Firewall Service Virtual Machine Packet Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional hardware firewalls do not leverage the flexibility and control provided by software defined networking (SDN) and network virtualization, lacking effective solutions for incorporating firewall services in virtualized environments.
Innovation Solution
A virtualization architecture that utilizes a firewall service virtual machine (SVM) to check packets for guest virtual machines, with a novel SVM interface (SVMI) allowing the firewall SVM to be accessed for packet inspection, and a firewall engine that communicates with the SVM to enforce firewall rules, including caching actions for efficient packet processing and managing rule checks across virtual network interfaces.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional hardware firewalls are used in virtualized environments, then firewall security function is provided, but flexibility and control from SDN/network virtualization cannot be leveraged
Solution Approach 1:
The patent introduces a firewall engine as an intermediary component that runs on the host system and communicates with both the software forwarding element and the firewall SVM. This intermediary translates between the virtualized network environment and the firewall service, enabling SDN flexibility while maintaining firewall functionality without requiring direct integration complexity between hardware firewalls and virtualized components
Solution Approach 2:
The patent replaces traditional hardware-based firewall appliances with a software-based firewall SVM that runs in the virtualized environment. This substitution eliminates the need for physical hardware integration and allows the firewall to be managed through software-defined networking controls, thereby improving flexibility and adaptability while reducing hardware dependency
2Productivity
If the firewall SVM is directly connected to the software forwarding element, then packet inspection is enabled, but processing overhead increases due to redundant rule checks
Solution Approach 1:
The firewall engine performs preliminary actions by maintaining a connection state data store that caches firewall rule check results. Before forwarding packets to the firewall SVM for inspection, the engine checks this cache to determine if the packet belongs to an already-evaluated flow, thereby avoiding redundant rule checks and reducing processing time
Solution Approach 2:
The patent implements a hybrid processing approach where different packet types are handled differently: established connections are processed quickly using cached data from the connection state data store, while new connections are subjected to full firewall rule evaluation. This parameter-based differentiation optimizes processing efficiency by applying appropriate evaluation depth based on connection state
3Reliability
If comprehensive firewall rule checking is performed for every packet, then security is ensured, but processing speed decreases
Solution Approach 1:
The connection state data store performs preliminary evaluation by caching results of firewall rule checks for established flows. When subsequent packets arrive for the same flow, the cached results are used to quickly determine allow/deny decisions without repeating the full rule evaluation process, thus maintaining security while improving speed
Solution Approach 2:
The system implements periodic re-evaluation of cached connection states rather than checking every single packet. The connection state data store maintains flow information for a period, and firewall rules are re-checked at appropriate intervals or when state changes occur, balancing security requirements with processing efficiency
Data Source
AI summary
For a host that executes one or more guest virtual machines (GVMs), some embodiments provide a novel virtualization architecture for utilizing a firewall service virtual machine (SVM) on the host to check the packets sent by and/or received for the GVMs. In some embodiments, the GVMs connect to a software forwarding element (e.g., a software switch) that executes on the host to connect to each other and to other devices operating outside of the host. Instead of connecting the firewall SVM to the host's software forwarding element that connects its GVMs, the virtualization architecture of some embodiments provides an SVM interface (SVMI) through which the firewall SVM can be accessed to check the packets sent by and/or received for the GVMs.