Virtual Machine Packet Flow Classification via Segmented Policy Databases
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualized systems, the efficiency of packet flow classification decreases exponentially with the number of policy entries in the database, and updating the database requires regenerating the RFC table, which is slow and proportional to the number of entries, leading to inefficiencies and conflicts in packet processing rules across virtual machines.
Innovation Solution
Each virtual machine has its own policy database and lookup mechanism, allowing independent updates and lookups without affecting other virtual machines, and using a network processor with micro engines and a packet classifier to direct packets to the appropriate policy database based on the incoming interface, employing algorithms like Recursive Flow Classification for efficient packet processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single shared policy database is used for all virtual machines, then device complexity is reduced, but lookup efficiency decreases exponentially as the number of policy entries increases
Solution Approach 1:
The patent divides the single shared policy database into multiple separate policy databases, with each virtual machine having its own dedicated policy database. This segmentation allows each VM to independently manage its policy entries without affecting other VMs, thereby maintaining lookup efficiency even as the total number of policy entries across the system increases. The network processor routes packets to the appropriate VM-specific database based on the incoming interface, enabling parallel independent lookups.
2Reliability
If the policy database is updated by regenerating the RFC table, then data consistency is maintained, but the update time increases proportionally to the number of policy entries
Solution Approach 1:
By segmenting the policy database into VM-specific databases, the patent enables independent updates for each virtual machine. When a policy entry needs to be updated, only the affected VM's policy database and its associated RFC table need to be regenerated, rather than regenerating the entire RFC table for all VMs. This significantly reduces the update time proportional to the number of policy entries while maintaining data consistency through the virtual machine monitor's arbitration mechanism.
3Device complexity
If a single policy database is shared among multiple virtual machines, then device complexity is reduced, but conflicts in packet processing rules arise
Solution Approach 1:
The patent assigns a separate policy database to each virtual machine, eliminating the possibility of rule conflicts between VMs. Each VM's policy database contains only its own packet processing rules, and the network processor uses the incoming interface to direct packets to the correct VM-specific database. This segmentation approach, combined with the virtual machine monitor's arbitration, ensures that each VM executes its own rules without interference, resolving conflicts while maintaining manageable system complexity.
Data Source
AI summary
A computer system having a plurality of virtual machines is provided. Each virtual machine in the computer system has an associated policy (rules) database and database (policy table) for storing rules and a database lookup associated with the policy database. One policy database/database lookup pair per virtual machine allows each virtual machine to have a different set of packet processing rules and security policies for handling the same key. In addition, the policy database associated with one virtual machine may be updated and the database lookup associated with the policy database re-generated independently without requiring any update of the policy database lookups associated with any of the other policy databases in the computer system.