## 3 The Proposed Firewall on an FPGA
The USB-UART communication is managed by the 'UART controller' module that communicates with the PC using the 'UART RX' and 'UART TX' modules (baud rate 115,200, 8-bit data, 1 stop bit, no parity bit). The communication of the 'UART controller' module with the circuits implemented in the FPGA programmable logic is realized with a custom interface with an 8-bit data bus: UART_RX_DATA[7:0] that is valid when the signal UART_RX_DV is set for the received data, and UART_TX_DATA[7:0] that is valid when the signal UART_TX_DV is set for the transmitted data. The signal UART_TX_DONE informs the 'UART controller' module when a data byte has been transmitted. Each firewall port features the following:  
1. An 'AXI 1G/2.5G Ethernet Subsystem' IP module by Xilinx [45]. This module manages the media access control (MAC) layer and the physical (PHY) layer of the Ethernet protocol. It is interfaced on the KC705 board with an SFP/SFP+ connector that transmits/receives the Ethernet data using fiber optic cables (differential signals RX_P, RX_N for the received data and differential signals TX_P, TX_N for the transmitted data). On the FPGA side, the packet data are transferred with an 8-bit data bus using the AXI communication protocol. In the case of the receiving port, for example, RX_DATA[7:0] stores the 8-bit data that are valid when the signal RX_DV is set, while RX_LAST is set during the transfer of the last byte of the packet. RX_ERR is a signal to indicate the presence of errors during the reception of the packet. 2. An 'RX control' module, designed using the Verilog HDL. This module is responsible for receiving the packet data from the 'AXI 1G/2.5G Ethernet Subsystem' module, storing the data in memory, and providing the packet data to the 'Packet analysis' module. 3. A 'Data memory' module that instantiates a dual-port SRAM using the block memory inside the FPGA, i.e., with the Xilinx IP module 'Block memory generator' [46]. This memory has a size of 16 kB and features 16,384 words of 1 byte each. It is used to store the received packet data before a decision is made on the compliance of the packet with the firewall rules. Each port of the memory features an address bus (14-bit), a data bus (8-bit), and a write enable (WE) signal that is set during a write operation. 4. A 'Control memory' module that instantiates a dual-port SRAM using the block memory inside the FPGA, i.e., with the Xilinx IP module 'Block memory generator' [46]. This memory has a size of 5 kB and features 1024 words of 40 bits each. Each port of the memory features an address bus (10-bit), a data bus (40-bit), and a write enable (WE) signal that is set during a write operation. Each word of the Control memory is composed of three fields and is associated with a specific packet whose data are stored in the Data memory. The most significant bits store the STATUS BYTE (8-bit), which defines the status of the packet: h0 for quarantined packets before a decision on the compliance with the firewall rules is made; h37 for packets that comply with  
Figure 2: Schematic of the designed hardware firewall on an FPGA. the firewall rules and can be transmitted; h2C for packets that do not comply with the firewall rules and must be blocked; h21 for packets with a checksum error that must be blocked. The other two fields are the PACKET START ADDRESS (16-bit), which stores the Data memory address of the first byte of the packet, and the PACKET LENGTH (16-bit), which stores the size of the packet in bytes. 5. A 'Packet analysis' module, designed using the Verilog HDL. This module receives the packet data (FW_DATA[7:0]) from the 'RX control' module: the data are valid when the signal FW_EN is set, while BYTE_NUMBER[15:0] indicates the position of the current data inside the packet. The signal FW_OUT is set one clock cycle after the reception of the last data byte.