Hypervisor Packet Filtering with Verified Guest Program Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Processing packets in guest virtual machines is slower than in hypervisors, and executing program code from guest virtual machines in hypervisors can be unsafe, potentially gaining unauthorized access to data.
Innovation Solution
Implementing secure processing programs in the hypervisor that are trusted and verified, with criteria specified by the guest virtual machine, using a shared memory region to associate packet criteria with program identifiers and processors, allowing efficient and safe packet processing without executing arbitrary, potentially unsafe, application program code at the hypervisor's privilege level.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If packet processing is performed in guest virtual machines, then security is improved through isolation and protection, but processing speed deteriorates compared to hypervisor-level processing
Solution Approach 1:
The patent introduces a hypervisor-level intermediary component that acts as a secure bridge between the guest virtual machine and the network. This intermediary verifies and validates packet filter programs before execution, enabling fast packet processing at the hypervisor level while maintaining the security benefits of guest-level isolation. The intermediary component includes verification modules that check program integrity and authorized access patterns without requiring slow guest VM processing for every packet.
2Productivity
If arbitrary program code from guest virtual machines is executed in the hypervisor, then packet processing efficiency is improved, but security deteriorates due to potential unauthorized access to data
Solution Approach 1:
The patent implements preliminary verification and validation actions that are performed on packet filter programs before they are executed in the hypervisor. The verification process includes checking program signatures, validating authorized access patterns, and ensuring program integrity. This preliminary action ensures that only verified and authorized programs are loaded and executed at the hypervisor level, maintaining security while enabling efficient packet processing.
Solution Approach 2:
The patent incorporates feedback mechanisms that continuously monitor the execution of packet filter programs in the hypervisor. The system tracks program behavior, validates output against expected patterns, and can terminate or rollback execution if unauthorized or malicious behavior is detected. This feedback loop maintains security while allowing efficient hypervisor-level packet processing to proceed.
Data Source
AI summary
An example method may include: receiving, by a hypervisor, a data packet, identifying a memory location associated with a guest virtual machine and accessible to the guest virtual machine and the hypervisor, wherein a program mapping table comprising one or more mapping table entries is stored at the memory location, each mapping table entry specifying a program selection criterion and a packet processing program. The example method may further include identifying, among the one or more mapping table entries in the program mapping table stored at the memory location, a mapping table entry comprising a particular program selection criterion that is satisfied by the data packet, wherein the identified mapping table entry specifies a first packet processing program, and executing the first packet processing program, wherein the data packet is provided to the first packet processing program as input.