Smart NIC Firewall Offload for Seamless VM Migration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Firewalls in hypervisor environments struggle to efficiently offload networking and storage functionalities to smart NICs, leading to CPU overload and inefficient processing of data message flows in virtual machines.
Innovation Solution
Offload firewall operations from a host computer to a physical network interface card (PNIC) by configuring a first firewall to determine actions on data message flows and offload processing to a flow-cache second firewall and embedded hardware switch on the PNIC, utilizing flow records and middlebox services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If firewall operations are implemented in the hypervisor on a per-VNIC basis, then firewall rules can be enforced at the VNIC level, but the host computer CPU becomes overloaded and processing efficiency decreases
Solution Approach 1:
The patent extracts firewall operations from the host computer hypervisor and relocates them to the smart NIC device. The smart NIC receives data messages from virtual machines and performs firewall rule evaluation, action execution, and flow record maintenance independently, removing the processing burden from the host CPU while maintaining security enforcement.
Solution Approach 2:
The smart NIC acts as an intermediary between virtual machines and the external network. It intercepts data messages at the VNIC level, applies firewall rules locally, and only forwards allowed traffic to the external network, eliminating the need for host CPU involvement in firewall processing while preserving the security function.
2Productivity
If firewall operations are offloaded to a smart NIC, then host computer CPU load is reduced, but the device complexity of the smart NIC increases
Solution Approach 1:
The smart NIC is designed to perform multiple functions: data message reception from virtual machines, firewall rule evaluation, action execution (allow/drop/block), flow record maintenance, and external network communication. By consolidating these functions into a single device, the patent reduces host CPU involvement while managing complexity through functional integration.
Solution Approach 2:
The smart NIC autonomously performs firewall operations without requiring host CPU intervention. It maintains its own flow records, evaluates rules independently, and executes actions directly, making the device self-sufficient for firewall processing while reducing the computational burden on the host system.
3Reliability
If flow records are maintained at the smart NIC for stateful inspection, then firewall functionality is enhanced, but the amount of information to be managed and synchronized increases
Solution Approach 1:
The smart NIC performs flow record maintenance and stateful inspection operations in advance, before traffic needs to be forwarded. By pre-evaluating rules and maintaining flow state locally, the device prepares traffic handling decisions beforehand, reducing the need for complex real-time synchronization with the host system.
Data Source
AI summary
Some embodiments provide a novel method for migrating virtual machines (VMs) from a first host computer to a second host computer. The first host computer is connected to a physical network interface card (PNIC) that performs middlebox service operations for flows associated with the VMs. At the PNIC, the method receives a notification that a VM is to be migrated from the first to the second host computer. The method configures an embedded hardware switch of the PNIC to forward a set of flows associated with the VM to a firewall of the PNIC. The embedded hardware switch was initially programmed to process the set of flows instead of the firewall. The method synchronizes flow cache information regarding the set of flows from the embedded hardware switch to the firewall. The method processes the set of flows at the firewall until the VM is migrated to the second host computer.