Virtual Switch Offload Processing Block for Cryptography
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computer systems with virtual machines, the overhead of specific function processing, such as cryptography, in management software increases due to the inability to execute decryption or other functions, leading to reduced processing efficiency.
Innovation Solution
Implementing an offload processing block within the virtual switch that can perform specific function processing, such as cryptography, by receiving processing information from the virtual machine and executing it, thereby relocating the processing from the virtual machine to the management block.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If each virtual machine performs cryptography processing individually, then communication security is improved, but processing overhead increases and efficiency deteriorates
Solution Approach 1:
The patent merges the cryptography processing function from individual virtual machines into a centralized management block (virtual switch). Multiple virtual machines share a common cryptography processing resource in the management block, eliminating redundant processing and improving overall system efficiency while maintaining security through centralized control.
Solution Approach 2:
The management block is designed with universal cryptography processing capability that can serve multiple virtual machines simultaneously. The offload processing block in the virtual switch provides multi-functional support for various cryptography operations (encryption, decryption, authentication) for different virtual machines, reducing per-VM overhead.
2Adaptability or versatility
If management software executes filtering processing on encrypted packets, then filtering capability is maintained, but decryption overhead increases processing time
Solution Approach 1:
Instead of decrypting packets first and then filtering (traditional approach), the patent inverts the sequence by performing filtering on encrypted packets directly. The offload processing block in the virtual switch filters packets based on encrypted content patterns without requiring decryption, maintaining filtering capability while eliminating decryption overhead.
3Speed
If cryptography processing accelerator is installed in physical machine, then cryptography speed is improved, but scheduling complexity and access control requirements increase
Solution Approach 1:
The virtual switch acts as an intermediary between virtual machines and the cryptography processing accelerator. The offload processing block in the virtual switch manages all interactions with the accelerator, handling scheduling and access control centrally. This shields virtual machines from complexity while utilizing the accelerator's high-speed capabilities through the virtual switch's coordinated management.
Data Source
AI summary
A computer system has: a virtual machine operating on a physical machine; and a management block operating on the physical machine and managing the virtual machine. The virtual machine has a specific function processing module that performs specific function processing with respect to a packet for transmission and a received packet. The management block has a virtual switch that relays a packet transmitted and received by the virtual machine. The virtual switch has an offload processing block that performs the specific function processing if the specific function processing is offloaded to the management block. If the specific function processing is offloaded from the virtual machine to the management block, the specific function processing module notifies the management block of processing information required for the specific function processing, and the offload processing block executes the specific function processing based on the processing information received from the virtual machine.