Cooperated Network Packet Filtering via Segmented Agents
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing, achieving fine-grained control over network packet filtering leads to performance degradation, as existing solutions either provide rich filtering capabilities with compromised performance or weak filtering with high performance, posing a security concern for cloud architecture.
Innovation Solution
A bifurcated packet filtering approach is implemented, where simple filtering agents enforce basic rules on network packets with minimal latency, and complex filtering is handled by a sideband agent and virtual Ethernet bridge, separating critical performance paths to maintain efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If complex packet filtering rules are implemented to achieve fine-grained control, then filtering capability is improved, but performance deteriorates
Solution Approach 1:
The patent segments the packet filtering system into two distinct components: a simple filtering agent implemented in hardware on the NIC that handles basic filtering rules with high speed, and a complex filtering agent implemented in software on the host that handles sophisticated filtering requirements. This segmentation allows the system to achieve fine-grained control through the complex filtering agent while maintaining high performance through the hardware-based simple filtering agent for routine packets.
2Reliability
If strong packet filtering capability is provided, then security is improved, but performance is compromised
Solution Approach 1:
The patent divides filtering responsibilities between hardware and software components. The hardware simple filtering agent provides fast path filtering for common security rules, while the software complex filtering agent provides deep inspection and advanced security policies. This segmentation ensures strong security through comprehensive filtering capabilities while maintaining performance by handling most packets in the fast hardware path.
Solution Approach 2:
The patent introduces a cooperative mechanism where the simple filtering agent acts as an intermediary that can offload packets requiring complex filtering to the complex filtering agent. This intermediary approach allows the system to maintain high performance for simple cases while providing strong security through complex filtering when needed, without forcing all packets through the slower software path.
Data Source
AI summary
An apparatus, system, method, and machine-readable medium are disclosed. In one embodiment the apparatus is a network interface controller that includes one virtual function owned by a virtual machine present in the computer system. The controller includes a simple filtering agent that is associated with the first virtual function. The agent enforces simple filter rules for received network packets. The simple filter rules are capable of blocking the network packets from reaching the virtual machine. The apparatus also includes another virtual function that is owned by a virtual machine monitor present in the computer system. The controller also includes a side bounce filtering agent to forward the first network packet to the second virtual function if the first packet is blocked by the at least one of the one or more simple filter rules.