Virtual Network Pairs via User-Space Protocol Stack
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network protocols for virtual machines lack efficient methods to establish secure and scalable communication between virtual machines across different host machines without requiring kernel-level privileges and are vulnerable to security threats like kernel-level buffer overflows.
Innovation Solution
The implementation of a network protocol that encapsulates messages in the user process space, using hash-based message authentication codes and secret keys to establish virtual network pairs, allowing secure communication between virtual machines without kernel-level access, and enabling communication across disparate geographic networks without specialized physical network support.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If kernel-level privileges are used for network protocol implementation, then network communication security is improved, but system vulnerability to kernel-level attacks increases and system complexity increases
Solution Approach 1:
The patent introduces a user-space network protocol stack as an intermediary layer between applications and the kernel. This user-space protocol implementation handles network communication without requiring kernel-level privileges, thereby maintaining security while avoiding kernel vulnerabilities. The user-space stack acts as a mediator that performs authentication, encryption, and packet processing functions that traditionally required kernel access.
Solution Approach 2:
The patent extracts network protocol processing functions from the kernel space and relocates them to user space. By separating these functions, the system eliminates the need for kernel-level privileges in network communication, reducing the attack surface while maintaining the necessary security functions in a safer environment.
2Adaptability or versatility
If virtual network pairs are established across disparate geographic networks, then network versatility is improved, but network complexity increases
Solution Approach 1:
The patent implements a universal network protocol stack in user space that can operate across different geographic networks and hardware platforms. This user-space implementation provides multi-functional capabilities including authentication, encryption, packet routing, and protocol translation, allowing virtual machines to communicate across disparate networks without requiring network-specific customizations or increased physical infrastructure complexity.
3Ease of manufacture
If message encapsulation is performed in user process space, then ease of deployment is improved, but processing overhead increases
Solution Approach 1:
The patent performs message encapsulation and authentication preparations in advance within the user process space. By pre-processing messages, establishing security contexts, and preparing encapsulated formats before kernel interaction is needed, the system reduces the time required for actual message transmission while maintaining deployment simplicity. This preliminary action allows the majority of processing to occur in the faster user space.
Data Source
AI summary
Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for implementing virtual network pairs between virtual machines and other devices. In one aspect, a method includes associating each of a plurality of different virtual machine network addresses with a respective host machine network address; receiving, from a sender, a request for a source virtual machine to communicate with a destination virtual machine; determining that the source virtual machine is authorized to communicate with the destination virtual machine; selecting, from the associations, a host machine network address for the destination virtual machine; generating a token based at least partly on the selected host machine network address and on a secret key of the destination virtual machine, wherein the secret key is not known by the source virtual machine; and sending the selected host machine network address and generated token to the sender.