Hypervisor Malicious Packet Filtering via VM Queue
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtualization systems face inefficiencies in handling malicious packets, leading to performance degradation as virtual machines are woken up to discard packets, and encrypted packets pose decryption challenges for hypervisors, making conventional filtering techniques inadequate.
Innovation Solution
Implementing a system where virtual machines determine malicious packets and add them to a filtering queue, with the hypervisor generating rules based on these packets to filter subsequent malicious packets, and optionally installing these rules on a physical NIC for efficient packet handling.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If virtual machines process and discard malicious packets themselves, then security detection capability is improved, but host performance deteriorates due to VM wake-up overhead
Solution Approach 1:
The patent introduces a filtering queue as an intermediary component between the virtual machine and the malicious packet handling process. The filtering queue stores malicious packet characteristics and allows the hypervisor to perform filtering operations without waking up the virtual machine, thus maintaining security detection capability while avoiding performance degradation from VM wake-up overhead
Solution Approach 2:
The patent replaces the mechanical approach of waking up virtual machines to process packets with a hypervisor-based filtering mechanism. The hypervisor intercepts packets at the virtual network interface card level and performs filtering based on characteristics stored in the filtering queue, eliminating the need to wake up VMs for routine packet processing
2Loss of energy
If hypervisor implements packet filtering, then resource usage is reduced, but ability to detect encrypted malicious packets deteriorates
Solution Approach 1:
The patent implements preliminary action by having the virtual machine proactively identify and store malicious packet characteristics in the filtering queue before the hypervisor performs bulk filtering. This allows the hypervisor to use these pre-extracted characteristics for efficient filtering of encrypted packets without needing to decrypt them, maintaining low resource usage while improving detection capability
3Reliability
If filtering rules are applied to all subsequent packets, then malicious packet filtering is improved, but processing speed deteriorates due to constant verification
Solution Approach 1:
The patent applies local quality by implementing selective filtering based on packet characteristics. Instead of applying uniform filtering to all packets, the system extracts specific characteristics (such as source address, destination address, port numbers, or encrypted signatures) and applies filtering rules only based on these local features, improving both filtering reliability and processing speed
Data Source
AI summary
A method includes accessing, by a hypervisor executing by a processing device, a filtering queue that stores at least one packet determined to be malicious by a virtual machine, generating, by the hypervisor, a filtering rule in view of characteristics of the at least one packet determined to be malicious, and storing the filtering rule in a data store to apply to subsequent packets addressed to the virtual machine to determine whether any of the subsequent packets have similar characteristics with the at least one packet determined to be malicious.