Congestion control enforcement in a virtualized environment
View Patent ↗In a data network congestion control in a virtualized environment is enforced in packet flows to and from virtual machines in a host. A hypervisor and network interface hardware in the host are trusted components. Enforcement comprises estimating congestion states in the data network attributable to respective packet flows, recognizing a new packet that belongs to one of the data packet flows, and using one or more of the trusted components and to make a determination based on the congestion states that the new packet belongs to a congestion-producing packet flow. A congestion-control policy is applied by one or more of the trusted components to the new packet responsively to the determination.
1. A method for communication, comprising the steps of:
supporting a plurality of virtual machines in a host, wherein the host comprises a hypervisor, and network interface hardware, the hypervisor and the network interface hardware being trusted components;
communicating data packet flows to and from the virtual machines over a data network via the network interface hardware;
estimating congestion states in the data network attributable to respective packet flows;
recognizing a new packet that belongs to one of the data packet flows;
making a determination based on the congestion states that the new packet belongs to a congestion-producing packet flow; and
applying a congestion-control policy to the new packet responsively to the determination, wherein the steps of making a determination and applying a congestion-control policy are performed by one or more of the trusted components, and wherein applying a congestion-control policy comprises sending a congestion-notification message to a source of the new packet, transmission of the congestion-notification message being delayed according to a class-based delay interval.
2. The method according to claim 1 , wherein applying a congestion-control policy is performed by the hypervisor.
3. The method according to claim 1 , wherein applying a congestion-control policy is performed by the network interface hardware.
4. The method according to claim 1 , wherein the congestion-notification message comprises a coalescence of a plurality of congestion-notification messages.
5. The method according to claim 1 , further comprising sending a second congestion-notification message only after elapse of a predetermined time interval after sending a first congestion-notification message.
6. The method according to claim 1 , further comprising the steps of:
recognizing a failure of the new packet to arrive within a predetermined time interval; and
updating the congestion states using one or more of the trusted components responsively to recognizing a failure.
7. The method according to claim 1 , wherein the new packet originates from one of the virtual machines, and wherein applying a congestion-control policy comprises delaying the new packet according to the congestion state attributable to the packet flow thereof.
8. The method according to claim 1 , wherein the new packet originates from one of the virtual machines, and wherein applying a congestion-control policy comprises imposing a rate limitation.
9. The method according to claim 1 , wherein the new packet originates from one of the virtual machines, and wherein applying a congestion-control policy comprises modifying a content of the new packet.
10. The method according to claim 1 , wherein the new packet originates from one of the virtual machines, and wherein applying a congestion-control policy comprises determining that the new packet is outside a congestion window, and thereafter dropping the new packet.
11. The method according to claim 1 , wherein the new packet originates from one of the virtual machines, and wherein applying a congestion-control policy comprises determining that the new packet is outside a congestion window, and thereafter delaying transmission of the new packet until the new packet is no longer outside the congestion window.
12. The method according to claim 1 , further comprising the steps of:
determining that one of the virtual machines has exceeded a predetermined congestion metric; and
thereafter migrating the one virtual machine to another host.
13. The method according to claim 1 , further comprising the step of using the congestion state as an input for a financial charging mechanism.
14. A computer system, comprising:
a memory;
a host processor configured to access the memory and to run one or more virtual machines and a hypervisor;
network interface hardware, which is configured to transmit and receive data packets over a data network, the hypervisor and the network interface hardware being trusted components;
wherein the host processor is co-operative with the network interface hardware for performing the steps of:
communicating data packet flows to and from the virtual machines over the data network via the network interface hardware;
estimating congestion states in the data network attributable to respective packet flows;
recognizing a new packet that belongs to one of the data packet flows;
making a determination based on the congestion states that the new packet belongs to a congestion-producing packet flow; and
applying a congestion-control policy to the new packet responsively to the determination, wherein the steps of making a determination and applying a congestion-control policy are performed by one or more of the trusted components, and wherein applying a congestion-control policy comprises sending a congestion-notification message to a source of the new packet, transmission of the congestion-notification message being delayed according to a class-based delay interval.
15. The system according to claim 14 , wherein applying a congestion-control policy is performed by the hypervisor.
16. The system according to claim 14 , wherein applying a congestion-control policy is performed by the network interface hardware.
17. The system according to claim 14 , further comprising the steps of:
recognizing a failure of the new packet to arrive within a predetermined time interval; and
updating the congestion states using one or more of the trusted components responsively to recognizing a failure.
18. The system according to claim 14 , wherein the new packet originates from one of the virtual machines, and wherein applying a congestion-control policy comprises delaying the new packet according to the congestion state attributable to the packet flow thereof.
19. The system according to claim 14 , further comprising falsifying the congestion-notification message by one or more of the trusted components.
20. A method for communication, comprising the steps of:
supporting a plurality of virtual machines in a host, wherein the host comprises a hypervisor, and network interface hardware, the hypervisor and the network interface hardware being trusted components;
communicating data packet flows to and from the virtual machines over a data network via the network interface hardware;
estimating congestion states in the data network attributable to respective packet flows;
recognizing a new packet that belongs to one of the data packet flows;
making a determination based on the congestion states that the new packet belongs to a congestion-producing packet flow; and
applying a congestion-control policy to the new packet responsively to the determination, wherein the steps of making a determination and applying a congestion-control policy are performed by one or more of the trusted components, and wherein applying a congestion-control policy comprises:
sending a congestion-notification message to a source of the new packet; and
falsifying the congestion-notification message by one or more of the trusted components.
21. The method according to claim 20 , further comprising sending a second congestion-notification message only after elapse of a predetermined time interval after sending a first congestion-notification message.
22. The method according to claim 20 , further comprising the steps of:
recognizing a failure of the new packet to arrive within a predetermined time interval; and
updating the congestion states using one or more of the trusted components responsively to recognizing a failure.
23. The method according to claim 20 , wherein the new packet originates from one of the virtual machines, and wherein applying a congestion-control policy comprises modifying a content of the new packet.
24. The method according to claim 20 , wherein the new packet originates from one of the virtual machines, and wherein applying a congestion-control policy comprises determining that the new packet is outside a congestion window, and thereafter delaying transmission of the new packet until the new packet is no longer outside the congestion window.