Kernel-Mode Packet Filtering for User-Mode Network Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
User-mode network application programs face inefficiencies due to frequent data duplication and inability to support novel data access like RDMA, while kernel-mode programs are difficult to develop and can cause OS crashes if errors occur.
Innovation Solution
A network application program product that operates in both user and kernel modes, with a packet filtering module in kernel mode capturing and analyzing network packets, comparing them to preset code content, and instructing data access or forwarding packets accordingly to maintain efficient data processing and access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If network application program operates in user mode, then ease of development and maintenance is improved, but running efficiency deteriorates due to frequent data duplication
Solution Approach 1:
The system is segmented into user-mode application program and kernel-mode packet filtering module. The packet filtering module operates independently in kernel mode to handle data access and packet filtering, while the application program in user mode focuses on business logic. This segmentation allows the application program to maintain ease of development while the kernel-mode module provides efficient data access without requiring frequent context switches or data copying.
2Productivity
If network application program operates in kernel mode, then running efficiency is improved, but ease of development and maintenance deteriorates
Solution Approach 1:
The system divides functionality between user-mode and kernel-mode components. Complex packet filtering and data access operations are segmented into the kernel-mode packet filtering module, while the application program in user mode handles higher-level logic. This segmentation provides efficient data access through direct kernel-mode operations while maintaining ease of development by isolating complex system-level code.
3Productivity
If network application program operates in kernel mode, then running efficiency is improved, but system stability deteriorates due to risk of OS crashes
Solution Approach 1:
The system segments critical operations into a dedicated kernel-mode packet filtering module that operates with controlled access to system resources. The user-mode application program cannot directly cause system crashes since it does not execute privileged operations. This segmentation maintains system stability by isolating potential error sources while preserving running efficiency through direct kernel-mode data access.
Solution Approach 2:
The packet filtering module in kernel mode acts as a protective layer that pre-processes and validates packets before they reach the user-mode application program. By performing filtering and validation in advance in the controlled kernel environment, the system prevents malformed or malicious data from causing instability in the user-mode application, thus cushioning against potential system crashes.
4Ease of operation
If user-mode application program directly accesses storage device, then ease of operation is improved, but data access efficiency deteriorates due to frequent data duplication
Solution Approach 1:
The packet filtering module in kernel mode serves as an intermediary between the user-mode application program and the storage device. It intercepts data access requests, performs necessary filtering and processing, and directly accesses the storage device when needed. This intermediary approach maintains ease of operation for the application program while improving data access efficiency by eliminating redundant data copying through direct kernel-mode storage access.
Data Source
AI summary
A network application program product and a method for processing an application layer protocol are provided. The network application program product includes a network application program executed in a user mode and a packet filtering module executed in a kernel mode. The network application program transmits connection information, associated with network connection to the network application program, to the packet filtering module. The packet filtering module captures a to-be-processed packet on the network connection according to the connection information; analyzes the to-be-processed packet into at least one protocol data unit; compares the protocol data unit with preset code content; and transmits the protocol data unit to the network application program or the data access module according to the comparison result for later processing.