# US 10,375,022 B2 · Cooperated approach to network packet filtering > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,022 B2 - Document ID: US10375022B2 - Status: Granted - Kind: B2 - Application number: 15/677,829 - Filed: 2017-08-15 - Published: 2018-06-14 - Granted: 2019-08-06 - Earliest claimed: 2016-03-01 - Assignees: Intel Corporation - Applicants: Intel Corporation - Inventors: Yaozu Dong; Kun Tian - Web page: https://patentgrep.com/patent/US10375022B2 ## CPC - H04L 63/0263: {Rule management} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - H04L 49/00: Packet switching elements - H04L 63/0245: {Filtering by information in the payload} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An apparatus, system, method, and machine-readable medium are disclosed. In one embodiment the apparatus is a network interface controller that includes one virtual function owned by a virtual machine present in the computer system. The controller includes a simple filtering agent that is associated with the first virtual function. The agent enforces simple filter rules for received network packets. The simple filter rules are capable of blocking the network packets from reaching the virtual machine. The apparatus also includes another virtual function that is owned by a virtual machine monitor present in the computer system. The controller also includes a side bounce filtering agent to forward the first network packet to the second virtual function if the first packet is blocked by the at least one of the one or more simple filter rules. ## Claims ### Claim 1 A network interface apparatus, comprising: a memory comprising a queue for storage of network packets; and a first-level matching logic to: determine whether a first network packet, received from a network and stored in the queue, matches under a first-level policy; forward the first network packet to a second-level matching logic to enforce a second-level policy on the first network packet if the first network packet doesn't match under the first-level policy; and, forward the first network packet to a virtual machine (VM) if the first network packet matches under the first-level policy. ### Claim 2 (depends on 1) The network interface apparatus of claim 1, wherein to forward the first network packet to the second-level matching logic comprises to forward the first network packet to a central processing unit (CPU) communicatively coupled to the network interface apparatus, wherein the first-level matching logic is further to receive the first network packet from the CPU and forward the first network packet to the VM if the first network packet matches under the second-level policy. ### Claim 3 (depends on 1) The network interface apparatus of claim 1, wherein the first-level matching logic is further to: receive a second network packet from the VM; determine whether the second network packet matches under the first-level policy; forward the second network packet for transmission to the network if the second network packet matches under the first-level policy; and forward the second network packet to the second-level matching logic to enforce the second-level policy on the second network packet if the second network packet does not match under the first-level policy. ### Claim 4 (depends on 3) The network interface apparatus of claim 3, wherein the first-level matching logic is further to receive the second network packet from the second-level matching logic and forward the second network packet for transmission to the network if the second network packet matches under the second-level policy. ### Claim 5 (depends on 1) The network interface apparatus of claim 1, wherein the first-level matching logic comprises a virtual function associated with the VM. ### Claim 6 (depends on 1) The network interface apparatus of claim 1, wherein the second-level policy comprise a complex filtering rule. ### Claim 7 (depends on 1) The network interface apparatus of claim 1, wherein to forward the first network packet to the second-level matching logic comprises to forward the first network packet to a central processing unit (CPU) communicatively coupled to the network interface apparatus. ### Claim 8 (depends on 1) The network interface apparatus of claim 1, wherein the network interface apparatus comprises the second-level matching logic. ### Claim 9 A system, comprising: a central processing unit (CPU) communicatively coupled to a network interface apparatus; a system memory; and the network interface apparatus comprising a first-level matching logic to: determine whether a first network packet, received from a network, matches under a first-level policy; forward the first network packet to a second-level matching logic to enforce a second-level policy on the first network packet if the first network packet doesn't match under the first-level policy; and, forward the first network packet to a virtual machine (VM) if the first network packet matches under the first-level policy. ### Claim 10 (depends on 9) The system of claim 9, wherein to forward the first network packet to the second-level matching logic comprises to forward the first network packet to the CPU, wherein the first-level matching logic is further to receive the first network packet from the CPU and forward the first network packet to the VM if the first network packet matches under the second-level policy. ### Claim 11 (depends on 9) The system of claim 9, wherein the first-level matching logic is further to: receive a second network packet from the VM; determine whether the second network packet matches under the first-level policy; forward the second network packet for transmission to the network if the second network packet matches under the first-level policy; and forward the second network packet to the second-level matching logic to enforce the second-level policy on the second network packet if the second network packet does not match under the first-level policy. ### Claim 12 (depends on 11) The system of claim 11, wherein the first-level matching logic is further to receive the second network packet from the second-level matching logic and forward the second network packet for transmission to the network if the second network packet matches under the second-level policy. ### Claim 13 (depends on 9) The system of claim 9, wherein the first-level matching logic comprises a virtual function associated with the VM. ### Claim 14 (depends on 9) The system of claim 9, wherein to forward the first network packet to the second-level matching logic comprises to forward the first network packet to the CPU. ### Claim 15 (depends on 9) The system of claim 9, wherein the network interface apparatus comprises the second-level matching logic. ### Claim 16 A method for filtering packets by a network interface apparatus, the method comprising: determining, by a first-level matching logic of the network interface apparatus, whether a first network packet, received from a network, matches under a first-level policy; forwarding, by the first-level matching logic, the first network packet to a second-level matching logic to enforce a second-level policy on the first network packet if the first network packet doesn't match under the first-level policy; and, forwarding, by the first-level matching logic, the first network packet to a virtual machine (VM) if the first network packet matches under the first-level policy. ### Claim 17 (depends on 16) The method of claim 16, wherein forwarding the first network packet to the second-level matching logic comprises forwarding the first network packet to a central processing unit (CPU) communicatively coupled to the network interface apparatus, wherein the method further comprises receiving, by the first-level matching logic, the first network packet from the CPU and forwarding, by the first-level matching logic, the first network packet to the VM if the first network packet matches under the second-level policy. ### Claim 18 (depends on 16) The method of claim 16, further comprising: receiving, by the first-level matching logic, a second network packet from the VM; determining, by the first-level matching logic, whether the second network packet matches under the first-level policy; forwarding, by the first-level matching logic, the second network packet for transmission to the network if the second network packet matches under the first-level policy; and forwarding, by the first-level matching logic, the second network packet to the second-level matching logic to enforce the second-level policy on the second network packet if the second network packet does not match under the first-level policy. ### Claim 19 (depends on 18) The method of claim 18, further comprising receiving, by the first-level matching logic, the second network packet from the second-level matching logic and forwarding, by the first-level matching logic, the second network packet for transmission to the network if the second network packet matches under the second-level policy. ### Claim 20 (depends on 16) The method of claim 16, wherein the first-level matching logic comprises a virtual function associated with the VM.