Increasing the Security of Network Data Transmission with a Configurable Hardware Firewall Based on Field Programmable Gate Arrays

Marco Grossi (), Fabrizio Alfonsi, Marco Prandini and Alessandro Gabrielli
Additional contact information
Marco Grossi: Department of Electrical Energy and Information Engineering “Guglielmo Marconi” (DEI), Alma Mater Studiorum, Università di Bologna, 40136 Bologna, Italy
Fabrizio Alfonsi: Istituto Nazionale di Fisica Nucleare (INFN) Bologna, 40127 Bologna, Italy
Marco Prandini: Department of Computer Science and Engineering, Alma Mater Studiorum, Università di Bologna, 40126 Bologna, Italy
Alessandro Gabrielli: Istituto Nazionale di Fisica Nucleare (INFN) Bologna, 40127 Bologna, Italy

Future Internet, 2024, vol. 16, issue 9, 1-22

Abstract: One of the most common mitigations against network-borne security threats is the deployment of firewalls, i.e., systems that can observe traffic and apply rules to let it through if it is benign or drop packets that are recognized as malicious. Cheap and open-source (a feature that is greatly appreciated in the security world) software solutions are available but may be too slow for high-rate channels. Hardware appliances are efficient but opaque and they are often very expensive. In this paper, an open-hardware approach is proposed for the design of a firewall, implemented on off-the-shelf components such as an FPGA (the Xilinx KC705 development board), and it is tested using controlled Ethernet traffic created with a packet generator as well as with real internet traffic. The proposed system can filter packets based on a set of rules that can use the whitelist or blacklist approach. It generates a set of statistics, such as the number of received/transmitted packets and the amount of received/transmitted data, which can be used to detect potential anomalies in the network traffic. The firewall has been experimentally validated in the case of a network data throughput of 1 Gb/s, and preliminary simulations have shown that the system can be upgraded with minor modifications to work at 10 Gb/s. Test results have shown that the proposed firewall features a latency of 627 ns and a maximum data throughput of 0.982 Gb/s.

Keywords: network security; firewall; FPGA; Ethernet; packet classification; embedded systems (search for similar items in EconPapers)
JEL-codes: O3 (search for similar items in EconPapers)
Date: 2024
References: View complete reference list from CitEc
Citations: View citations in EconPapers (1)

Downloads: (external link)
https://www.mdpi.com/1999-5903/16/9/303/pdf (application/pdf)
https://www.mdpi.com/1999-5903/16/9/303/ (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:gam:jftint:v:16:y:2024:i:9:p:303-:d:1462450

Access Statistics for this article

Future Internet is currently edited by Ms. Grace You

More articles in Future Internet from MDPI
Bibliographic data for series maintained by MDPI Indexing Manager ().