Motivation for this class

Transcription

1 CSE 535 : Lecture 1 Itroductio to Acceleratio of Networkig Algorithms i Hardware Washigto Uiversity Fall Copyright 2003, Joh W Lockwood Lockwood@arl.wustl.edu CSE 535 : Lockwood 1 Motivatio for this class Iteret hosts are ofte attacked Iteret worms ad computer viruses spread quickly SoBigF worm affected > 350,000 hosts by Aug 16, 2003 SPAM is Rampat Over 50% of all traffic Networks are Fast Gigabit Network adapters widely available PCI-based Gigabit NIC cards sold for uder $40 from Best Buy Backboe etworks operate at multi-gigabit/secod rates OC4 = 2.4 Gigabits/secod ad faster Solutio: Need Hardware-accelerated Firewall o a Chip Network Itrusio Detectio Network Itrusio Prevetio CSE 535 : Lockwood 2

2 Providig Network Security i Hardware Make it suitable for etwork-wide deploymet Fast (Gigabit+ throughput) Small (Sigle-chip solutio) Have it implemet baselie fuctioality Sca Iteret headers ad payload Eable it to perform additioal features Extesible modules i recofigurable hardware Let it be easy to use Provide web-based cotrol ad cofiguratio meus CSE 535 : Lockwood 3 Solutio Platform Field-programmable Port Exteder (FPX) platform Dyamically recofigurable hardware Recofigurable hardware implemets all header, payload, ad traffic flow processig CSE 535 : Lockwood 4

3 Cofiguratio to process real traffic Fiber-optic Uplik FPX ruig SOPC firewall Fast Etheret Switch Wide Area Network Router / Switch Cotet-Aware, Firewall Iteret Protected Host(s) CSE 535 : Lockwood 5 Iteret Protocol (IP) Packet Header Specifies Source & Destiatio Address Trasfers up to 64kB of data ver IHL service type total legth idetificatio flags fragmet offset ttl protocol header checksum source address destiatio address optios paddig CSE 535 : Lockwood 6

4 Sample Iteret Packet Header Source Address = (dotted.decimal) Destiatio Address = (dotted.decimal) Source 4096 (decimal) Destiatio 0 (decimal) Protocol = TCP (6) All values show I hex Src IP (hex) = 0FC0505 Dest IP (hex) = DE0202 Src 1000 Dest 0050 Proto = 06 CSE 535 : Lockwood 7 Sample Header Matchig Rule Packet matches if followig coditios met: Source Address = / 16 Destiatio Address = / 16 Source Do t Care Destiatio 0 Protocol = TCP (6) Src IP value = 0FC0000 Dest IP (hex) = CAM_MASK_1 DE0000 Src 0000 Dest 50 Proto = 06 Value Src IP (hex) = FFFF0000 Dest IP (hex) = CAM_VALUE_1 FFFF Src 0000 Dest FFFF Proto = FF 7 0 Mask: 1=care 0=do t care Src IP (hex) = 0FC0505 Dest IP (hex) = DE0202 Src 1000 Dest 0050 Proto = 06 IP Packet CSE 535 : Lockwood

5 Matchig w/terary Cotet Addressable Memory (TCAM) 16 bits 112 bits Flow ID [1] CAM MASK [1] CAM VALUE [1] Flow ID [2] CAM MASK [2] Flow ID 16 bits Flow ID [3] CAM VALUE [2] --CAM Table -- CAM MASK [3] Resultig Flow Idetifier... Flow ID [N]... CAM VALUE [3]... CAM MASK [N] CAM VALUE [N] Flow List Bits i IP Header Priority Ecoder Mask Matchers Value Comparators Payload Match Bits Source Address Source Port Destiatio Address Dest. Port Protocol CSE 535 : Lockwood 9 Sample Keywords i packet payloads Geeral SPAM (A a)(m m)(a a)(z z)(i i)(n )(G g) CALL NOW (L l)imited (T t)ime (O o)ffer Save Moey SPAM (C c)osolidate (F f)(u u)(l l)(l l) (R r)(e e)(f f)(u u)(n )(D d) Fast Moey SPAM MAKE MONEY FAST (W w)ork from home Chais ad Forwards Read this FWD Jokes (J j)oke walks ito bar Work List (H h)omework (M m)achie (P p)roblem (C c)(s s)536 Lockwood Washigto Uiversity Persoal List (M m)om (D d)ad (C c)all (H h)ome Urget (U u)(r r)(g g)(e e)(n )(T t) Emergecy CSE 535 : Lockwood 10

6 FPgrep Module Regular Expressio Buffer RE[1] RE[2] RE[3] RE[-1] RE[] Logic Cotroller Output Buffer 1 Alert Packet Geerator CSE 535 : Lockwood 11 Icreased Throughput via Parallelism RE[1] RE[2] RE[3] RE[N-1] RE[N] Dispatcher RE[1] RE[1] RE[2] RE[2] RE[3] RE[3] RE[N-1] RE[N-1] RE[N] RE[N] Flow Cotrol RE[1] RE[2] RE[3] RE[N-1] RE[N] Four Parallel Scaers CSE 535 : Lockwood 12

7 Cotet Matchig Module Data Iput Regular Expressio (RE) Matchig Circuit Data Output Cotet Match Vector CSE 535 : Lockwood 13 Architecture of a System-O-Chip Firewall Xilix XCV2000E FPGA SDRAM 2 Cotroller SDRAM 1 Cotroller Iterfaces to Off- Chip Memories Free List Maager SRAM 1 Cotroller Payload Scaer TCAM Filter Payload Match Bits Flow ID Extesible Module(s) Flow Buffer Queue Maager Layered Iteret Protocol Wrappers Packet Scheduler (Implemeted i CS 536, Fall 2002) CSE 535 : Lockwood 14

8 SOC-Firewall FPGA Layout Memory Cotroller Regio for Extesible Plug-i Modules CSE 535 : Lockwood Packet Store Maager TCAM Header Filterig Regular Expressio Payload Filterig Layered Protocol Wrappers Per-flow Queuig 15 Field programmable Port Exteder (FPX) Off-chip Memories Off-chip Memories Addr PC100 PC100 SDRAM SDRAM D[64] Addr ZBT SRAM D[36] ZBT SRAM Recofigurable Applicatio Device (RAD) FPGA SelectMAP Recofiguratio Iterface RAD Program SRAM Network Iterface Device (NID) FPGA NID Program PROM Subet A Subet B CSE 535 : Lockwood 2.4 Gigabit/sec Network Iterfaces 16

9 Sample Waveform of Packet through Hardware CSE 535 : Lockwood 17 Iput ad Output Packets Shows iput packets Shows output packets Displays packets as HTML tables with color coded header fields CSE 535 : Lockwood 1

10 Process to Build Custom Firewalls Hardware Developer Uploads extesible Plug-i modules Module Collector Hardware Developer Module Library Module Parameters Network Admiistrator Selects modules for custom firewall SOPC Geerator Customized SoC Bitfile MSE 03 CSE 535 : Lockwood 19 Web-based Itegratio Tool CSE 535 : Lockwood 20

11 Recofigure hardware over etwork New module developed Cotet Matchig Server geerates New module i programmable Logic Module Bitfile trasmitted over etwork New module deployed ito FPX hardware Iteret CSE 535 : Lockwood 21