Virtual NIC Packet Authorization for Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user-level transport libraries for network interfaces lack trust and integrity, as they bypass kernel routines, increasing the risk of transmitting malformed or malicious data packets due to the lack of authorization and control mechanisms.
Innovation Solution
A network interface device is programmed to authorize data packets based on their characteristics, such as transport protocol, port numbers, and IP addresses, ensuring that only authorized processes can transmit data, thereby protecting the system from compromised data transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If user-level transport libraries bypass kernel routines to improve performance, then network transmission speed is improved, but security and data integrity deteriorate due to lack of authorization control
Solution Approach 1:
The patent introduces a virtual network interface card (VNIC) driver as an intermediary layer between user-level transport libraries and the physical network interface card. The VNIC driver receives packets from user-level libraries, validates their authorization based on pre-configured security policies, and forwards authorized packets to the physical NIC. This mediator approach allows user-level libraries to operate independently without kernel routine dependencies while maintaining security controls, thus preserving both transmission speed and data integrity.
2Reliability
If kernel routines are used to control packet transmission to ensure security, then data integrity is improved, but system complexity and processing overhead increase
Solution Approach 1:
The patent implements self-service security validation by configuring the VNIC driver with pre-defined authorization policies and packet filtering rules during system initialization. The VNIC driver then autonomously validates outgoing packets against these pre-configured rules without requiring real-time kernel intervention or complex security decision-making processes. This self-service approach maintains strong security controls while minimizing system complexity and processing overhead during actual packet transmission.
3Ease of operation
If user-level libraries have direct access to network interface devices, then ease of operation is improved, but the risk of transmitting malformed or malicious packets increases
Solution Approach 1:
The patent applies preliminary action by pre-configuring the VNIC driver with security policies, authorization rules, and packet validation criteria before user-level libraries begin transmission operations. The VNIC driver is pre-loaded with filtering rules that define which packet types, protocols, and data patterns are authorized for transmission. This preliminary configuration enables the VNIC driver to automatically block malformed or malicious packets at the point of transmission without requiring complex real-time analysis, thus maintaining ease of operation while preventing harmful transmissions.
Data Source
Figure 1
Figure 2
Figure 2A
AI summary
Roughly described, a network interface device receiving data packets from a computing device for transmission onto a network, the data packets having a certain characteristic, transmits the packet only if the sending queue has authority to send packets having that characteristic. The data packet characteristics can include transport protocol number, source and destination port numbers, source and destination IP addresses, for example. Authorizations can be programmed into the NIC by a kernel routine upon establishment of the transmit queue, based on the privilege level of the process for which the queue is being established. In this way, a user process can use an untrusted user-level protocol stack to initiate data transmission onto the network, while the NIC protects the remainder of the system or network from certain kinds of compromise.