Privileged Network Filter for Virtual Switch Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current virtualization systems face challenges in managing network filtering and forwarding programming, with existing methods either compromising security and performance or restricting VM networking capabilities, and relying on CPU-intensive learning/snooping logic for packet forwarding.
Innovation Solution
A privileged management module is introduced at the host machine to intercept and evaluate VM networking requests against administrative policies, automating filtering and forwarding programming without the need for snooping or learning logic, allowing VMs to make configuration changes while ensuring policy compliance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the hypervisor allows VMs to perform any type of networking programming, then networking flexibility and VM control are improved, but security and performance deteriorate
Solution Approach 1:
The patent introduces a virtual switch as an intermediary component between VMs and the physical network. The virtual switch intercepts networking programming requests from VMs, evaluates them against administrative policies, and selectively permits or denies them. This mediator approach allows VMs to maintain networking flexibility while the virtual switch ensures security by filtering malicious or non-compliant requests before they reach the hypervisor or physical network infrastructure.
2Reliability
If a separate component manages networking parameters for VMs without allowing VM configuration changes, then security and performance are improved, but VM networking capabilities and adaptability are lost
Solution Approach 1:
The patent implements a dynamic networking management system where the virtual switch can adapt its behavior based on the type of request and current system state. Rather than a static, completely restrictive approach, the virtual switch dynamically evaluates each networking programming request against administrative policies, allowing legitimate VM configuration changes while blocking harmful ones. This dynamic approach preserves VM networking capabilities while maintaining security.
3Measurement precision
If the host machine uses learning/snooping logic to determine packet forwarding, then forwarding accuracy is improved, but CPU load increases
Solution Approach 1:
The patent implements preliminary action by having the virtual switch evaluate and approve networking programming requests in advance, before actual packet forwarding occurs. By pre-establishing approved forwarding rules and filtering configurations through the virtual switch, the system eliminates the need for runtime snooping and learning logic that would consume CPU cycles. The virtual switch prepares the networking environment beforehand, allowing the host machine to forward packets efficiently based on pre-approved configurations rather than continuously analyzing traffic patterns.
Data Source
AI summary
A mechanism for managed network filter/forward programming in a virtualization system is disclosed. A method of the invention includes receiving a network programming request from a hypervisor managing a virtual machine (VM), wherein the hypervisor intercepted the network programming request from the VM, determining whether the network programming request satisfies an administrative network policy, and updating network configuration settings as requested by the network programming request if the network programming request satisfies the administrative network policy, wherein the updating occurs without restarting the VM.