Metavisor Network Packet Routing in Virtualized Environments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualized computing environments, managing network traffic between two independent operating entities sharing a fixed hardware address is challenging, as the virtual data center blindly drops packets without the correctly assigned address, leading to inefficiencies and security vulnerabilities.
Innovation Solution
The introduction of a meta-hypervisor (metavisor) that operates transparently between the hypervisor and guest OS, using conditional tests and actions to differentiate and manage network packet traffic, enabling transparent encryption/decryption and firewall filtering services by reordering encryption/decryption operations and employing hook modules to inspect and route packets correctly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If an intermediary manager is deployed as an independent operating entity sharing a hardware address with the guest OS, then network traffic management and security services are enhanced, but the virtual data center cannot distinguish between packets for the intermediary manager and packets for the guest OS, causing packets to be blindly dropped
Solution Approach 1:
The patent introduces a metavisor as an intermediary layer between the hypervisor and the guest OS. The metavisor intercepts and inspects network packets, determining whether they are destined for the intermediary manager or the guest OS. This mediator resolves the address conflict by adding an intermediate decision-making layer that the VDC architecture lacks, enabling proper packet routing without requiring changes to the underlying VDC address assignment mechanism.
2Adaptability or versatility
If the intermediary manager shares the fixed hardware address assigned by the VDC, then network interface functionality is provided, but the VDC blindly drops any packet not having the correctly assigned address, preventing proper communication
Solution Approach 1:
The patent segments the network traffic handling process into distinct stages: packet interception by the metavisor, inspection and classification of packet destination, and conditional forwarding to either the intermediary manager or the guest OS. This segmentation allows the system to maintain the shared hardware address configuration while reliably delivering packets to the correct recipient through structured process division.
3Measurement precision
If the metavisor inspects and differentiates network packets to route them correctly, then packet forwarding accuracy is improved, but the complexity of network traffic management increases due to conditional tests and actions required
Solution Approach 1:
The metavisor performs preliminary inspection and classification of network packets before they reach the guest OS or intermediary manager. By pre-determining packet destination and applying appropriate routing actions in advance, the system avoids the need for complex runtime decision-making at lower layers. This preliminary action simplifies the overall system complexity by centralizing the differentiation logic in the metavisor layer.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A technique transparently deploys an operating entity (OE) into a network data path of a virtualized computing environment that includes a guest operating system (OS) running in a virtual machine instance (VMI) of a virtual data center (VDC). The OE is embodied as an intermediary manager, e.g., a meta-hypervisor (metavisor), of a computing cell within the VMI that includes the guest OS and associated applications. The computing cell is layered over a hypervisor which manages system resources of the VDC in an arrangement such that the metavisor is disposed between the hypervisor and guest OS, and operates transparent to the guest OS. The transparent deployment technique involves a set of conditional tests and actions embodied as modules of the metavisor that is applied to examine network packet traffic exchanged over the network data path and that operates to make the presence of the metavisor within the network data path "invisible" (i.e., transparent) to the guest OS, i.e., so that the guest OS is unaware of the presence of the metavisor.