Cooperated Network Packet Filtering via Bifurcated Agents
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In network virtualization, especially in cloud computing, fine-grained packet filtering is desired but often compromises network performance, as complex filtering rules lead to increased latency and resource constraints, making it challenging to achieve both robust security and high performance.
Innovation Solution
A bifurcated packet filtering approach is implemented, where simple filtering agents enforce basic rules with minimal latency and forward complex packets to a sideband filtering agent and virtual Ethernet bridge for deeper inspection, maintaining high performance by segregating complex filtering operations from critical paths.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If complex packet filtering rules are implemented to achieve fine-grained control and robust security, then security capability is improved, but network performance deteriorates due to increased latency and resource consumption
Solution Approach 1:
The patent segments packet filtering into two distinct paths: a fast path using simple filtering rules for critical performance packets, and a slow path using complex filtering rules for non-critical packets. This segmentation allows the system to apply different filtering strategies based on packet characteristics, thereby maintaining high performance for time-sensitive traffic while still providing robust security through complex filtering when necessary.
Solution Approach 2:
The patent applies local quality by differentiating filtering intensity based on packet type and destination. Critical performance packets (such as those requiring low latency) receive simple filtering with minimal processing, while non-critical packets undergo comprehensive complex filtering. This localized application of filtering quality ensures that security is strengthened where needed without unnecessarily impacting overall network performance.
2Productivity
If simple filtering rules are used to maintain high network performance, then network performance is improved, but security capability deteriorates due to insufficient filtering granularity
Solution Approach 1:
The patent implements dynamic filtering by adapting the filtering path based on packet characteristics. The system dynamically routes packets to either the fast path or slow path filtering mechanism depending on whether they require simple or complex filtering. This dynamic approach ensures that each packet receives the appropriate level of security scrutiny, maintaining both performance and security adaptively.
Solution Approach 2:
The patent introduces an intermediary classification mechanism that determines whether a packet should undergo simple or complex filtering. This intermediary layer acts as a mediator between the two filtering paths, analyzing packet characteristics and routing them to the appropriate filtering level, thereby ensuring that security requirements are met without unnecessarily burdening all packets with complex filtering overhead.
3Adaptability or versatility
If fine-grained packet filtering control is implemented in virtual network facilities, then control capability is improved, but performance deteriorates due to the overhead of complex filtering operations
Solution Approach 1:
The patent segments the filtering control into hierarchical levels: a first level using simple rules for rapid decision-making on most packets, and a second level using complex rules for detailed inspection of specific packets. This segmentation enables fine-grained control capability while maintaining performance by ensuring that complex filtering operations are applied only when necessary, rather than to every packet.
Solution Approach 2:
The patent applies partial action by implementing complex filtering only for the subset of packets that require it, rather than applying full filtering strength to all packets. This partial application of complex filtering rules provides sufficient control capability for security-critical packets while avoiding the performance penalty of applying the same level of scrutiny to all traffic.
Data Source
AI summary
An apparatus, system, method, and machine-readable medium are disclosed. In one embodiment the apparatus is a network interface controller that includes one virtual function owned by a virtual machine present in the computer system. The controller includes a simple filtering agent that is associated with the first virtual function. The agent enforces simple filter rules for received network packets. The simple filter rules are capable of blocking the network packets from reaching the virtual machine. The apparatus also includes another virtual function that is owned by a virtual machine monitor present in the computer system. The controller also includes a side bounce filtering agent to forward the first network packet to the second virtual function if the first packet is blocked by the at least one of the one or more simple filter rules.