FPGA-based firewall hardware acceleration method and system

Abstract

The application relates to the technical field of firewall hardware acceleration, and discloses a FPGA-based firewall hardware acceleration method and system, which comprises the following steps: collecting original network messages based on FPGA and performing message analysis to obtain the standardized five-tuple, the first packet connection anchor point abstract and the arrival clock label of the original network messages, and encapsulating the same into observable anchor point data; determining the connection context identification of the original network messages, and establishing the migration observation window of the original network messages; performing connection migration decision on the original network messages, merging the legal migration messages, and generating connection state data; and updating the hardware disposal strategy of the firewall based on the connection state data. The application realizes message collection and analysis, connection context binding, migration decision and strategy acceleration based on FPGA, performs the same connection determination and state merging at the hardware level in real time and with low misjudgment for the five-tuple change caused by the QUIC connection migration, so that the continuity and safety of the firewall strategy execution are ensured.

Images