Parallel Network Stack for Virtualized Guest Networking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing environments, providing users with full access to hardware resources while ensuring security and preventing modifications that could affect subsequent users is challenging due to the risks of firmware changes and performance degradation caused by virtualization overhead.
Innovation Solution
Implementing an enhanced protocol that bypasses conventional network stack restrictions by allowing large packets to be processed at the host layer, segmenting them to conform to standard protocols, and using a parallel network stack to improve networking speed and security, while monitoring and controlling access to firmware and configuration information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If virtualization is implemented to provide cloud computing services, then resource sharing and scalability are improved, but network performance deteriorates due to virtualization overhead
Solution Approach 1:
The patent segments network traffic into two categories: traffic between virtual machines on the same host (handled directly by the virtual switch) and traffic to external networks (handled by the physical network interface). This segmentation eliminates unnecessary routing overhead for intra-host traffic while maintaining external connectivity, thus improving network performance without compromising virtualization capabilities.
Solution Approach 2:
The patent introduces a virtual switch as an intermediary component that sits between virtual machine network interfaces and physical network interfaces. The virtual switch intelligently routes traffic, performing direct delivery for intra-host traffic and standard routing for external traffic, thereby reducing virtualization overhead while maintaining resource sharing benefits.
2Ease of operation
If users are granted full access to hardware resources, then customization and performance are improved, but security deteriorates due to potential firmware modifications
Solution Approach 1:
The patent extracts firmware and configuration information from the virtual machine environment and stores it in a secure location on the host system. This allows users to access and modify their virtual machine configurations through approved interfaces while preventing direct access to the underlying host firmware, thus maintaining security while enabling hardware-level customization.
Solution Approach 2:
The patent introduces a security layer as an intermediary between users and hardware resources. This layer provides controlled access to firmware and configuration information, allowing users to perform necessary customizations while preventing unauthorized modifications that could compromise system security or affect other users.
3Reliability
If packet processing is performed at multiple network stack levels, then protocol compliance is improved, but processing speed deteriorates due to additional overhead
Solution Approach 1:
The patent segments packet processing into two paths: a fast path for traffic that only requires virtual switch handling (intra-host traffic) and a complete path for traffic requiring full network stack processing (external traffic). This segmentation allows compliant protocol processing where needed while maximizing speed for traffic that doesn't require full processing, thus resolving the contradiction between protocol compliance and processing speed.
Data Source
AI summary
Networking speed in a virtualized environment can be improved by utilizing an enhanced protocol and parallel stack to bypass restrictions of a conventional network stack that complies with standard networking protocols. In one embodiment, an enhanced TCP protocol enables large packets received from a guest application to bypass the guest networking stack and be received to a bottom conversion layer of the enhanced stack, which is able to segment the packet into appropriately sized segments that conform to the conventional protocol. These segments can be passed to a network interface card (NIC) or other device for encapsulation, framing, or other such processing to be transmitted to the destination as Ethernet frames or other such packets.