Virtual NIC Network Redirection for VDI Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtual machine networking technologies often expose virtual machine network traffic to the local network of the datacenter, introducing security issues and interference with local network operations, and require additional resources for remote virtual desktop infrastructure (VDI) connections.
Innovation Solution
A system and method for seamlessly redirecting network data between a client and a remote server using a communication channel, where a virtual network interface controller (NIC) on the server emulates access to a physical local area network, detecting guest network packets and transmitting them to the client without injecting them into the local area network, using packet injection layers on both the server and client sides to keep the server-side local network isolated.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If virtual machine network traffic is exposed to the datacenter's local network, then network communication functionality is improved, but network security and isolation are worsened
Solution Approach 1:
The patent introduces an intermediary mechanism (virtual network interface controller and packet injection layer) that mediates between the virtual machine's network traffic and the physical network. This intermediary captures packets at the virtual NIC level and redirects them through a controlled path to the client device, preventing direct exposure to the datacenter's local network while maintaining full network communication functionality.
2Ease of operation
If traditional remote VDI connection methods are used, then remote access capability is improved, but resource requirements and system complexity are worsened
Solution Approach 1:
The patent merges the network redirection functionality directly into the existing RDP communication channel between client and server. By integrating the virtual network interface controller and packet injection layer into the existing RDP infrastructure, the system achieves remote network access without requiring separate control points or additional communication channels, thereby reducing overall system complexity.
3Object-affected harmful factors
If virtual machine networking is isolated to client side, then network security is improved, but network access functionality is worsened
Solution Approach 1:
The patent resolves this contradiction by operating at a different layer of the network stack. Instead of isolating traffic at the network layer (which would block access), the solution implements isolation at the virtual NIC/driver layer while maintaining full network layer functionality through the RDP channel. This dimensional shift allows simultaneous achievement of security isolation and access functionality.
Data Source
AI summary
Disclosed are systems and methods for seamlessly redirecting network data between a client and a remote server. In one exemplary aspect, the method comprises receiving, at a remote server, the network data via a first remote desktop protocol (RDP) channel, wherein the network data is encapsulated and transmitted by a client device configured to communicate with the remote server. The method further comprises replacing a MAC address listed in the network data with a MAC address of a logical network adapter on the remote server, and placing received network packets into a network driver of the logical network adapter, wherein the logical network adapter transfers received data in an operating system of the remote server such that a server-side application on the remote server receives network packets from the client device.