and other functions with hardware. While maintaining the existing hardware platform unchanged, functions of the address translation, state tracking and Qos can be achieved through software upgrades. This design is of better scalability and application.
引文
[1] P. Gupta, N. Mc Keown. Algorithms for Packet Classification [J]. IEEE Network, 2001, 15(2): 24~32
[2]李正茂.网络隔离理论与关键技术研究[D].上海:同济大学.2006, 3
[3]严蔚敏,吴伟民.数据结构(C语言版).北京:清华大学出版社, 1997: 80~84
[4]郑连清,崔捷,马哲元.安全网络概论[M].北京:清华大学出版社, 2004
[5]龚俭,陆晟,王倩.计算机网络安全导论[M].南京:东南大学出版社,2000.8
[6]高峰,许南山.防火墙包过滤规则问题的研究[J].计算机应用, 2003.6
[7]蔡淑珍,陆阳,陈蕾.基于分布的嵌入式防火墙的设计与实现[J].计算机工程与应用, 2003(11): 162~164
[8]谢树新.浅谈防火墙系统的研究现状与发展趋势[J]. IT技术, 2007. (6), 12-13, 8
[9] S. Deering, R. Hinden. Internet Protocol, Version 6 (IPv6) Specification [S]. IETF, RFC 2460, 1998
[10] S.Blake, D.Black, M.Carlson et al. An Architecture for Differentiated Services [S]. IETF, RFC 2475, 1998
[11] R. Braden, D. Clark, S.Shenker. Integrated Services in the Internet Architecture: an Overview [S]. IETF, RFC 1633, June 1994
[12]谢希仁.计算机网络(第四版) [M].北京:电子工业出版社, 2003, 232~240
[13] A.Conta, S.Deering.Generic. Packet Tunneling in IPv6 Specification [S]. IETF, RFC 2473, 1998
[14] B. Carpenter, C. Jung. Transmission of IPv6 over IPv4 Domains without Explicit Tunnels [S]. IETF, RFC 2529, 1999
[15] R. Gilligan, E. Nordmark. Transition Mechanisms for IPv6 Hosts and Routers [S]. IETF, RFC 2893, August 2000
[16] B. Carpenter, K. Moore. Connection of IPv6 Domains via IPv4 Clouds[S]. IETF, RFC 3056, 2001
[17] M. Roesch. Snort-Lightweight Intrusion Detection for Networks [M]. In: Proceedings of the 13th Conference on Systems Administration. Washington: USENIX, 1999.
[18] G. Apostolopoulos, D. Aubespin, V. Peris, et al. Design, Implementation and Performance of a Content-Based Switch [J]. In: Proceedings of IEEE Infocom 2000, March 2000.
[19] A. Cohen, S. Rangarajan, H.Slye. On the Performance of TCP Splicing for URL-aware Redirection [J].In: Proceedings of the 2nd USENIX Symposium on Internet Technologies and Systems, October 1999: 117~125
[20] T. Y. C. Woo. A Modular Approach to Packet Classification: Algorithms and Results [J]. In: Gruein R ed. Proceedings of IEEE Infocomm 2000. San Francisco, CA: IEEE Computer Society Press, 2000. 1210~1217
[21] K. Thompson, G. J. Miller, R. Wilder. Wide-area Internet Traffic Patterns and Characteristics [J]. IEEE Network, 1997, 11(6): 10~27
[22] T.Kijkanjanarat.Fast Routing Lookup and Packet Classification for Next- generation Router: [PhD Dissertation] [J]. Polytechnic University, 2002
[23]喻中超,吴建平,徐恪. IP分类技术研究[J].电子学报. 2001, 29(2): 260~262
[24]冯东雷,张勇,白英彩.线速数据包输入处理技术[J].计算机研究与发展, 2002, 39(1):41~48
[25]李胜磊,张德运,刘刚.基于CAM的高速IP数据包分类技术[J].计算机工程, 2004, 30(4): 81~82, 101
[26]付歌,杨明福,陈骏.基于TCAM的快速更新算法[J].计算机工程, 2003, 29(9): 19~21
[27]田立勤,林闯.报文分类技术的研究及其应用[J].计算机研究与发展, 2003, 40(06): 765～775
[28]单征,赵荣彩,张铮.报文分类算法研究[J].计算机工程与应用, 2005, 41(7): 149~152
[29]朱秋香,陶军.流分类算法研究综述[J].小型微型计算机系统, 2004, 25(10): 1802~1810
[30]王燕.实现IPv6数据包分类的算法研究[J].计算机应用, 2005, 25(11):2052~2054, 2520
[31]高蕾,谭明峰,龚正虎. IP报文分类算法综述与评价[J].计算机工程与科学, 2006, 28(3): 70~73, 105
[32]赵国锋,谷上宇,温智宇.一种多域数据包快速分类算法[J].通信学报, 2002, 23(12): 378~384
[33]陈骏,杨明福.基于Trie结构的并行多维数据包分类[J].计算机应用与软件, 2003, 20(11): 61~63
[34] V. Srinivasan, S. Suri, G.Varghese, M. Waldvogel. Fast and Scalable Layer four Switching [J]. In: Proceedings of ACM Sigcomm'98, 1998: 191~202
