Intercepting Virtual Switch Traffic via VLAN Trunks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computing environments with virtualized resources, intercepting and filtering network traffic routed by virtual switches for selective security services is challenging due to the complexity of managing traffic across virtual local area networks (VLANs) and trunk groups, which often results in processing irrelevant traffic, leading to inefficiencies in security operations.
Innovation Solution
Implementing an interface microservice that intercepts and filters network traffic by creating intercept VLANs, mapping original VLANs to intercept VLANs, and adding them to a VLAN trunk, allowing for transparent interception and filtering of network packets, enabling targeted security operations without affecting outside devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security processing is performed on all trunk group traffic, then security coverage is improved, but processing efficiency deteriorates due to handling irrelevant traffic from multiple VMs
Solution Approach 1:
The patent segments the network traffic processing by creating separate intercept VLANs for different port groups and VMs. Instead of processing all trunk group traffic uniformly, the system divides traffic into distinct segments that can be selectively intercepted and processed based on security requirements, allowing efficient handling of only relevant traffic while maintaining comprehensive security coverage.
Solution Approach 2:
The patent applies local quality by enabling selective security processing on specific VMs and port groups rather than uniformly processing all traffic. The system configures packet filters and intercept rules tailored to individual security needs of different VMs, allowing security operations to be applied only where necessary, thus improving processing efficiency while maintaining security coverage.
2Measurement precision
If intercept VLANs and packet filters are configured for each VM, then security precision is improved, but system complexity increases
Solution Approach 1:
The patent applies universality by creating a standardized intercept VLAN framework that can be reused across multiple VMs and port groups. Instead of configuring completely separate security mechanisms for each VM, the system uses a universal intercept VLAN structure with configurable packet filters that can be applied consistently across different security contexts, reducing overall system complexity while maintaining precise security control.
Solution Approach 2:
The patent introduces intercept VLANs as intermediary structures between the vSwitch and security processing components. These intercept VLANs act as mediators that simplify the configuration process by providing a standardized interface for traffic interception, while the underlying packet filter rules maintain the precision needed for specific VM security requirements, thus balancing complexity and precision.
3Reliability
If all network traffic is routed through security application, then security monitoring is improved, but processing overhead increases due to irrelevant traffic
Solution Approach 1:
The patent applies partial action by routing only specific traffic that requires security monitoring through the security application, rather than forcing all network traffic through it. The system uses packet filters and intercept VLAN configurations to identify and selectively route only relevant traffic streams to security processing, thereby reducing processing overhead while maintaining effective security monitoring for critical traffic.
Solution Approach 2:
The patent extracts relevant traffic from the general traffic flow by using packet filters and intercept rules to identify and separate traffic that requires security processing. This extraction mechanism allows the security application to focus only on necessary traffic streams, reducing processing overhead from irrelevant traffic while maintaining comprehensive security monitoring for identified threats.
Data Source
AI summary
Systems, methods, and apparatuses enable an interface microservice to intercept and filter network traffic generated by virtual machines (VMs) and routed by a virtual switch (vSwitch). A vSwitch receiving network packets from the VMs is configured to route network packets to the interface microservice via a generated VLAN trunk. The interface microservice can retrieve and apply stored packet filters to the network packets intercepted by the microservice. If an intercepted network packet matches any of the applied packet filters, the interface microservice can perform various security operations, send the network packets to another microservice for security processing, or perform any other operations. For network packets which do not match a packet filter, the interface microservice forwards the packets to the originally intended destination.