Black List/White List Processing

Deny or Allow Real Time Internet Connections at 100GE based on defined attributes

Black List processing is an access control mechanism that denies access to internet connections or flows based on attributes such as email addresses, IP addresses, domain names, etc.. A Black List can be applied at various points in a security architecture (Firewalls, Intrusion Prevention Systems (IPS), Web Proxys, Authentication Gateways. As opposed to Black List processing, White List (allow list) processing only allows items on the list to pass through.

Real time implementations of Black/White List processing such as Authentication Gateways and Firewalls are required to handle demanding, high capacity (nx100G) Network Connections while executing complex security algorithms. These devices leverage the power of FPGA based Host Offload SmartNICs to process Complex Data Plane functions in real time without Host Intervention. Accolade’s implementation of the Black List feature on Xilinx Alveo SmartNICs supports real time processing of 200 million Black List addresses at 100Gbps. The Black List offload processing as implemented on the Xilinx Alveo U280 is illustrated in Figure 1 described below.

black list flow logic for alveo

Figure 1: 100G Black List Processing Flow

A single 100G packet processing pipeline with IP traffic is illustrated in Figure 1. Internet Traffic entering the Ingress port encounters the Packet Parser Block which extracts the IP Packet payload and forwards the IP header to the Filter Block. The Static Filter Block then performs stateless filtering of IP addresses of interest. During the next stage the Flow Processor identifies and tags any new flow with a flow identity (ID) and manages Flow Table entry setup, teardown and metadata export.

All packets tagged with a Flow ID are then sent to the Black List Processor Block for IP source address checking. The Black List Processor accesses the Black List Table in DRAM which is maintained by the Host CPU, allowing the Host to add/remove items from the Black List Table while traffic is flowing. Only the first packet of a flow is processed for Black List match. Packets that have been classified and previously verified as a no match, are forwarded to the Egress port. Results of Black List processing are stored in a Result Table. Please note that this Black List processing offload flow sequence may easily be configured for White List processing as well.

wdt_ID Speed 1G 10G 10G 10G 10G/40G 10G/40G 100G 100G 100G
1 Model 4Ku 20ku 40ku 40kq 80ku ATLAS-1100 Service Node ANIC-200KFlex ANIC-100Kq ANIC-200Kq
2 Port/Type 4X1G SFP 2X10G SFP+ 4X10G SFP+ 1X40G QSFP+ 4X10G SFP+ 2X40G QSFP+ 8X10G SFP+ 4x10G SFP+ 1x40G QSFP+ 2x100G QSFP28 2x40G QSFP28 1X100G QSFP28 2X100G QSFP28
3 PCIe Interface Gen3 x8 Gen3 x8 Gen3 x8 Gen3 x8 Gen3 x8 Gen3 x8 Gen3 x16 Gen3 x16 Gen3 x16
4 Dimensions(H x L inches) 4.25 x 6.5   4.25 x 6.25 4.25 x 6.25 4.25 x 6.25 4.25 x 6.25 1.75 x12.28x14 4.25 x 6.5 4.25 x 10.5 4.25 x 10.5
5 Memory 32MB 4G 4G 4G 4G 16/32G 8G 12G 12G
6 Timestamp 5.7 nS 5.7 nS 5.7 nS 5.7 nS 5.7 nS 5.7 nS 4 nS 4 nS 4 nS
7 100% Packet
Capture
8 Gigamon, AristaTimestamp
9 Packet Merging
10 Packet Parsing


About Accolade

Accolade is the technology leader in FPGA-based Host CPU Offload and 100% Packet Capture PCIe NIC’s and Scalable 1U Platforms. Accolade’s line of 1-100GE products enable 100% packet capture, flow classification, flow shunting, deduplication, packet filtering and more. Our customers are global leaders in network monitoring & cybersecurity applications as well as in the network test and measurement, telecom and video stream monitoring markets.

FPGA Acceleration Features

100% Packet Capture | Flow Classification | Flow Shunting | Precise Time Stamping | Packet Merging | Packet Slicing | Packet Parsing | Packet Filtering | Deduplication | Host Packet Buffer | Packet Steering | Direct Memory Access (DMA) | Statistics (RMON1)

Free Product Evaluation

Resolve all your host CPU offload bottlenecks. Share Your Technical Requirements with our FPGA and software experts to tailor the optimal solution. Accolade offers a 60 day free product evaluation for qualified customers to fully test and evaluate our products.