NIC Classifier for Virtual Machine Traffic Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computer systems with multiple concurrently executing operating systems, managing incoming network traffic to enforce usage policies across virtual machines is challenging, as traditional methods lack control over traffic from switches without affecting other operating systems.
Innovation Solution
A system and method that configure a classifier on a physical network interface card (NIC) to forward packets to hardware receive rings (HRRs) associated with virtual NICs, allowing for priority-based flow control (PFC) lanes, and transmit pause frames to switches to manage traffic and enforce usage policies, ensuring that traffic violations are addressed without affecting other virtual machines.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional network traffic control methods are used in virtualized systems, then all operating systems share common traffic control mechanisms, but individual operating systems cannot exercise control over incoming traffic without affecting other operating systems
Solution Approach 1:
The patent segments network traffic control by implementing separate priority-based flow control lanes for each virtual machine. The physical NIC is divided into multiple independent PFC lanes, each associated with a specific destination address or VLAN, allowing individualized traffic control without affecting other VMs. This segmentation enables each operating system to exercise control over its own incoming traffic while maintaining isolation from other virtual machines.
2Productivity
If multiple virtual machines share a single physical NIC, then resource utilization is improved, but traffic management and policy enforcement become difficult
Solution Approach 1:
The patent introduces hardware receive rings (HRRs) as intermediary structures between the physical NIC and virtual machines. Each HRR acts as a dedicated buffer and management interface for a specific VM, allowing the physical NIC to efficiently distribute traffic to multiple VMs while maintaining simple and independent traffic management for each. The HRRs serve as mediators that enable policy enforcement and flow control without complicating the overall system operation.
3Reliability
If pause frames are transmitted to control incoming traffic, then traffic flow control is improved, but latency may increase due to packet buffering
Solution Approach 1:
The patent implements dynamic flow control by enabling virtual machines to dynamically transmit pause frames based on their real-time buffer status and traffic conditions. Each VM can independently activate or deactivate pause frames for its associated PFC lane, allowing the system to adapt traffic flow control to current needs. This dynamic approach ensures reliable flow control while minimizing latency by only buffering packets when necessary, rather than continuously.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
A computer program product comprising software instructions for managing resources on a host, wherein the software instructions comprise functionality to: configure a classifier located on a NIC, to forward packets addressed to a first destination address to a first HRR mapped to a first VNIC, wherein packets addressed to the first destination address are associated with a first PFC lane; configure the classifier to forward packets addressed to a second destination address to a second HRR, wherein packets addressed to the second destination address are associated with a second PFC lane; and transmit, by the first VNIC, a pause frame associated with the first PFC lane to a switch operatively connected to the physical NIC, wherein the switch, in response to receiving the pause frame, stores packets associated with the first PFC lane in a buffer without transmitting the packets.