Hypervisor Flow Steering for Shared-IP Virtual NIC Networking

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing hypervisor networking implementations prevent HIVEs from directly participating in the physical network, requiring NAT and causing issues with multicast, broadcast traffic, loopback communication, and application protocols that query local IP addresses, and lack practical solutions for accommodating guest applications without a NAT ALG.

Innovation Solution

Assigning the same IP address to both the physical and virtual NICs, with a flow steering engine that steers packets based on tuples to ensure direct addressing and communication between HIVEs and the physical network, eliminating the need for NAT and enabling multicast and broadcast traffic.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If NAT and virtualization are used to enable HIVE communication, then HIVE can communicate with external networks, but application protocols that query local IP addresses do not work and multicast/broadcast traffic is broken

Engineering Contradiction:

ImproveHIVE network communication capabilityVSAvoidApplication protocol functionality

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent introduces a flow steering engine as an intermediary component that sits between the HIVE network stack and the physical network. This engine transparently redirects packets without requiring NAT, allowing application protocols to query and use the actual physical IP address while maintaining HIVE isolation. The flow steering engine examines packet tuples and steers them appropriately without breaking application layer protocols.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent changes the network address parameters by assigning the physical IP address directly to the HIVE's virtual NIC instead of using NAT address translation. This parameter change allows the HIVE to participate directly in the physical network with a real IP address, enabling application protocols to function correctly while maintaining communication capability through the flow steering engine's packet redirection.

Inventive Principle:

Principle #35Parameter changes

2Adaptability or versatility

If each HIVE has its own virtualized IP address and network stack, then HIVE independence and mobility are achieved, but the HIVE cannot be a first-order participant in the physical network and requires hypervisor intermediation

Engineering Contradiction:

ImproveHIVE independence and mobilityVSAvoidHypervisor intermediation layer

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The flow steering engine serves as a lightweight intermediary that maintains HIVE independence while reducing hypervisor complexity. Instead of full NAT and virtualization layers, the flow steering engine provides minimal packet redirection based on flow tuples, allowing HIVEs to be first-order participants in the physical network with direct IP addressing while preserving isolation and mobility.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Adaptability or versatility

If NAT address translation is used for HIVE networking, then HIVE can communicate with physical network, but loopback communication between guest applications and multicast/broadcast traffic do not work

Engineering Contradiction:

ImproveHIVE external network communicationVSAvoidLoopback and multicast functionality

Core Design Contradiction:

Adaptability or versatilityVSEase of operation

Solution Approach 1:

The patent changes the network addressing parameter from NAT-translated addresses to direct physical IP addresses assigned to HIVE virtual NICs. This allows loopback communication to work seamlessly since packets can use the actual physical IP address, and enables multicast/broadcast traffic to function properly by allowing the HIVE to participate directly in physical network protocols without address translation interference.

Inventive Principle:

Principle #35Parameter changes

4Adaptability or versatility

If the HIVE uses a private MAC address in a virtualized network, then HIVE isolation is maintained, but the HIVE cannot participate in the physical network at the data/link layer

Engineering Contradiction:

ImproveHIVE network isolationVSAvoidVirtual network stack

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The flow steering engine acts as an intermediary that allows the HIVE to maintain its private MAC address for isolation purposes while still participating in the physical network. The engine redirects packets at the network layer based on IP addresses and flow tuples, bridging the gap between the virtualized private network and the physical network without requiring the HIVE to expose its private MAC address.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentEP3853721B1Hypervisor flow steering for address sharing

Publication Date: 2025.12.31 MICROSOFT TECHNOLOGY LICENSING LLC

Figure 1
Figure 2
Figure 3

AI summary

Embodiments relate to hypervisors that provide hardware isolated virtualization environments (HIVEs) such as containers and virtual machines (VMs). A first HIVE includes a first virtual network interface card (NIC) and a second HIVE includes a second virtual NIC. Both virtual NICs are backed by the same physical NIC. The physical NIC has an Internet Protocol (IP) address. The virtual NICs are assigned the same IP address as the physical NIC. A networking stack of the hypervisor receives inbound packets addressed to the IP address. The networking stack steers the inbound packets to the virtual NICs according to tuples of the inbound packets. Packets emitted by the virtual NICs comprise the IP address, pass through the network stack, and are transmitted by the physical NIC with headers comprising the IP address.