Kernel Packet Flow Policy Configuration Without User-Space Overhead
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing packet forwarding systems consume significant processing resources and are vulnerable to denial-of-service attacks due to the reactive creation of policy flows, which involves sending packets to the user space for configuration.
Innovation Solution
Implementing automatic policy configuration for packet flows using the kernel of a computing device, without sending packets to the user space, by examining packet information to determine existing flows and configuring policies directly within the kernel.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If packets are sent to user space for policy configuration, then policy flows can be created dynamically, but processing resources are consumed and denial-of-service vulnerability increases
Solution Approach 1:
The patent segments packet processing into kernel space operations (flow matching, policy application) and user space operations (policy configuration). By handling routine packet processing in kernel space and only involving user space for actual policy configuration when needed, the system achieves dynamic policy creation while minimizing resource consumption and attack surface.
Solution Approach 2:
The patent introduces a flow cache as an intermediary data structure in kernel space that stores packet flow information. This cache acts as a mediator between incoming packets and user space policy configuration, allowing the kernel to quickly match packets against cached flows without immediately involving user space, thus reducing processing overhead and denial-of-service vulnerability.
2Adaptability or versatility
If packets are sent to user space for policy configuration, then policy flows can be created dynamically, but packet processing speed decreases
Solution Approach 1:
The patent performs preliminary actions by pre-populating the flow cache with packet flow information before packets arrive. When packets are received, the kernel can immediately match them against the pre-computed cache entries, avoiding the need to send packets to user space for analysis. This preliminary caching significantly speeds up packet processing while maintaining dynamic policy creation capabilities.
Solution Approach 2:
The patent enables the kernel to skip the user space packet sending step entirely for packets that match cached flows. By rushing through the matching process using cached information, the system achieves high-speed processing for routine packets while still allowing dynamic policy creation when cache misses occur.
3Adaptability or versatility
If packets are sent to user space for policy configuration, then policy flows can be created dynamically, but denial-of-service attacks become more vulnerable
Solution Approach 1:
The patent extracts the critical packet processing functions (flow matching, policy enforcement) from user space and places them in kernel space. By taking out only the essential configuration functions to user space, the system maintains dynamic policy creation while minimizing the attack surface exposed to user space, thereby reducing denial-of-service vulnerability.
Solution Approach 2:
The patent creates a copy of packet flow information in the kernel space flow cache, which is a simplified representation sufficient for matching purposes. This copy allows the kernel to perform matching operations independently without involving user space, reducing the system's vulnerability to denial-of-service attacks while preserving dynamic policy capabilities.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques are disclosed for providing automatic policy configuration for packet flows. For example, a computing device comprises a virtual node and one or more virtual execution elements coupled to the virtual node. The computing device may also comprise one or more processors configured to: receive a packet originating from an application workload hosted on the one or more virtual execution elements and destined for a remote destination device; determine the packet is part of a new packet flow; in response, configure, by a kernel of the computing device and without sending the packet to a user space of the computing device, a policy for a forward packet flow for the new packet flow; configure, by the kernel, a policy for a reverse packet flow associated with the forward packet flow; and send the packet toward the remote destination device in accordance with the policy for the forward packet flow.