基于FPGA的访问控制列表并行查找设计与实现  

Design and implementation of access control list parallel lookup based on FPGA

作　　者：许芮铭 武刚 Xu Ruiming;Wu Gang(No.30 Institute of China Electronics Technology Group Corporation,Chengdu 610041,China)

机构地区：[1]中国电子科技集团公司第三十研究所,四川成都610041

出　　处：《无线互联科技》2024年第8期110-113,共4页Wireless Internet Technology

摘　　要：在高安全要求的网络环境中,多种类型的网络设备均需要部署基于规则的访问控制功能。访问控制列表通过五元组进行规则匹配,实现对网络报文的筛选、过滤、处理、控制等操作。如何利用有限的资源实现更高查表性能、更多规则数量的访问控制列表,是相关设备的关键技术之一。通过分析网络通信设备中访问控制列表的一般工作流程,文章提出了一种改进的基于现场可编程逻辑门阵列(Field Programmable Gate Array,FPGA)实现的访问控制列表并行查找设计方法,并详细阐述了具体模块的实现方案。实验结果表明,该方案可以充分利用FPGA的存储与逻辑资源,实现较大规模的支持范围匹配的规则表项,并可以支持10 Gpbs速率等级网络通信的查表需求。In a network environment with high security requirements,many types of network devices need to deploy rule-based access control functions.By matching five-tuple with rules,the access control lists realize the screening,filtering,processing and control of network messages.How to utilize limited resources to achieve higher lookup performance and more number of rules for access control lists is one of the key technologies for related devices.By analyzing the general workflow of access control lists in network communication devices,an improved design method for parallel lookup of access control lists based on FPGA implementation is proposed,and the implementation scheme of specific modules is elaborated.The implementation results show that the scheme can make full use of the storage and logic resources of FPGA,realize a larger scale of the number of range matching rule table entries,and support the table lookup demand of 10 Gbps rate class network communication.

关 键 词：访问控制列表 FPGA 并行查找 五元组 范围匹配 

分 类 号：TN915.05[电子电信—通信与信息系统]