Virtual Switch Expedited Forwarding Bypasses Linux Bridge
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In public cloud scenarios, network security verification in LINUX bridges reduces data stream forwarding performance due to cache pollution caused by mode switching between kernel and user modes during data stream forwarding.
Innovation Solution
A data transfer method where a virtual switch bypasses security verification for data packets with expedited forwarding rules, reducing mode switching and improving efficiency by directly forwarding secure data packets without additional verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security verification is performed in the LINUX bridge for all data packets, then network security is improved, but data packet forwarding efficiency deteriorates due to mode switching between kernel and user modes
Solution Approach 1:
The patent segments data streams into two categories: those requiring security verification and those that can be forwarded directly. By creating an expedited forwarding path for trusted data streams, the system divides the forwarding process into regular paths (with verification) and expedited paths (without verification), thereby improving overall forwarding efficiency while maintaining security for necessary traffic
Solution Approach 2:
The patent performs preliminary security verification on data streams before they are forwarded. By verifying security characteristics in advance and caching the verification results, the system prepares trusted data streams for expedited forwarding, eliminating the need for repeated verification on subsequent packets of the same stream and thus improving efficiency
Data Source
AI summary
A data transfer method and a virtual switch, where when receiving a data packet, the virtual switch extracts characteristic information of the data packet, and determines, based on the extracted characteristic information of the data packet, whether an expedited forwarding rule is configured for a data stream to which the data packet belongs. If the expedited forwarding rule is configured for the data stream to which the data packet belongs, the virtual switch bypasses a LINUX bridge to directly send the data packet to a receive end, thereby reducing times of data packet switching between a kernel mode and a user mode, and improving data packet forwarding efficiency.