Guest Thin Agent Host Network Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud environments, misconfiguration of network settings can expose network data between tenants' virtual machines, and existing encryption methods like IPSec are cumbersome and inefficient, leading to increased CPU usage and fragmentation issues due to the need for host-based encryption and IPSec stack implementation.
Innovation Solution
Implementing a thin agent in virtual machines to select and encrypt traffic, using a dummy security association to offload IPSec processing to the network interface card, allowing the host to manage encryption keys and avoid IPSec stack implementation, while enabling granular control over encryption based on user or process generating the traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If host-based encryption with IPSec stack is implemented, then network data security is improved, but device complexity and CPU usage increase
Solution Approach 1:
The patent extracts the IPSec processing functionality from the host system and relocates it to a dedicated network interface card. The host only retains key management responsibilities, while the NIC handles encryption/decryption operations, eliminating the need for complex IPSec stack implementation on the host.
Solution Approach 2:
The patent introduces a thin agent as an intermediary component that bridges the host and virtual machines. This agent enables granular traffic selection and encryption control without requiring full IPSec stack implementation, simplifying the overall system architecture while maintaining security.
2Reliability
If host-based encryption is implemented, then network data security is improved, but CPU usage increases
Solution Approach 1:
The patent extracts the computationally intensive encryption/decryption operations from the host CPU and transfers them to the network interface card. This offloading significantly reduces host CPU usage while maintaining security, as the NIC performs the cryptographic operations independently.
Solution Approach 2:
The patent replaces the software-based encryption mechanism (requiring host CPU processing) with a hardware-based encryption mechanism implemented in the network interface card. This substitution eliminates the need for continuous CPU involvement in encryption operations.
3Reliability
If IPSec encryption is implemented, then network data security is improved, but packet fragmentation occurs
Solution Approach 1:
The patent performs encryption at the network interface card level, after packet assembly but before transmission. This timing allows the encryption process to work with complete packets rather than fragmented segments, preventing IPSec-related fragmentation issues while maintaining security.
Data Source
AI summary
A method to selectively encrypting packets includes filtering calls, at a virtual machine on a host, to connect sockets to server applications. When a call by a client application to connect a socket to a server application is detected, the method includes determining if the socket between the client and the server applications is to be encrypted based on identities of the client application, a user logged in on the virtual machine, or the client application and the user logged in on the virtual machine. The method includes filtering outbound packets in a protocol stack of the virtual machine. When the socket is to be encrypted and an outbound packet for the socket is detected, the method includes tagging the outbound packet for encryption by a hypervisor on the host and sending the outbound packet to a virtual network interface card (vNIC) emulated by the hypervisor.