VM Network Packet Segmentation for Secure DMA

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Virtual machine queue (VMQ) technology enables direct memory access (DMA) of incoming network frames to a virtual machine's (VM) memory, posing a security risk as a malicious VM can modify packet contents, potentially launching denial of service attacks or monitoring unintended traffic, especially when VLAN IDs are configured.

Innovation Solution

A computing system divides incoming network packets into two portions, with the first portion processed by the host OS and then copied to the VM OS, while the second portion is directly DMAed to the VM OS memory, ensuring secure processing and preventing unauthorized access to packet data.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If VMQ technology is enabled to allow direct DMA access of incoming frames to VM memory, then processing efficiency is improved by avoiding host memory copies, but security is worsened as malicious VMs can modify packet contents and launch attacks

Engineering Contradiction:

Improvenetwork packet processing efficiencyVSAvoidnetwork security

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The packet processing function is segmented between host OS and VM OS. The host OS retains control over the first portion of packets requiring security processing, while the VM OS receives the second portion directly via DMA. This segmentation allows efficient direct memory access for appropriate packets while maintaining security control for packets requiring inspection.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The virtual switch driver acts as an intermediary between the hardware NIC and VM networking stack. It manages the VMQ receive queues, determines which packets can be directly DMAed to VM memory versus which require host processing first, and coordinates the packet routing between host and VM memory spaces.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If VLAN ID filtering is configured on VM NIC to monitor traffic, then network monitoring capability is improved, but security is worsened as malicious VMs can monitor traffic on different VLANs

Engineering Contradiction:

Improvenetwork traffic monitoring capabilityVSAvoidunauthorized traffic monitoring

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary security processing of packet headers in the host OS before DMAing data portions to VMs. This preliminary action includes validating VLAN IDs and checking packet legitimacy, preventing malicious VMs from accessing or monitoring traffic on VLANs they should not access.

Inventive Principle:

Principle #9Preliminary anti-action

Solution Approach 2:

The host OS performs preliminary processing of the first portion of packets (including VLAN ID validation and security checks) before the VM OS processes the second portion. This preliminary action ensures that only authenticated and properly routed packets are made accessible to VMs, preventing unauthorized VLAN monitoring.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If the virtual switch driver processes all packets through host memory, then security is improved by maintaining control, but processing efficiency is worsened due to additional copy operations

Engineering Contradiction:

Improvepacket processing securityVSAvoidpacket processing throughput

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The packet data is segmented into two portions: the first portion (headers requiring security processing) is handled through host memory via virtual switch driver, while the second portion (data payload) is directly DMAed to VM memory. This segmentation reduces unnecessary copy operations for packets that don't require deep host processing.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Instead of processing entire packets through host memory, the system applies partial processing only to the necessary first portion of packets that require security validation. The remaining second portion is handled directly by VMs via DMA, avoiding excessive host processing overhead while maintaining security for critical packet portions.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS7966620B2Secure network optimizations when receiving data directly in a virtual machine's memory address space

Publication Date: 2011.06.21 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

Techniques are disclosed for increasing the security of a system where incoming network packets are directly placed into the memory space of a virtual machine (VM) operating system (OS) running on the system via direct memory access (DMA). In an embodiment, each packet is split into a first portion, which requires further processing, and a second portion, which may be immediately placed into the VM OS's memory address space. When the host OS running on the system completes processing the first portion, it places it directly before the second portion in the VM OS memory space and indicates to the VM OS that a packet is available. Techniques are further disclosed that mitigate the security risk in such systems related to VLAN ID configuration.