FPsed: a streaming content search-and-replace module for an Internet firewall

Moscola, James; Pachos, M.; Lockwood, John W.; Loui, Ronald P.

doi:10.1109/conect.2003.1231488

Cited by 7 publications

(2 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A match is detected when the sequence of arriving bytes causes a DFA to reach a matching state [28]. Finite automata can also be created to modify the content of the traffic, thus performing the FPGA equivalent of the common Unix Stream Editor (SED) [29].…”

Section: Payload Processingmentioning

confidence: 99%

Automated tools to implement and test Internet systems in reconfigurable hardware

Lockwood

Neely

Zuver

et al. 2003

SIGCOMM Comput. Commun. Rev.

View full text Add to dashboard Cite

Tools have been developed to automatically integrate and test networking systems in reconfigurable hardware. These tools dynamically generate circuits for Field Programmable Gate Arrays (FPGAs). A library of hardware-accelerated modules has been developed that processes Internet Protocol (IP) packets, performs header rule matching, scans packet payloads, and implements per-flow queueing. Other functions can be added to the library as extensible modules.An integration tool was developed to enable a network administrator to specify how a customized system should examine, drop, buffer, and/or modify packets. This tool joins together modules from the library to create a composite circuit that performs multiple functions. The tool allows additional modules to be quickly added to the library and integrated into systems. The integration tool has been used to create circuits that perform Internet firewall, network intrusion detection, network intrusion prevention, and Denial of Service (DoS) attack protection functions.A test tool was developed to automatically verify that circuits created by the integration tool run properly in reconfigurable hardware. Circuits created by the integration tool are deployed into a Field-programmable Port Extender (FPX) platform. As new modules were added to the library, the test tool reconfigured the logic on the FPX, injected traffic, and monitored the resulting packets.By using hardware, not software, networking system can process millions of packets per second. Together, the integration and test tools simplify the otherwise difficult task of developing reconfigurable hardware for networking systems and testing them at Gigabit per second rates.

show abstract

Section: Payload Processingmentioning

confidence: 99%

Automated tools to implement and test Internet systems in reconfigurable hardware

Lockwood

Neely

Zuver

et al. 2003

SIGCOMM Comput. Commun. Rev.

View full text Add to dashboard Cite

show abstract

“…Several mechanisms were developed to perform exact matching and longest prefix matching for header fields [23] [24] [25]. An automated design flow was created to scan the payload traffic for regular expressions [26] [27]. In addition, a Bloom filter was developed to enable large numbers of fixed-length strings to be scanned in hardware [28].…”

Section: Signature Scanning Systemsmentioning

confidence: 99%

Application of Hardware Accelerated Extensible Network Nodes for Internet Worm and Virus Protection

et al. 2004

View full text Add to dashboard Cite

Abstract. Today's crucial information networks are vulnerable to fastmoving attacks by Internet worms and computer viruses. These attacks have the potential to cripple the Internet and compromise the integrity of the data on the end-user machines. Without new types of protection, the Internet remains susceptible to the assault of increasingly aggressive attacks. A platform has been implemented that actively detects and blocks worms and viruses at multi-Gigabit/second rates. It uses the Field-programmable Port Extender (FPX) to scan for signatures of malicious software (malware) carried in packet payloads. Dynamically reconfigurable Field Programmable Gate Array (FPGA) logic tracks the state of Internet flows and searches for regular expressions and fixedstrings that appear in the content of packets. Protection is achieved by the incremental deployment of systems throughout the Internet.

show abstract

A Parallel Automaton String Matching with Pre-Hashing and Root-Indexing Techniques for Content Filtering Coprocessor

Tseng

Lin

Lee

et al.

2005 IEEE International Conference on Application-Specific Systems, Architecture Processors (ASAP'05)

View full text Add to dashboard Cite

show abstract

FPsed: a streaming content search-and-replace module for an Internet firewall

Cited by 7 publications

References 12 publications

Automated tools to implement and test Internet systems in reconfigurable hardware

Automated tools to implement and test Internet systems in reconfigurable hardware

Application of Hardware Accelerated Extensible Network Nodes for Internet Worm and Virus Protection

A Parallel Automaton String Matching with Pre-Hashing and Root-Indexing Techniques for Content Filtering Coprocessor

Contact Info

Product

Resources

About