Network Interface Controller Offloading Encapsulation for Virtualization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network virtualization technologies, such as NVGRE and VXLAN, require virtual machines to rely on hypervisors for encapsulation and decapsulation of packets, leading to increased computing power consumption and communication latency due to the need for hypervisor involvement in all packet transmissions and receptions.
Innovation Solution
Offloading network virtualization support functions to a network interface controller (NIC), allowing virtual machines to send and receive packets directly over tenant networks without hypervisor intervention by using encapsulation tables stored in host memory, with the NIC accessing and managing encapsulation information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hypervisors are used to encapsulate and decapsulate packets for network virtualization, then network virtualization functionality is achieved, but computing power consumption increases and communication latency increases
Solution Approach 1:
The patent extracts the packet encapsulation and decapsulation functions from the hypervisor software layer and relocates them to the NIC hardware layer. This extraction moves the processing burden from the CPU-hypervisor software chain to dedicated hardware circuits in the NIC, thereby reducing computing power consumption while maintaining network virtualization functionality.
Solution Approach 2:
The patent introduces an intermediary encapsulation table stored in host memory that the NIC uses to perform encapsulation operations. This intermediary structure enables the NIC to autonomously handle encapsulation without requiring hypervisor intervention, reducing both computing power consumption and communication latency while preserving virtualization capabilities.
2Reliability
If hypervisors are involved in all packet transmissions and receptions, then network virtualization is maintained, but communication latency increases
Solution Approach 1:
The patent extracts the time-consuming hypervisor involvement from the packet transmission and reception path. By moving encapsulation and decapsulation to NIC hardware, packets no longer need to traverse the software hypervisor layer during data plane operations, significantly reducing communication latency while maintaining virtualization isolation.
Solution Approach 2:
The NIC is empowered to perform encapsulation and decapsulation operations autonomously using encapsulation tables stored in host memory. This self-service capability eliminates the need for hypervisor mediation in every packet operation, reducing communication latency while preserving network virtualization functionality.
3Reliability
If network virtualization is implemented with encapsulation headers, then tenant network isolation is achieved, but device complexity increases
Solution Approach 1:
The patent introduces an encapsulation table as an intermediary data structure that stores pre-configured encapsulation parameters. This table acts as a mediator between the NIC hardware and the virtualization requirements, enabling the NIC to perform complex encapsulation operations with simple hardware logic while maintaining tenant network isolation.
Solution Approach 2:
The encapsulation tables are pre-populated with encapsulation parameters before runtime operations. This preliminary action allows the NIC to perform encapsulation using simple table lookups rather than complex real-time computations, reducing device complexity while maintaining isolation capabilities.
Data Source
AI summary
A network interface device includes a host interface for connection to a host processor having a memory. A network interface is configured to transmit and receive data packets over a data network, which supports multiple tenant networks overlaid on the data network. Processing circuitry is configured to receive, via the host interface, a work item submitted by a virtual machine running on the host processor, and to identify, responsively to the work item, a tenant network over which the virtual machine is authorized to communicate, wherein the work item specifies a message to be sent to a tenant destination address. The processing circuitry generates, in response to the work item, a data packet containing an encapsulation header that is associated with the tenant network, and to transmit the data packet over the data network to at least one data network address corresponding to the specified tenant destination address.