Research On FPGA-based Network Attack Defense Key Technology

Network security has always been accompanied by the development of computernetwork, with the rapid increasement of network bandwidth and continuous expansionof Internet applications, hardware-based network security technology as the mosteffective measure of access control continuously improve the performance anddevelop new architectures for different application fields, such as application specificintegrated circuit(ASIC), network processor(NP), field－programmable gate array(FPGA), and so on. With the advantage of programmable, scalability, and shortdesign cycle, FPGA-based network security techonolgy can effectively providespecific security control strategy based on different application areas.This paper completes the design of FPGA-based network security platform, andcarrys out research on network attack defense key technology. This paper describesthe hardware system architecture of FPGA-based network security platform, discussesthe design principles of network communication circuit and FPGA hardware systemsin detail, normalizes one-way transmission control network, protocol and contentfiltering to packet filtering issues according to different characteristics of networkattacks, shows the RTL code architecture, and expounds the design method ofnetwork chip driver module, CAM-based packet filtering engine and half-duplexscheduling mechanism. This paper uses a hierarchical approach to test bidirectionaldata forwarding, network security and other functions step by step, and describes thetest system, method of analysis and test results of each step.The experiment results show that the FPGA-based network security platform cancorrectly realize network data forwarding and processing. The test results underdifferent security policies shows the effectiveness of the network security architecturebased on packet filtering engine designed in this paper.