Method for improving hardware acceleration performance of fire wall chip

Abstract

The invention discloses a method for improving the acceleration performance of hardware of a firewall chip. The method of the invention is that: the exterior of the firewall chip is provided with an external memory, in which an area is respectively arranged for a connecting index table and a connecting table, and the base addresses of the connecting index table and the connecting table are stored into the firewall chip and a CPU. Mirror images of the connecting index table and the connecting table are established in a CPU memory. The mirror images and the connecting index table and the connecting table in the external memory of firewall chip are kept synchronizing. Then, the firewall chip and the CPU work collaboratively so as to realize the access and establishment of the connecting index table and the connecting table. The method of the invention thoroughly solves the problem that connecting list item of present speeding-up firewall of hardware is too small and concurrent connections are unable to meet requirement for the performance of the firewall. In addition, the enlarged connecting index table and the connecting table reduce the probability of conflict of HASH algorithm and enhance the efficiency of processing data packet of the firewall chip.

Description

technical field [0001] The invention belongs to the field of network technology, relates to network security and networking technology, in particular to a method for enabling a firewall chip to efficiently forward data packets and simultaneously improving the search hit rate of connection table items under the condition of large network traffic. Background technique [0002] With the continuous development of network technology, people have higher and higher requirements for network response speed, data packet throughput and network security, and a security firewall with small delay and large traffic is required. This requires a chip to achieve hardware acceleration and improve the performance of the firewall. At present, most data packets on the Ethernet network (Ethernet) are transmission control protocol packets (TCP packets) and user datagram protocol packets (UDP packets). These data packets are grouped according to connections, and the same group of TCP packets or UDP...

AI Technical Summary

Problems solved by technology

In this way, the firewall chip can directly forward very few data packets, which cannot achieve the purpose of hardware acceleration, and most of the data packets must be sent to the CPU for processing, causing the performance of the firewall to decline sharply or even paralyzed

Images