[35] M. M. Buddhikot, S Suri, M Waldvogel. Space Decomposition Techniques for Fast Layer-4 Switching [J]. In: Proceedings of Conference on Protocols for High Speed Networks. Salem, MA, USA: Kluwer Academic Publishers, 1999: 25~41
[36]邵华钢,杨明福.基于空间分解技术的多维数据包分类[J].计算机工程, 2003, 29(12): 123~124,172
[37]付歌,杨明福,王兴军.基于空间分解的数据包分类技术[J].计算机工程与应用, 2004, 40(8): 63~65, 139
[38] A. Feldman and S.Muthukrishnan. Tradeoffs for Packet Classification [J]. In: Proceedings of IEEE Infocom, 2000: 193-202
[39] F. Baboescu, G.Varghese. Scalable Packet Classification [J].In: Proceedings of ACM Sigcomm,2001. 199~210
[40]韩晓非,王学光,杨明福.位并行数据包分类算法研究[J].华东理工大学学报, 2003, 29(5): 504~508
[41]唐兴艳,汪纪锋.一种高效的多维数据包分类算法[J].重庆邮电学院学报(自然科学版), 2005, 17(6): 733~735, 758
[42]尚凤军,潘英俊.基于XOR Hash的快速IP数据包分类算法研究[J].计算机工程与应用, 2005, 41(8): 1~3, 77
[43]杨勇,瞿中,何江平.基于散列查找的数据包分流算法研究[J].计算机工程与设计, 2005, 26(4): 927~929
[44]尚凤军,王海霞.基于完全无冲突哈希的IP数据包分类算法研究[J].计算机工程与应用, 2004, 40(34): 173~175
[45] P. Gupta, N. McKeown. Packet Classification on Multiple Fields [J]. In: Proceedings of ACM Sigcomm'99, 1999: 147~160
[46] P. Gupta, N. McKeown. Packet Classification Using Hierarchical Intelligent Cuttings [J]. IEEE Micro, 2000, 20(1): 34~41
[47] V. Srinivasan, S. Suri, G.Varghese. Packet Classification Using Tuple Space Search [J].TheACM Sigcomm’99, 1999. 135~146
[48] J. van Lunteren, APJ Engbersen. Multi-field Packet Classification Using Ternary CAM[J]. IEE Electronics Letters, 2002, 38(1): 21~23
[49] T. V. Lakshman, D. Stidialis. High-Speed Policy-based Packet Forwarding Using Efficient Multi-dimensional Range Matching [J].In: Proceedings of ACM Sigcomm’98, 1998. 191~202
[50] Douglas E. Comer.网络处理器与网络系统设计(英文版) [M].北京:电子工业出版社, 2004. 158
[51] S. Iyer, R. Rao Kompella, A Shelat. ClassiPI: An Architecture for Fast and Flexible Packet Classification [J]. IEEE Network, 2001, 15(2): 33~41
[52] D. Shah and P. Gupta. Fast Updating Algorithms for TCAMs [J]. IEEE Micro, 2001, 21(1): 36~47
[53] R. Panigrahy, S. Sharma. Sorting and Searching Using Ternary CAMs [J]. IEEE Micro, 2003, 23(1): 44~53
[54] T. Lecroq. Experimental Results on String Matching Algorithms [J].Software- Practice & Expierence, 1995, 25(7): 727~765
[55] I. Sourdis. Efficient and High-Speed FPGA-based String Matching for Packet Inspection: [Master’s Thesis] [J]. ECE Dept, Technical University of Crete (TUC), Chania, Greece, July 2004
[56]王诚,吴继华,范丽珍,薛宁,薛小刚. Altera FPGA/CPLD设计(高级篇)[M].北京:人民邮电出版社, 2005
[57] B. Bloom. Space/Time Trade-Offs in Hash Coding with Allowable Errors[J]. Commmunication of the ACM, 1970, 13(7): 422~426
[58] A. Aho, MJ. Corasick. Efficient String Matching: An aid to Bibliographic Search [J]. Communications of the ACM, 1975, 18(6): 333~340
[59] Long Bu,John A. Chandy. FPGA Based Network Intrusion Detection using Content Addressable Memories [J].In: Proceedings of the 12th Annual IEEE Symposium on Field-Programmable Custom Computing Machines (FCCM'04), 2004. 316~317
[60] Xu Ke, Wu Jian-ping, Yu Zhong-chao et al. A Non-Collision Hash Trie-Tree Based Fast IP Classification Algorithm[J]. Computer Science and Technology, 2002, 17(2): 219~226
[61]彭元杰.高速电路信号完整性分析[D].长沙:湖南大学, 2007.5
[62]张华.高速互联系统的信号完整性研究[D].南京:东南大学, 2005.1
[63]王诚,吴继华,范丽珍,薛宁,薛小刚. Altera FPGA/CPLD设计(初级篇)[M].北京:人民邮电出版社. 2005
[64]布达科(美),译者:田玉敏等. PCI Express系统体系结构[M]. 2005.11