Network Interface Controller Offloading Intrusion Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtual machine environments, conventional software virtual switches act as performance bottlenecks and introduce latency when handling data traffic and intrusion detection, as they require communication with external appliances, which can hinder efficient resource utilization and increase latency.
Innovation Solution
A network interface controller (NIC) is configured to offload switching and intrusion detection functions, utilizing filter processing to steer frames for additional processing, thereby reducing the load on host resources and minimizing latency by performing these functions within the NIC or dynamically with host-based intrusion detection processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a software virtual switch is used to handle data traffic and intrusion detection, then intrusion detection capability is provided, but performance bottleneck and increased latency occur
Solution Approach 1:
The patent extracts the intrusion detection function from the software virtual switch and implements it directly within the NIC hardware. The NIC now includes dedicated intrusion detection circuitry that can inspect data frames for malicious content independently of the host processor, removing this function from the software layer that causes performance bottlenecks.
Solution Approach 2:
The patent introduces a buffer memory within the NIC that serves as an intermediary between the data traffic flow and the intrusion detection processing. This buffer allows the NIC to hold incoming frames temporarily while intrusion detection is performed, enabling parallel processing and preventing the detection function from blocking the main data path.
2Reliability
If an external appliance is used for intrusion detection, then intrusion detection is provided, but communication latency increases due to external communication
Solution Approach 1:
The patent merges the intrusion detection function with the NIC hardware itself, combining what were previously separate components (NIC and external intrusion detection appliance) into a single integrated unit. This eliminates the need for external communication and associated latency, as intrusion detection now occurs locally within the NIC before frames are passed to the host.
3Adaptability or versatility
If host resources are used for switching and intrusion detection, then comprehensive processing is achieved, but resource utilization efficiency decreases
Solution Approach 1:
The patent enables the NIC to serve itself by implementing switching and intrusion detection functions directly within the hardware. The NIC can now perform frame steering, filtering, and intrusion detection autonomously without requiring host CPU intervention for these operations, allowing the host resources to be allocated to more demanding computational tasks.
Data Source
AI summary
A network interface controller (NIC) is configured to couple a host to a network. The NIC coupled to the host via a host bus, and the host is configured to operate a plurality of virtual machines. The NIC is configured to receive at least one data frame, the at least one data frame including at least a source network address and indication of at least one destination network address; determine if the received data frame is a frame on which additional processing should occur; based on a result of the determining step, cause the frame to be provided to the host, via the host bus, for the host to perform the additional processing; and receive, via the host bus, the frame on which additional processing has been performed and steer the frame to a destination based on the at least one destination address.