Dual Datapath Packet Processing via Kernel-User Space Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network devices in computer networks face limitations in packet processing due to prioritization of kernel space over user space, leading to restricted software programs and increased latency, which hinders the utilization of user space capabilities for enhanced packet processing operations.
Innovation Solution
Implementing a dual datapath approach by leveraging a hook point in kernel space to introduce a kernel program that places network traffic onto the user datapath, allowing for packet processing operations to be performed in both kernel and user spaces, thereby accessing additional software and hardware capabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If kernel space is prioritized for packet processing, then data security and integrity are maintained, but software program diversity is restricted and latency increases
Solution Approach 1:
The patent divides packet processing into two separate datapaths: a kernel space datapath for security-critical operations and a user space datapath for diverse software programs. This segmentation allows each space to operate independently with its own priorities and constraints, resolving the contradiction between security and software diversity.
Solution Approach 2:
The patent introduces a user module as an intermediary that bridges kernel space and user space. The user module receives packets from the kernel space datapath, processes them through user space programs, and returns processed packets to the kernel space datapath for final transmission. This intermediary enables both security maintenance in kernel space and software diversity in user space.
2Reliability
If kernel space is prioritized for packet processing, then data security is protected, but packet processing latency increases
Solution Approach 1:
By segmenting packet processing into kernel space and user space datapaths, the patent allows packets to be processed in user space where fewer security restrictions apply, reducing processing time while maintaining security through the kernel space gateway.
Solution Approach 2:
The user module acts as an efficient intermediary that minimizes the overhead of transferring packets between kernel and user spaces. By processing packets in user space and only returning them to kernel space for final transmission, the system reduces latency while maintaining security boundaries.
3Device complexity
If only kernel space datapath is used, then system simplicity is maintained, but access to user space capabilities is lost
Solution Approach 1:
The user module serves as a simple intermediary layer that enables user space capability access without fundamentally complicating the kernel space datapath. The kernel space remains relatively simple for security-critical operations, while the user module provides a straightforward interface to user space programs.
Solution Approach 2:
The dual datapath system provides universality by allowing packets to be processed through either kernel space or user space datapaths depending on the requirements. The same packet processing infrastructure can serve both security-critical and diverse software needs, making the system multi-functional without requiring completely separate systems.
Data Source
AI summary
In general, techniques are described for enhancing packet processing in a computing device of a network. The computing device is configured to in response to receiving ingress data of a flow from the first network device via the first network interface, execute, based on a hook point in kernel space of the device, a kernel program to transfer, via a first socket of a user module, the ingress data for packet processing; configure an code point for the second network interface, wherein the user module is configured to couple a second socket with the code point; and in response to determining the second network device as a next hop for the flow, transfer, based on the code point, egress data of the flow via the second socket to the second network interface, wherein the second network interface is operative to output the egress data to the second network device.