Packet Flow Policy Configuration in Kernel Space Without User-Space Handoff
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing packet forwarding systems consume significant processing resources and are vulnerable to denial-of-service attacks due to the reactive creation of policy flows, which involves sending packets to the user space for configuration.
Innovation Solution
Implementing automatic policy configuration for packet flows using the kernel of a computing device without sending packets to the user space, enabling the kernel to determine and configure policies for both forward and reverse packet flows based on packet information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If packets are sent to user space for policy configuration, then policy flows can be created reactively, but processing resources are consumed significantly and the system becomes vulnerable to denial-of-service attacks
Solution Approach 1:
The patent extracts the policy configuration functionality from user space and relocates it to kernel space. The kernel now directly configures policy flows without requiring packet transmission to user space, eliminating the performance bottleneck while maintaining reactive policy creation capability.
Solution Approach 2:
The patent introduces a kernel-space policy configuration mechanism that acts as an intermediary between packet reception and policy application. This mediator enables direct kernel-to-kernel policy installation, removing the need for user-space involvement in the packet processing path.
2Adaptability or versatility
If packets are sent to user space for configuration, then policy flows can be configured dynamically, but packet processing speed decreases
Solution Approach 1:
The patent removes the user-space packet transmission step from the policy configuration process. By extracting this operation and performing policy configuration directly in kernel space, the system maintains dynamic policy updates while restoring full packet processing speed.
3Adaptability or versatility
If packets are sent to user space for policy configuration, then policy flows can be created on-demand, but the system becomes vulnerable to denial-of-service attacks
Solution Approach 1:
The patent extracts the security vulnerability by removing user-space involvement from the packet processing path. Policy flows are created on-demand in kernel space, eliminating the attack vector where malicious packets could be sent to user space to exhaust system resources.
4Adaptability or versatility
If reactive policy flow creation is implemented, then packet flows can be configured as needed, but processing overhead increases
Solution Approach 1:
The patent extracts the overhead-causing operation of sending packets to user space and replaces it with direct kernel-space policy configuration. This maintains reactive policy creation while dramatically reducing the processing overhead associated with inter-space communication and packet handling.
Data Source
AI summary
Techniques are disclosed for providing automatic policy configuration for packet flows. For example, a computing device comprises a virtual node and one or more virtual execution elements coupled to the virtual node. The computing device may also comprise one or more processors configured to: receive a packet originating from an application workload hosted on the one or more virtual execution elements and destined for a remote destination device; determine the packet is part of a new packet flow; in response, configure, by a kernel of the computing device and without sending the packet to a user space of the computing device, a policy for a forward packet flow for the new packet flow; configure, by the kernel, a policy for a reverse packet flow associated with the forward packet flow; and send the packet toward the remote destination device in accordance with the policy for the forward packet flow.