Virtual Bridge Packet Filtering for Virtual Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualized data centers, ensuring information isolation between virtual networks while reducing the burden on physical switches is challenging due to the need to process all traffic through switches, which degrades communication efficiency.
Innovation Solution
A method where a physical host uses a virtual bridge to discard network packets if the security domains of the source and target virtual machines differ, eliminating the need to send all traffic to a physical switch for processing by determining the security domains based on MAC addresses and applying appropriate forwarding or discarding controls.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all virtual machine traffic is sent to the physical switch for processing, then information isolation between virtual networks is ensured, but the burden on the physical switch is greatly aggravated
Solution Approach 1:
The patent segments the network traffic processing function by dividing traffic into two categories: traffic within the same security domain is processed locally by the virtual switch, while traffic between different security domains is forwarded to the physical switch. This segmentation reduces the processing burden on the physical switch while maintaining information isolation through security domain verification.
Solution Approach 2:
The patent introduces a security domain concept as an intermediary layer between virtual machines and the physical switch. The virtual switch acts as a mediator that performs preliminary security domain verification and filtering before forwarding traffic to the physical switch, thereby reducing the switch's processing burden while ensuring isolation.
2Reliability
If all virtual machine traffic is sent to the physical switch for processing, then network security control is maintained, but communication efficiency within virtual networks is degraded
Solution Approach 1:
The patent segments traffic handling paths based on security domain relationships. Intra-domain traffic is routed through the virtual switch for efficient local processing, while inter-domain traffic is forwarded to the physical switch. This segmentation improves communication efficiency for common intra-domain traffic while maintaining security control for inter-domain traffic.
Solution Approach 2:
The patent performs preliminary security domain verification and filtering at the virtual switch before traffic reaches the physical switch. This preliminary action eliminates the need for the physical switch to process all traffic, thereby improving communication efficiency while maintaining security control through advance verification.
3Productivity
If virtual machines share the same physical infrastructure, then working efficiency is improved, but information isolation between service systems becomes difficult to implement
Solution Approach 1:
The patent applies local quality by assigning different security domain attributes to different virtual machines on the same physical infrastructure. The virtual switch performs local security domain verification for each packet, allowing efficient resource sharing while maintaining information isolation through localized security enforcement at the virtual switch level.
Data Source
Figure 1a~1b
Figure 2
Figure 3A
AI summary
Embodiments of the present invention provide a method, an apparatus, a host, and a network system for processing a packet. The method includes: receiving, by a physical host through a virtual bridge in the physical host, a network packet sent by a source virtual machine in the physical host, where the network packet carries a source MAC address and a target MAC address; obtaining, by the physical host according to the source MAC address and the target MAC address by querying correspondence between each virtual machine MAC address and a security domain, a security domain to which the source virtual machine corresponds and a security domain to which a target virtual machine corresponds; and controlling, by the physical host, the virtual bridge to discard the network packet, when the security domain to which the source virtual machine corresponds is different from a security domain corresponding to the virtual bridge.