基于fpga的ip分组分类器的设计与实现-计算机应用技术专业论文.docxVIP

摘 摘 要 I万方数据 I 万方数据 摘 要 随着千兆、万兆高速局域网以及光纤通信等技术的应用，Interne 的网络流量和性 能得到了极大的提高。在这种高速网络环境下，基于软件的网络入侵检测系统（NIDS） 已经无法实时完成高速网络数据流的处理，造成丢包和漏报现象经常发生。因此研究 和设计高速的 NIDS 系统，以便适应当前高带宽和高负荷的网络环境成为了网络安全 领域急需解决的技术难题。 本文在研究目前典型的 IP 分组分类算法的基础上，综合考虑各种算法的优缺点 后，提出了一种将三重内容可寻址存储器（TCAM）分类算法运用到高速 NIDS 的规 则头检测方案，并根据此方案设计了一个 IP 分组分类器。该分类器实现了 IEEE 802.3u 全双工以太网的 MAC 功能，通过捕获 IP 分组，并利用 TCAM 的高速数据匹配机制， 来完成 NIDS 的规则头的高速检测工作。分类器的设计基于 FPGA 技术，使用的 FPGA 器件是 100 万门的 Xilinx 的 Virtex-II XC2V1000。 本文的研究工作，为开发自主的 IP 分组分类器积累了实践经验，并对促进基于 硬件技术的高速 NIDS 系统的发展具有意义。 关键词：IP 分组分类器、TCAM、NIDS、FPGA 、MAC AB ABSTRACT II万方数据 II 万方数据 ABSTRACT With the application in technology such as Gigabit, 10-Gigabit high-speed LANs and fiber optical communications, network traffic and performance of Internet have got great improvement. Under such high-speed network environment , the network intrusion detection system (NIDS) based on software are unable to complete the processing of the high-speed data stream in real time, which causes packet loss and alarm missing frequently. Therefor the study and design of high-speed NIDS system has become a technical problem of great urgency need to be solved in the network security domain. Based on the research of typical algorithms for packet classification and considering the performance of these algorithms, a detection method of NIDS’ rule header which adopts ternary content addressable memory (TCAM) classifying algorithm is presented. An packet classifier is developed according to the above method. The classifier implements the MAC functions of IEEE 802.3u full duplex Ethernet. Through capturing packets and using the high-speed matching mechanism of TCAM, the high-speed detection of NIDS’ rule header is completed . The design is based on Xilinx FPGA, Virtex-II XC2V1000. The research of this paper is helpful to the further research of packet classifier, and accumulate the practical experience for own packet classifier design. Also it has the significance to promote the technological development o