Host-Level Malicious Packet Filtering in Virtualization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtualization systems face inefficiencies in handling malicious packets, leading to performance degradation and inability to decrypt encrypted packets, as conventional methods require constant processing and resource allocation, even for discarded packets.
Innovation Solution
Implementing a logic on virtualized execution environments to determine malicious packets and using a hypervisor or host OS to create filtering rules, which are stored and applied to subsequent packets, reducing resource usage and avoiding unnecessary wake-ups of virtualized execution environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional packet filtering methods are used in virtualization systems, then malicious packets can be detected and filtered, but host performance degrades due to constant processing and resource allocation even for discarded packets
Solution Approach 1:
The patent extracts the packet filtering function from the virtualized execution environments and consolidates it at the host level. The host OS or hypervisor creates and maintains filtering rules independently, while virtualized execution environments only process packets that match existing rules or need to send packets. This separation eliminates the performance overhead of constant filtering processing in virtualized environments while maintaining detection capability.
2Reliability
If virtualized execution environments continuously process packets to detect malicious content, then security is maintained, but resource usage increases and unnecessary wake-ups occur
Solution Approach 1:
The patent implements preliminary action by pre-creating filtering rules at the host level before packets arrive. The host OS or hypervisor proactively establishes filtering criteria based on known malicious packet characteristics, allowing packets to be filtered before reaching virtualized execution environments. This eliminates the need for continuous processing and wake-ups, as filtering decisions are made in advance using pre-established rules.
3Reliability
If filtering rules are applied at the virtualized execution environment level, then packet filtering is effective, but device complexity increases and management becomes difficult
Solution Approach 1:
The patent merges the filtering rule management functionality into the host OS or hypervisor, consolidating control at a single level. Instead of each virtualized execution environment maintaining its own filtering rules, the host creates and manages a centralized set of filtering rules that apply system-wide. This reduces device complexity by eliminating redundant filtering mechanisms while maintaining effective packet filtering through unified host-level management.
Data Source
AI summary
A method includes receiving, by a processing device, a first packet addressed to a first virtualized execution environment, determining, by the processing device, whether the first packet has similar characteristics with a second packet by applying a first filtering rule to the first packet, wherein the first filtering rule is generated in view of characteristics of the second packet, and wherein the second packet is stored in a first filtering queue of a second virtualized execution environment, and responsive to determining that the first packet is similar to the second packet, discarding, by the processing device, the first packet.