  In data communication via internet, security is becoming one of the most
influential aspects. One way to support it is by classifying and filtering
ethernet packets within network devices. Packet classification is a fundamental
task for network devices such as routers, firewalls, and intrusion detection
systems. In this paper we present architecture of fast and reconfigurable
Packet Classification Engine (PCE). This engine is used in FPGA-based firewall.
Our PCE inspects multi-dimensional field of packet header sequentially based on
tree-based algorithm. This algorithm simplifies overall system to a lower scale
and leads to a more secure system. The PCE works with an adaptation of single
cycle processor architecture in the system. Ethernet packet is examined with
PCE based on Source IP Address, Destination IP Address, Source Port,
Destination Port, and Protocol fields of the packet header. These are basic
fields to know whether it is a dangerous or normal packet before inspecting the
content. Using implementation of tree-based algorithm in the architecture,
firewall rules are rebuilt into 24-bit sub-rules which are read as processor
instruction in the inspection process. The inspection process is comparing one
sub-rule with input field of header every clock cycle. The proposed PCE shows
91 MHz clock frequency in Cyclone II EP2C70F896C6 with 13 clocks throughput
average from input to output generation. The use of tree-based algorithm
simplifies the multidimensional packet inspection and gives us reconfigurable
as well as scalable system. The architecture is fast, reliable, and adaptable
and also can maximize the advantages of the algorithm very well. Although the
PCE has high frequency and little amount of clock, filtering speed of a
firewall also depends on the other components, such as packet FIFO buffer. Fast
and reliable FIFO buffer is needed to support the PCE. This PCE also is not
completed with rule update mechanism yet. This proposed PCE is tested as a
component of FPGA-based firewall to filter Ethernet packet with FPGA DE2 Board
using NIOS II platform.
