Data Packet Redirection via XDP Metadata for Flexible Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity network products in cloud deployments lack the ability to customize security policies and services without modifying the operating system, leading to less effective security solutions.
Innovation Solution
A data plane framework using XDP programs and eBPF to redirect data packets through virtual ethernet pairs, allowing unmodified operating systems to route traffic to various network services in userspace and kernel, with dynamic chaining and metadata sharing among services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the operating system is customized to share information with data inspection engines, then security policy customization capability is improved, but system complexity and deployment difficulty increase
Solution Approach 1:
The system separates security policy customization from the operating system kernel by using user-space applications that interact with the network stack through standardized interfaces. This allows security policies to be customized without modifying the OS, resolving the contradiction between adaptability and complexity.
Solution Approach 2:
An intermediary layer (user-space application framework) is introduced between the network stack and security inspection engines. This mediator enables information sharing and policy enforcement without requiring OS customization, thus improving adaptability while maintaining system simplicity.
2Adaptability or versatility
If traffic is redirected to customized network services, then security service flexibility is improved, but packet processing performance may deteriorate
Solution Approach 1:
The system pre-establishes virtual ethernet pairs and routing paths before traffic needs to be redirected. This preliminary setup allows fast packet forwarding without real-time OS intervention, maintaining high performance while enabling flexible service redirection.
Solution Approach 2:
The network stack creates virtual copies of physical network interfaces (virtual ethernet pairs) to redirect traffic to user-space services. This copying mechanism enables flexible traffic routing without disrupting the original high-performance network path, thus maintaining packet processing speed.
3Adaptability or versatility
If packet redirection is implemented in cloud environments, then service adaptability is improved, but compatibility with unmodified OS kernels is reduced
Solution Approach 1:
The packet redirection functionality is extracted from the OS kernel and implemented as user-space applications. This extraction allows the system to provide advanced services on unmodified OS kernels, improving service adaptability while maintaining full OS compatibility.
Solution Approach 2:
The user-space application framework provides universal access to network packet processing capabilities across different OS types. This multi-functional approach enables the same redirection mechanism to work on various unmodified kernels, enhancing both adaptability and compatibility.
Data Source
AI summary
A method for redirecting data packets includes receiving, by a computer system, at least one data packet, attaching, by an express data path program of the one or more processors of the computer system, a metadata structure to each of the at least one data packet, populating, by the express data path program, the metadata structure with metadata information, redirecting, by the computer system based on the metadata information, the at least one data packet from a network stack path to at least one data security program, executing, by the computer system, the at least one data security program on the at least one data packet including interpreting at least a portion of the metadata information, and after the at least one data security program has been executed on the at least one data packet, redirecting the at least one data packet back to the network stack path.