Virtual Switch Bypass for Host Data Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtual switch systems in datacenters incur processing overhead due to filtering all traffic, including trusted traffic from or destined for the host operating system, which can be optimized to improve network performance by bypassing unnecessary filtering operations.
Innovation Solution
Implementing a method to monitor data traffic through a virtual switch and designate traffic based on MAC addresses, directing virtual machine data traffic through a packet processor while allowing host data traffic to bypass the processor, thereby reducing processing time and resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all traffic is routed through the virtual switch for filtering and processing, then security and traffic control are improved, but processing time and system resources are consumed
Solution Approach 1:
The patent segments traffic into two categories: host data traffic and virtual machine data traffic. By segmenting traffic this way, the system can apply different processing paths to each type, allowing trusted host traffic to bypass the packet processor while still maintaining security filtering for virtual machine traffic.
Solution Approach 2:
The patent applies local quality by treating different traffic types differently based on their source and destination. Host data traffic (trusted) receives bypass treatment, while virtual machine data traffic (untrusted) receives full filtering processing. This localized differentiation optimizes performance for trusted traffic without compromising security for untrusted traffic.
2Reliability
If all traffic is processed by the packet processor, then security filtering is maintained, but system resources are consumed
Solution Approach 1:
The patent segments traffic into host data traffic and virtual machine data traffic, enabling selective processing. By segmenting traffic this way, the system can skip packet processing for trusted host traffic while maintaining security filtering for virtual machine traffic, thus reducing overall resource consumption.
Solution Approach 2:
The patent extracts trusted host data traffic from the general packet processing pipeline. By taking out host traffic that doesn't require filtering, the system reduces the processing burden on the packet processor and associated resources while maintaining security for virtual machine traffic.
3Reliability
If host data traffic is filtered like virtual machine traffic, then security is maintained, but network performance deteriorates
Solution Approach 1:
The patent applies local quality by differentiating treatment based on traffic trust level. Host data traffic (trusted) receives optimized bypass treatment for high performance, while virtual machine data traffic (untrusted) receives standard filtering treatment for security. This localized differentiation simultaneously optimizes both performance and security.
Solution Approach 2:
The patent introduces dynamic traffic classification and routing decisions based on the source and destination of data packets. The system dynamically determines whether traffic should bypass processing or undergo filtering based on real-time evaluation of MAC addresses and traffic patterns, optimizing performance without compromising security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method of communicating data traffic including data packets through a virtual switch on a host device is provided. The data traffic flowing through the virtual switch is monitored. The data traffic includes at least virtual machine data traffic flowing to and from virtual machine processes on the host device and host data traffic flowing to and from host operating system processes on the host device. Each of the data packets are designated as virtual machine data traffic or host data traffic based on an evaluation of the Media Access Controller (MAC) address of each of the one or more data packets of the monitored data traffic. Virtual machine data traffic is directed through a packet processor as the virtual machine data traffic traverses the virtual switch. Host data traffic is directed to bypass the packet processor as the host data traffic traverses the virtual switch.