Hardware validated · M.E. thesis
Layer-2 Ethernet security firewall
Moving Ethernet security policy into programmable logic, with a compact rule engine and bounded evaluation latency.
01 / The challenge
Engineering objective
Embedded Ethernet systems need a practical way to evaluate Layer-2 security policy without making the processing system responsible for every packet decision.
02 / My contribution
My role & contribution
I designed the hardware rule path, packet parser and control structure, integrated the subsystem, and developed the validation flow for my M.E. thesis.
03 / The approach
Technical approach
- Extract Ethernet header fields into a streaming parser.
- Evaluate the relevant security policies in programmable logic.
- Combine policy results at a decision stage and control the output flow.
- Keep control and status access separate from the streaming datapath.
04 / The outcome
Results & project status
The thesis reports a 17-rule hardware implementation using 9.1% of device LUTs and validation with more than 550,000 captured Ethernet frames.
Thesis subsystem measurements: 8 ns rule evaluation and 43–67 ns header parsing. ARP detection reached 100% in the evaluated traffic case at 30,000+ packets/s.