Virtual NIC MAC Address Isolation via Hardware Receive Rings
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computer systems with multiple concurrently executing operating systems, existing technologies fail to effectively isolate network traffic destined for each operating system when using advanced network interface cards (NICs) with multiple MAC addresses.
Innovation Solution
A method and system that manage guest operating systems by using a host operating system to receive and configure MAC addresses for virtual network interface cards (VNICs), forwarding packets through an intermediate VNIC to a physical NIC, and configuring a classifier to direct packets to appropriate hardware receive rings, allowing for isolation of network traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a system uses multiple concurrently executing operating systems with advanced NICs configured with multiple MAC addresses, then the system can handle multiple network identities, but the system cannot isolate network traffic destined to the various concurrently executing operating systems
Solution Approach 1:
The patent segments network traffic handling by creating separate hardware receive rings (HRRs) for different guest operating systems. Each HRR is dedicated to receiving packets for a specific guest OS, allowing the NIC to physically separate traffic streams that would otherwise be mixed. This segmentation enables multiple MAC addresses to coexist while maintaining isolation between guest OSes.
Solution Approach 2:
The patent introduces an intermediate software layer (virtual switch or network driver) that acts as a mediator between the NIC and guest operating systems. This intermediary receives packets from the NIC, examines destination MAC addresses, and routes packets to the appropriate guest OS. It also manages the mapping between MAC addresses and HRRs, enabling traffic isolation without requiring each guest OS to directly interface with the physical NIC.
2Productivity
If packets are received by a single hardware receive ring, then the NIC structure is simple, but packets for multiple guest operating systems cannot be properly separated and delivered
Solution Approach 1:
The patent divides the single HRR into multiple separate HRRs, with each HRR dedicated to a specific guest operating system. This segmentation allows the NIC to maintain simple, dedicated receive buffers for each guest OS, improving packet delivery efficiency while the added complexity is managed at the software layer through automated HRR selection based on destination MAC address.
3Reliability
If the system uses traditional single NIC configuration, then network traffic isolation is straightforward, but the system cannot support multiple MAC addresses for virtual machines
Solution Approach 1:
The patent makes the NIC and its HRRs universal by enabling them to serve multiple guest operating systems simultaneously. Instead of dedicating separate physical NICs to each guest OS, the system configures the NIC with multiple MAC addresses and uses software-based routing to direct traffic to appropriate guests. This multi-functionality allows a single NIC to replace multiple physical interfaces while maintaining isolation.
Solution Approach 2:
The intermediate software layer acts as a universal translator and router that enables the NIC to support multiple MAC addresses and multiple guest OSes. It maintains mappings between MAC addresses, guest OS identifiers, and HRRs, allowing the system to achieve traditional traffic isolation semantics while supporting modern virtualization requirements for multiple network identities.
Data Source
AI summary
A method for managing a guest OS executing on a host. The method includes receiving, from the guest OS associated with a first MAC address, a second MAC address, wherein the first MAC address is associated with a first guest VNIC, wherein the second MAC address is associated with a second guest VNIC; configuring an intermediate VNIC executing on the host OS to forward packets associated with the second MAC address to the guest OS, wherein packets associated with the first MAC address and received by the intermediate VNIC are forwarded to the guest OS; and forwarding the second MAC address from the intermediate VNIC to a device driver associated with a physical NIC, wherein the device driver configures a classifier on the physical NIC to forward packets associated with the second MAC address to a first HRR located on the physical NIC associated with the intermediate VNIC.