Communication of data between virtual processes

Patent metadata

Field	Value
Publication number	US-11500699-B2
Application number	US-201916256171-A
Country	US
Kind code	B2
Filing date	Jan 24, 2019
Priority date	Jan 24, 2019
Publication date	Nov 15, 2022
Grant date	Nov 15, 2022

Abstract

An interface module in a user space intercepts a call from a first virtual process, the call to cause communication of data from the first virtual process to a second virtual process. The interface module accesses mapping information to redirect the communication of data to the second virtual process without passing through the protocol stack of a kernel, the mapping information comprising entries each including network addresses used in identifying a respective connection between corresponding virtual processes.

First claim

What is claimed is:

1. A computer system comprising:
a processor;
a system kernel; and
a non-transitory memory device storing instructions that when executed by the processor cause the computer system to facilitate an interface module in a user space and executable on the processor to:
intercept a call from a first virtual process, wherein the call forwards a data packet from the first virtual process to a second virtual process, wherein the first and second virtual processes operate on the computer system;
access mapping information comprising one or more entries, wherein a respective entry includes a mapping between network addresses used in identifying a respective connection between corresponding virtual processes; and
in response to determining that the call does not relate to a function to be implemented by the system kernel, redirect the data packet from the first virtual process to the second virtual process using the mapping information instead of traversing a network protocol stack of the computer system wherein the system kernel includes a protocol stack that facilitates network communications between processes.

2. The computer system of claim 1 , wherein the interface module comprises a wrapper of a library of routines.

3. The computer system of claim 1 , wherein data communication between the first and second virtual processes comprises an inter-process communication.

4. The computer system of claim 1 , wherein the interface module is executable on the processor to: modify the mapping information for a new connection between virtual processes.

5. The computer system of claim 4 , wherein the interface module is executable on the processor to modify the mapping information by:
receiving information associated with establishment of the new connection, and
adding the information for the new connection in an entry of the mapping information.

6. The computer system of claim 5 , wherein the information relating to the establishment of the new connection comprises a first network address and a first network port of one virtual process, and a second network address and a second network port of another virtual process.

7. The computer system of claim 1 , wherein the interface module is executable on the processor to:
intercept a second call from a virtual process;
determine whether the second call relates to the function to be implemented by the system kernel; and
responsive to determining that the second call relates to the function to be implemented by the system kernel, allow the second call to pass to the system kernel for processing by the system kernel.

8. The computer system of claim 7 , wherein the function to be implemented by the system kernel comprises a security function.

9. The computer system of claim 1 , wherein the interface module is executable on the processor to: allow a second call from a virtual process to pass to the system kernel, and create an entry of the mapping information using information received based on information provided by the system kernel in processing the second call.

10. The computer system of claim 1 , wherein the first and second virtual processes comprise virtual network functions.

11. The computer system of claim 1 , wherein the protocol stack comprises a Transmission Control Protocol/Internet Protocol (TCP/IP) stack.

12. A non-transitory machine-readable storage medium comprising instructions that upon execution cause a processor of a computer system to:
maintain a system kernel in a kernel space of the computer system;
intercept, by an interface module in a user space of the computer system, a call from a first virtual process, wherein the call forwards a data packet from the first virtual process to a second virtual process, wherein the first and second virtual processes operate on the computer system;
access, by the interface module, mapping information comprising one or more entries, wherein a respective entry includes a mapping between network addresses useable to communicate over a connection between virtual processes; and
in response to determining that the call does not relate to a function to be implemented by the system kernel, redirect, by the interface module, the data packet from the first virtual process to the second virtual process using the mapping information instead of traversing a protocol stack of the computer system, wherein the system kernel includes a protocol stack that facilitates network communications between processes.

13. The non-transitory machine-readable storage medium of claim 12 , wherein the redirecting of the data packet from the first virtual process to the second virtual process avoids the kernel space.

14. The non-transitory machine-readable storage medium of claim 12 , wherein the instructions upon execution cause the processor further to add an entry to the mapping information in response to detecting a new connection between the first and second virtual processes, wherein detecting the new connection comprises: receiving, from the first virtual process, a call to open a socket; receiving, from the second virtual process, a call to connect to the socket; and obtaining information associated with the call to open the socket and the call to connect to the socket to add information to the added entry.

15. The non-transitory machine-readable storage medium of claim 12 , wherein the network addresses in the entry comprises a network address of one of the virtual processes, and a network address of another of the virtual processes.

16. The non-transitory machine-readable storage medium of claim 12 , wherein the entry comprises a network address and a network port of one of the virtual processes, a network address and a network port of another of the virtual processes, and information of a protocol used for the connection.

17. The non-transitory machine-readable storage medium of claim 12 , wherein the instructions upon execution cause the processor further to:
determine whether a second call from a virtual process relates to the function to be implemented by the system kernel, and
responsive to determining that the second call relates to the function to be implemented by the system kernel, allow the second call to pass to the system kernel for processing by the system kernel.

18. A method comprising:
maintaining a system kernel in a kernel space of a computer system;
intercepting, by an interface module in a user space of the computer system comprising a hardware processor, a call from a first virtual process;
determining, by the interface module, that the call forwards a data packet from the first virtual process to a second virtual process, wherein the first and second virtual processes operate on the computer system;
accessing, by the interface module, mapping information comprising one or more entries, wherein a respective entry includes a mapping between network addresses used in identifying a respective connection between corresponding virtual processes; and
in response to determining that the call does not relate to a function to be implemented by the system kernel, redirecting the data packet from the first virtual process to the second virtual process using the mapping information instead of traversing a network protocol stack of the computer system, wherein the computer system supports a system kernel that includes a protocol stack facilitating network communications between processes.

19. The method of claim 18 , wherein redirecting of the data packet further comprises:
determining whether a second call from a virtual proc

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• Sethi Aseem
• Denny Mark Andrew

Classifications

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• G06F2009/45595

  Network integration; Enabling network access in virtual machine instances · CPC title

• G06F9/545 Primary

  where tasks reside in different layers, e.g. user- and kernel-space · CPC title