Guest Partition Control Plane Virtualization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Designing computing devices that balance functionality with security, preventing malicious access and ensuring performance, is challenging as existing solutions often compromise between virtualization and direct access to device components.
Innovation Solution
The host in a computing device virtualizes the control plane of physical devices while allowing direct access to the data plane for guest partitions, managing access through a control plane interface and data plane interface to ensure security and performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the control plane of physical devices is virtualized for guest partition access, then security is improved by preventing malicious access, but access speed deteriorates due to virtualization overhead
Solution Approach 1:
The physical device is segmented into two distinct planes: control plane and data plane. The control plane is virtualized for security while the data plane provides direct access for performance. This segmentation allows each plane to serve its specific function optimally without compromising the other.
Solution Approach 2:
Different access modes are applied to different parts of the physical device. The control plane uses virtualized access with security management, while the data plane uses direct physical access. This local differentiation optimizes both security and performance in their respective domains.
2Speed
If direct access to physical devices is allowed for guest partitions, then access speed is improved, but security deteriorates due to potential malicious interference
Solution Approach 1:
The physical device interface is divided into control plane (virtualized) and data plane (direct access). This segmentation enables fast data transfer while maintaining security controls for device management functions.
Solution Approach 2:
The control plane acts as an intermediary layer between the guest partition and the physical device. It mediates access requests, providing security management while allowing direct data plane access when appropriate.
3Reliability
If full virtualization is applied to physical devices, then security is improved, but device complexity increases due to management overhead
Solution Approach 1:
By segmenting the device into control and data planes, the management complexity is reduced. Only the control plane requires virtualization management, while the data plane can be directly accessed, simplifying the overall management architecture.
Solution Approach 2:
Instead of fully virtualizing the entire physical device, only the necessary control plane functions are virtualized. This partial virtualization approach provides adequate security while reducing management complexity compared to complete virtualization.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computing device includes a host, one or more guest partitions, and one or more physical devices. A physical device can be virtualized, at least in part, by the host and made available to the guest partitions. A physical device includes both a control plane and a data plane. The host provides direct access to at least part of the data plane of a physical device to a guest partition. However, the host virtualizes the control plane of the physical device, exposing a control plane for the physical device to the guest partition that is not the actual control plane of the physical device. Requests to access (e.g., read, write, modify, etc.) the control plane of the physical device are received by the host from the guest partition, and converted as appropriate to the control plane for the physical device.