Compiling Policy Descriptions into Reconfigurable

We describe a framework for capturing firewall require-ments as high-level descriptions based on the policy spec-ification language Ponder. The framework provides ab-straction from hardware implementation while allowing performance control through constraints. Our hardware compilation strategy for such descriptions involves a rule reduction step to produce a hardware firewall rule repre-sentation. Three main methods have also been developed for resource optimisation: partitioning, elimination, and sharing. A case study involving five sets of filter rules indicates that it is possible to reduce 67-80 % of hard-ware resources over techniques based on regular content-addressable memory, and 24-63 % over methods based on irregular content-addressable memory.