Scan-on-read Manager for Network Security Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Hardware transport network interfaces face a performance penalty in receive-side security scanning, as accessing received data for scanning diminishes the efficiency gains of kernel bypass and zero copy mechanisms, necessitating a method to allow data copying into the target application buffer while enabling scanning.
Innovation Solution
The implementation of a scan-on-read manager that modifies page table entries to cause a fault when an application attempts to read data, allowing fault handling to detect and scan the data only at that point, thereby enabling scanning without compromising performance gains.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If hardware transport is used for network communication, then network communication efficiency is improved (4× performance gain), but receive-side security scanning becomes difficult without compromising performance
Solution Approach 1:
The system performs preliminary setup by installing scan-on-read handlers in page table entries before data reception. These handlers are pre-configured to automatically trigger security scanning when applications attempt to read received data, eliminating the need for post-reception scanning that would compromise hardware transport performance.
Solution Approach 2:
The patent introduces an intermediary mechanism (scan-on-read handler in page table entries) between the hardware transport layer and the application layer. This intermediary enables security scanning to occur transparently during application read operations without interfering with the hardware transport's zero-copy efficiency.
2Reliability
If data is accessed for security scanning before application read, then security is improved, but performance advantage of hardware transport is substantially diminished or eliminated
Solution Approach 1:
Instead of continuous or pre-reception scanning, the system implements periodic scanning triggered by application read operations. The security scan occurs only when necessary (when the application attempts to read data), maintaining the 4× performance advantage while still providing security protection.
Solution Approach 2:
The system changes the timing parameter of security scanning from 'before application read' to 'during application read'. This parameter change allows security scanning to occur at the optimal moment when it is most effective, while minimizing performance impact by leveraging the application's necessary read operation.
3Stability of the object's composition
If complete memory space is copied to child process in parallel processing, then memory isolation is ensured, but copying operation is very expensive and negates performance advantage
Solution Approach 1:
The patent extracts only the essential function of memory isolation from complete memory copying. By installing scan-on-read handlers in page table entries, the system achieves memory security (isolation) without actually copying the memory space, thus eliminating the expensive copying operation while maintaining parallel processing efficiency.
Solution Approach 2:
Instead of copying complete memory spaces, the system copies only the scan-on-read handler mechanism into the child process's page table entries. This lightweight copying approach provides the necessary memory isolation and security scanning capability without the performance penalty of full memory duplication.
Data Source
AI summary
A scan-on-read manager efficiently scans received data. The scan-on-read manager detects attempts by applications to read received data. The scan-on-read manager scans received data only responsive to an application attempting to read it. The scan-on-read manager only allows the application to read received data that has been scanned.