Virtual Ethernet Data Plane for XDP Security Service Chaining
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity network products in cloud deployments lack the ability to customize security policies and services without modifying the operating system, leading to less effective security solutions.
Innovation Solution
A data plane framework using virtual ethernet (veth) pairs and express datapath (XDP) programs allows traffic redirection to customized network services in userspace and kernel space, maintaining performance without modifying the Linux kernel.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the operating system is customized to share information with data inspection engines, then security policy granularity and effectiveness improve, but system complexity and deployment flexibility deteriorate
Solution Approach 1:
The patent introduces virtual ethernet device pairs as intermediary components that bridge the network stack and data inspection engines. These virtual devices enable information sharing and traffic redirection without requiring operating system customization, thus maintaining security effectiveness while avoiding system complexity.
Solution Approach 2:
The patent segments the network processing function by separating the data plane (virtual ethernet devices for traffic redirection) from the control plane (inspection engines for security policies). This segmentation allows independent deployment and configuration of security services without modifying the operating system kernel.
2Ease of operation
If an unmodified operating system kernel is used, then deployment flexibility and ease of operation improve, but the ability to redirect traffic to customized network services deteriorates
Solution Approach 1:
The patent adds a virtualization dimension to the network architecture by introducing virtual ethernet device pairs that operate at the network layer. This dimensional addition enables traffic redirection and service chaining capabilities without requiring modifications to the underlying operating system kernel.
Solution Approach 2:
The virtual ethernet device pairs serve multiple functions including traffic interception, redirection to various inspection engines, and service chaining. This multi-functionality provides adaptability and versatility for different security scenarios while maintaining compatibility with unmodified operating systems.
3Reliability
If traffic is redirected to multiple security services, then security coverage and reliability improve, but processing time and system complexity deteriorate
Solution Approach 1:
The patent performs preliminary classification and routing decisions at the virtual ethernet device pair level before traffic reaches inspection engines. By pre-determining which security services need to process each packet and in what sequence, the system avoids unnecessary processing delays while maintaining comprehensive security coverage.
Solution Approach 2:
The patent implements dynamic service chaining where the sequence and selection of inspection engines are adjusted based on traffic characteristics, security policies, and current system state. This dynamic approach optimizes processing time by adapting the inspection pipeline to each packet's specific requirements rather than applying a fixed sequential processing model.
Data Source
AI summary
A method for redirecting data packets includes receiving, by a first virtual ethernet device pair of a computer system having one or more computer processors, at least one data packet, intercepting, by a packet filter deployed by the first virtual ethernet device pair, the at least one data packet, redirecting, by the first virtual ethernet device pair based on the intercepting, the at least one data packet to a second virtual ethernet device pair, executing, by the second virtual ethernet device pair, an express data path data security program on the at least one data packet, and after the express data path security program has been executed on the at least one data packet, redirecting the at least one data packet back to the first virtual ethernet pair. Further disclosed is a computer system and computer program product configured to perform the method.