Virtual Input-Output Connections for Automated Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing machine virtualization systems face challenges in efficiently managing and enforcing policies across virtual and physical compute nodes, particularly in translating Virtual Input-Output Connections (VIOCs) into physical switch configurations, which can be complex and require manual intervention for changes in system configurations.
Innovation Solution
A method and system for defining and enforcing Virtual Input-Output Connections (VIOCs) by specifying source attributes, creating policies, and configuring physical packet switching elements to identify and act on data packets matching these attributes, using techniques such as Access Control Lists (ACLs) to automate policy enforcement and adapt to changes in system configurations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If VIOCs are translated into physical switch configurations manually, then policy enforcement can be achieved, but system complexity increases and manual intervention is required for changes
Solution Approach 1:
The system automatically translates VIOC policies into physical switch configurations without requiring manual intervention. The virtual switch autonomously generates and applies ACL rules to physical switches based on detected changes, enabling self-service configuration management and eliminating the need for manual translation of virtual to physical configurations.
Solution Approach 2:
The system continuously monitors physical and virtual system configurations for changes and automatically updates the translation between VIOC policies and physical switch configurations. This feedback mechanism ensures that policy enforcement remains effective despite system changes, resolving the contradiction between reliable policy enforcement and configuration complexity.
2Manufacturing precision
If manual intervention is used for configuration changes, then control precision is maintained, but productivity decreases due to time-consuming manual updates
Solution Approach 1:
The virtual switch automatically detects configuration changes and translates VIOC policy changes into physical switch configuration updates without manual intervention. This self-service capability maintains configuration accuracy while dramatically improving productivity by eliminating time-consuming manual update processes.
Solution Approach 2:
The system prepares and applies configuration changes proactively upon detecting VIOC policy changes, rather than waiting for manual intervention. This preliminary action approach ensures configuration accuracy is maintained while accelerating the update process, resolving the contradiction between precision and productivity.
3Ease of operation
If VIOCs are treated like physical switch ports, then ease of operation improves, but device complexity increases due to virtual-physical translation requirements
Solution Approach 1:
The virtual switch acts as an intermediary layer that translates VIOC policies into physical switch configurations. This intermediary abstraction allows users to manage VIOCs with the simplicity of physical switch ports while the underlying virtual-physical translation complexity is encapsulated within the virtual switch, resolving the contradiction between ease of operation and device complexity.
Data Source
AI summary
A computing method includes specifying a virtual computer system including at least one virtual or physical compute node, which produces data packets having respective source attributes. At least one Virtual Input-Output Connection (VIOC) that is uniquely associated with the values of the source attributes is defined. A policy specifying an operation to be performed with regard to the VIOC is defined. The virtual computer system is implemented on a physical computer system, which includes at least one physical packet switching element. The physical packet switching element is configured to identify the data packets whose source attributes have the values that are associated with the VIOC and to perform the operation on the identified data packets, so as to enforce the policy on the VIOC.