The Internet is a technological advance that provides access to information, and the ability to publish information, in revolutionary ways. There is also a major danger that provides the ability to corrupt and destroy information as well. When a computer is connected to the Internet, three things are put at risk: the data storage, the computing resources and the users reputation. In order to balance the advantages and risks, the contact between a computer and the Internet or the contact between different networks should be controlled carefully. <p>A firewall is a form of protection that allows a network to connect to the Internet or to another network while maintaining a degree of security. The firewall is an effective type of network security, and in most situations, it is the most effective tool for doing that. <p>With the availability of larger bandwidth, it is becoming more and more difficult for traditional software firewalls to function over a high-speed connection. In addition, the advances in network hardware technology, such as routers, and new applications of firewalls have caused the software firewall to be an impediment to high throughput. This network bottleneck leads to the requirement for new solutions to balance performance and security. Replacing software with hardware could lead to improved performance, enabling the firewalls to handle significantly larger amounts of data. <p> The goal of this project is to investigate if and how existing desktop computer firewall technology could be improved by replacing software functionality with hardware (i.e., silicon). A hardware-based Silicon Firewall system has been designed by choosing the appropriate architecture and implemented using Altera FPGA (Field Programmable Gate Array) on a SOPC (System On a Programmable Chip) Board. The performance of the Silicon Firewall is tested and compared with the software firewall.

The Internet is a technological advance that provides access to information, and the ability to publish information, in revolutionary ways. There is also a major danger that provides the ability to corrupt and destroy information as well. When a computer is connected to the Internet, three things are put at risk: the data storage, the computing resources and the users reputation. In order to balance the advantages and risks, the contact between a computer and the Internet or the contact between different networks should be controlled carefully. <p>A firewall is a form of protection that allows a network to connect to the Internet or to another network while maintaining a degree of security. The firewall is an effective type of network security, and in most situations, it is the most effective tool for doing that. <p>With the availability of larger bandwidth, it is becoming more and more difficult for traditional software firewalls to function over a high-speed connection. In addition, the advances in network hardware technology, such as routers, and new applications of firewalls have caused the software firewall to be an impediment to high throughput. This network bottleneck leads to the requirement for new solutions to balance performance and security. Replacing software with hardware could lead to improved performance, enabling the firewalls to handle significantly larger amounts of data. <p> The goal of this project is to investigate if and how existing desktop computer firewall technology could be improved by replacing software functionality with hardware (i.e., silicon). A hardware-based Silicon Firewall system has been designed by choosing the appropriate architecture and implemented using Altera FPGA (Field Programmable Gate Array) on a SOPC (System On a Programmable Chip) Board. The performance of the Silicon Firewall is tested and compared with the software firewall.

none

Thesis (Ph. D.)--University of Hong Kong, 2010. / Includes bibliographical references (leaves 147-156). Also available in print.

No description available.

No description available.

Recent research results on buffer sizing challenged the widely used assumption that routers should buffer millions of packets. These new results suggest that when smooth Transmission Control Protocol (TCP) traffic goes through a single tiny buffer of size O(logW), then close-to-peak throughput can be achieved where W is the maximum window size of TCP flows. But the current routers have the buffer size much larger than that. It is shown that, we can reduce the buffer size by a factor of √N when the traffic is somehow smooth, where N is the number of flows. So, the main goal of this thesis is to show some directions on how the buffer size can be reduced in Internet routers. In this research, we adopted some measures like different packet sizes, different network scenarios, different buffer sizes, various link delays to see the performance of small buffers with the presence of both TCP and UDP traffic. / Graduate

Thesis (M. Phil.)--Hong Kong University of Science and Technology, 2002. / Includes bibliographical references (leaves 47-48). Also available in electronic version. Access restricted to campus users.

The problem of data transmission in a packet radio system with one central base station and a number of mobile/stationary terminals is addressed. More specifically, the effects of possible collisions between packets on the inbound channel are investigated. Schemes which can be used to improve the performance are studied. The use of capture to improve the performance of slotted ALOHA systems is discussed. For a power group division scheme proposed by Metzner in which a capture effect is artificially induced, it is shown that in the two power group case, the higher power packet needs only be able to tolerate interference from up to three lower power packets in order to realize most of the achievable improvement of the infinite capture model. The evaluation of the performance for more than two power groups is also considered. A packet radio system in which a capture effect exists due to the fact that mobiles will generally be at different distances from the base station is also investigated. A number of different capture and spatial distribution models are discussed. Methods for evaluating the probability [formula omitted] of successful reception when there are [formula omitted] contending transmitters are examined. It is shown that a generalized capture model can be used to estimate [formula omitted] for an example system which uses non-coherent frequency shift keying modulation. This model can be applied to other systems as well. In most practical systems, the mobiles cannot get arbitrarily close to the base station. The effects of this constraint on [formula omitted] is examined. The dependence of the capture probability for a test mobile on its distance from the base station is also analyzed. The use of multiple directional antennas and receivers in a slotted ALOHA system in which the signals from the different transmitters are received with more or less the same powers is analyzed. It is shown that the performance of the system can be substantially improved by using directional antennas and multiple receivers. Results indicate that fewer than five antennas per receiver are required in order to achieve most of the achievable performance. A finite population Markov model is used to evaluate the performance of a multi-antenna and receiver slotted ALOHA system in a mobile radio environment in which the signal power levels from different mobiles are no longer equal. The effects of three different antenna patterns, background noise and Rayleigh fading are studied. Here again, numerical results indicate that substantial gains are possible with the use of several antennas and receivers. It is also found that the dynamic behaviour of the system is improved. The selection of the antennas to be connected to the receivers becomes an issue if the number of receivers at the base station is less than the number of antennas . Four antenna selection schemes are compared for three different channel models, assuming an ideal antenna pattern. It is found that the scheme which selects the antennas with the largest received signal powers is nearly optimum. The effects of using a more practical non-ideal antenna pattern are also discussed. / Applied Science, Faculty of / Electrical and Computer Engineering, Department of / Graduate

The development of pulse code modulation systems and electronic exchanges, together with the increase in volume of data traffic, have made it desirable to establish a means for handling both voice and data trarfic in the telephone network. A technique is required whereby integrated voice and data switching may be accomplished in an electronic exchange. It is proposed that a data adaptor unit be incorporated in electronic exchanges for the ourpose of concentrating data traffic onto PCM highways. A conceptual design for the architecture of such a unit is presented and its performance evaluated. The protocols for connecting data adaptors into a network, and the use of flow control procedures for regulating data traffic within the network, are described. The hardware implementation of the unit is not considered. The proposed data adaptor operates on the packet switching principle. It is comprised of three types of modules each dedicated to carrying out a particular communication function. The modules are the interface processor that interacts with data transmitting devices, the network processor for sending data over PCM channels between adaptors, and the supervisory processor for regulating activities within the adaptor unit.