Filtering Module for Containerized VM Network Routing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtualized computer systems face significant network performance degradation due to the use of Network Address Translation (NAT) for message routing between guests, which adds latency and limits transmission speeds, while also posing security risks through elevated supervisor access.
Innovation Solution
Implementing a filtering-based containerized virtual machine networking system that assigns a public IP address to nested VMs and uses a filtering module to validate IP addresses, allowing direct message routing without NAT, thereby avoiding additional latency and security risks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If Network Address Translation (NAT) is used for message routing between guests, then message routing functionality is provided, but network transmission speed decreases and latency increases
Solution Approach 1:
The patent extracts the NAT functionality from the routing path by implementing a filtering module that validates IP addresses directly at the container level. This removes the NAT translation step that was causing speed degradation and latency, while maintaining the necessary routing functionality through direct IP address validation and forwarding.
Solution Approach 2:
The filtering module acts as an intermediary between the virtual machine and the network, validating IP addresses and forwarding legitimate traffic directly without requiring full NAT processing. This intermediary approach maintains security while eliminating the performance penalty of traditional NAT routing.
2Reliability
If NAT is used for message routing, then routing functionality is achieved, but security risks increase due to elevated supervisor access
Solution Approach 1:
The filtering module implements self-service security by validating IP addresses against configured criteria and automatically blocking illegitimate traffic. This eliminates the need for elevated supervisor access to enforce security policies, as the filtering module autonomously makes security decisions at the container level.
Solution Approach 2:
The system performs preliminary IP address validation in the filtering module before traffic reaches the supervisor level. By pre-validating addresses and blocking illegitimate traffic early in the processing chain, the system prevents security threats from reaching higher privilege levels, thereby maintaining security without requiring continuous supervisor intervention.
3Reliability
If filtering module validates IP addresses for each message, then security is enhanced, but processing overhead increases
Solution Approach 1:
The filtering module performs partial validation by checking only the IP address field against configured criteria, rather than performing full packet inspection or complex security analysis. This partial action approach provides sufficient security validation while minimizing processor overhead and energy consumption.
Data Source
AI summary
Filtering based containerized virtual machine networking is disclosed. For example, a host has a processor, a memory, and a network interface (NIC), and a hypervisor executes on the host. A container with a filtering module executes on the host with a virtual machine (VM) with a virtual network interface (VNIC) executing on the container. The VNIC receives a message for transmission over a network. The filtering module determines whether an internet protocol (IP) address in the message matches a validation IP address configured in the filtering module. In response to determining that the IP address in the message is invalid, transmission of the message is canceled and the message is sent to a remediation service. In response to determining that the IP address in the message valid, the container forwards the message to the hypervisor, which transmits the message to the network using the IP address via the NIC.