PNIC Firewall Offload with Flow Cache and Hardware Switching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current firewalls implemented in hypervisor environments for virtual machines (VMs) are inefficient as they rely on host computer CPU resources for networking and storage functionalities, leading to a need for offloading these operations to smart network interface cards (NICs).
Innovation Solution
A method to offload firewall operations from a host computer to a physical network interface card (PNIC) by configuring a first firewall on the PNIC to determine actions for data message flows, processing them using a flow-cache second firewall, and offloading further processing to an embedded hardware switch on the PNIC.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If firewall operations are implemented in the host computer hypervisor, then comprehensive security control can be achieved, but the host computer CPU resources are consumed leading to reduced networking efficiency
Solution Approach 1:
The patent extracts firewall operations from the host computer hypervisor and relocates them to the physical network interface card (PNIC). The PNIC includes a firewall module that independently processes data messages according to firewall rules, separating the security control function from the host CPU responsibilities. This extraction maintains comprehensive security control while eliminating the CPU resource consumption associated with host-based firewall processing.
Solution Approach 2:
The patent introduces a flow cache structure as an intermediary between the PNIC firewall module and the host computer. The flow cache stores pre-processed flow information and firewall rule matching results, allowing the PNIC to quickly retrieve and apply firewall decisions without repeatedly querying the host computer. This intermediary mechanism enables the PNIC to autonomously handle firewall operations, maintaining security control while improving networking efficiency by reducing host CPU involvement.
2Adaptability or versatility
If firewall rules are enforced at the VNIC of each VM in the hypervisor, then per-VM security control is achieved, but the inspection process consumes host computer processing resources
Solution Approach 1:
The patent extracts per-VM firewall control capabilities from the host computer hypervisor and relocates them to the PNIC. The PNIC firewall module maintains the ability to enforce firewall rules at the VNIC level for each VM, preserving fine-grained per-VM security control. By performing these inspections at the PNIC rather than the host CPU, the patent eliminates the consumption of host processing resources while maintaining the same level of security control adaptability.
Solution Approach 2:
The patent enables the PNIC to autonomously perform firewall rule inspections and enforcement for each VM's VNIC without requiring host computer processing resources. The PNIC firewall module independently matches incoming and outgoing data messages against applicable firewall rules, determines compliance, and enforces security policies self-service style. This self-service capability at the PNIC maintains per-VM security control adaptability while eliminating dependency on host CPU resources.
3Productivity
If the PNIC processes all data message flows, then host computer CPU is freed for other tasks, but the PNIC processing capacity may be insufficient for complex firewall operations
Solution Approach 1:
The patent segments the firewall processing workload into two distinct parts: the PNIC handles initial firewall rule matching, flow classification, and simple enforcement decisions; the host computer handles complex firewall operations, rule updates, and exception cases. This segmentation allows the PNIC to process the majority of data messages independently, freeing host CPU for other tasks, while complex operations are escalated to the host. The segmentation resolves the contradiction by matching each processor's capabilities to appropriate task complexity.
Solution Approach 2:
The patent implements preliminary action by having the PNIC perform initial firewall rule matching and flow classification before data messages reach the host computer. The PNIC pre-processes data messages by comparing them against firewall rules, identifying matching flows, and making preliminary enforcement decisions. This preliminary action at the PNIC handles the bulk of processing requirements, freeing the host computer for more complex tasks while ensuring firewall security is established early in the processing pipeline.
Data Source
AI summary
Some embodiments provide a novel method for offloading firewall operations from a host computer executing a set of one or more virtual machines (VMs) to a physical network interface card (PNIC) connected to the host computer. The method configures, on the PNIC, a first firewall to determine actions to perform on flows associated with the set of VMs, and to offload processing of the flows to a flow-cache second firewall of the PNIC. The method configures, on the PNIC, the flow-cache second firewall to process a first set of flows based on a first set of actions determined by the first firewall, and to offload processing of a second set of flows to an embedded hardware switch of the PNIC. The method configures, on the PNIC, the embedded hardware switch to process the second set of flows based on a second set of actions determined by the first firewall.