VM Packet Flow Isolation via Tenant Identity Validation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Virtual machines running for different tenants on the same computer host often interfere with each other's packet flows due to inadequate separation of packet flows, leading to abnormal experimental results and interference in network traffic analysis.

Innovation Solution

Assigning virtual hardware addresses with tenant identities to virtual machines, and implementing a validation procedure to ensure that packets are only transmitted between virtual machines with matching tenant identities, preventing interference between different tenants' packet flows.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If multiple virtual machines from different tenants are run on the same computer host, then resource utilization is improved, but packet flow separation deteriorates causing interference between tenants

Engineering Contradiction:

Improveresource utilizationVSAvoidpacket flow separation

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent segments packet flows by inserting validation procedures at key points in the network communication path (host to virtual machine interfaces). These validation procedures check tenant identifiers in packet headers, effectively dividing the shared network resources into isolated tenant-specific channels while maintaining the ability to run multiple virtual machines on the same host.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The validation procedure acts as an intermediary between packet transmission and virtual machine reception. It examines packet headers containing tenant identifiers and decides whether to allow packet delivery based on tenant matching, thus mediating between the shared network infrastructure and individual virtual machine requirements.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of operation

If packet flows of virtual machines are not properly separated, then network communication simplicity is maintained, but measurement precision deteriorates due to wrong packets being captured

Engineering Contradiction:

Improvenetwork communication simplicityVSAvoidpacket capture accuracy

Core Design Contradiction:

Ease of operationVSMeasurement precision

Solution Approach 1:

The validation procedure provides feedback about packet legitimacy to the network communication system. By checking tenant identifiers and returning validation results, the system can selectively allow or block packets, ensuring that only authorized packets reach their intended virtual machines and preventing measurement errors from incorrect packets.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS8935696B2Communication method of virtual machines and server-end system

Publication Date: 2015.01.13 WIWYNN CORP

AI summary

A communication method of virtual machines and a server-end system are provided. A virtual hardware address is assigned to a virtual machine when the virtual machine are established, wherein the virtual hardware address includes a tenant identity. A validation procedure for a packet is performed when the virtual machine desires to communicate with another virtual machine by transmitting the packet, so as to determine whether the virtual hardware addresses of the source-end and the destination-end in the packet have the same tenant identity. If the both virtual hardware addresses have the same tenant identity, the packet is transmitted to the another virtual machine.