Method for improving hardware acceleration performance of fire wall chip

Abstract

The invention discloses a method for improving the acceleration performance of the hardware of a firewall chip. The method of the invention comprises the steps that: the exterior of the firewall chip is configured with an external memory, in which an area is respectively divided for a connecting index table and a connecting table, and the base addresses of the connecting index table and the connecting table are stored into the firewall chip and a CPU. The mirror images of the connecting index table and the connecting table are established in a CPU memory. The mirror images, and the connectingindex table and the connecting table in the external memory of the firewall chip are kept synchronizing. Then, the firewall chip and the CPU work collaboratively so as to realize the access and the establishment to the connecting index table and the connecting table. The method of the invention fundamentally solves the problem that the connecting list items of the existing speeding-up firewall ofthe hardware are too few and concurrent connections can not meet the requirement of the performance of the firewall. In addition, the enlarged connecting index table and the connecting table reduce the probability of the conflict of HASH algorithm and enhance the efficiency of processing the data packet of the firewall chip.

Description

technical field [0001] The invention belongs to the field of network technology, relates to network security and networking technology, in particular to a method for enabling a firewall chip to efficiently forward data packets and simultaneously improving the search hit rate of connection table items under the condition of large network traffic. Background technique [0002] With the continuous development of network technology, people have higher and higher requirements for network response speed, data packet throughput and network security, and a security firewall with small delay and large traffic is required. This requires chips to achieve hardware acceleration and improve the performance of firewalls. At present, most data packets on the Ethernet network (Ethernet) are transmission control protocol packets (TCP packets) and user datagram protocol packets (UDP packets). These data packets are grouped according to connections, and the same group of TCP packets or UDP pac...

AI Technical Summary

Problems solved by technology

In this way, the firewall chip can directly forward very few data packets, which cannot achieve the purpose of hardware acceleration, and most of the data packets must be sent to the CPU for processing, causing the performance of the firewall to decline sharply or even paralyzed

Images