Virtualized Secure Networking via Bridge Driver
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure networking architectures require additional hardware resources when implementing secure communications between virtualized operating systems, and they lack flexibility in adapting to different network topologies without modifying guest OS configurations.
Innovation Solution
A data processing system that utilizes a virtualized hardware platform with a Network Interface Controller (NIC) managed by a trusted OS, which includes a Virtual Machine Monitor (VMM) to enable concurrent operation of multiple OS instances and emulate virtual networks, allowing secure and transparent bridging between physical and virtual networks using a single NIC, thereby optimizing hardware resources and facilitating flexible network configurations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If different NICs are used for secure and transparent communications, then communication security is improved, but hardware resource consumption increases
Solution Approach 1:
The patent segments the network interface functionality by implementing separate virtual network interface controllers (VNICs) for secure and transparent communications within the virtualized environment. Each VNIC can be configured with appropriate security protocols (IPsec) while sharing the physical NIC hardware, thus maintaining security requirements without duplicating physical hardware resources.
Solution Approach 2:
The patent introduces a bridge driver as an intermediary component that manages communication between the physical NIC and virtual networks. The bridge driver handles security protocol processing and packet forwarding, enabling secure and transparent communications to share the same physical NIC while maintaining security boundaries through software-based mediation.
2Reliability
If secure networking is implemented in virtualized environments, then data confidentiality and integrity are improved, but system complexity increases
Solution Approach 1:
The patent implements a universal bridge driver that can handle multiple functions including secure packet forwarding, transparent bridging, and IPsec protocol processing. This multi-functional component reduces system complexity by consolidating security and networking functions into a single manageable interface that works across different virtual network configurations.
Solution Approach 2:
The patent uses virtual network interface controllers (VNICs) as software copies of physical NIC functionality. These virtual interfaces replicate the capabilities needed for secure communication while operating in the virtualized environment, allowing security protocols to be applied to virtual networks without requiring modifications to the physical hardware or guest operating systems.
3Reliability
If IPsec protocols are applied to virtual networks, then communication security is improved, but network configuration flexibility decreases
Solution Approach 1:
The patent implements dynamic security configuration where IPsec protocols can be selectively applied to different virtual networks and VNICs based on communication requirements. The bridge driver dynamically determines whether to apply security protocols to each packet flow, allowing transparent networks to remain unsecured while secure networks use IPsec, thus maintaining both security and configuration flexibility.
Solution Approach 2:
The patent applies security protocols locally to specific virtual networks and communication paths rather than universally to all traffic. Each VNIC and virtual network can be independently configured with or without IPsec protection, allowing localized security application that maintains overall system flexibility and adapts to specific communication requirements.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention provides a data processing system for the support of secure networking on a single, virtualized hardware platform. The data processing system comprises a Network Interface Controller NIC to control access to a physical network; a first operating system comprising an NIC driver to manage the NIC, and a first Virtual Network Interface Controller VNIC driver. The system further comprises at least one second operating system comprising at least one second VNIC driver associated with a networking stack; and a Virtual Machine Monitor VMM to enable concurrent operation of the first and second operating systems, and to emulate a virtual network, the VMM comprising first and second VNICs to provide access to the virtual network by the first and second operating systems through the first and second VNIC drivers, respectively. The first operating system further comprises a bridge driver inbetween the NIC driver and the first VNIC driver to manage the connection between the physical network and the virtual network.