Application-Aware Route Selection With Policy-Based Verification

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing communication systems face potential security risks during the route selection process due to the inability to effectively identify and authenticate applications, which can lead to network resource infringement and attacks by malicious traffic.

Innovation Solution

Implementing a method to verify the integrity and authenticity of application identifiers and distinguishing parameters using a route selection policy rule, including steps such as integrity verification, authentication, and interaction with network devices to confirm application matching, thereby enhancing security in the route selection process.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If application identification is performed using only application identifier, then the route selection process is simple, but security risks increase due to inability to effectively identify legitimate applications

Engineering Contradiction:

Improveapplication identification accuracyVSAvoidverification process complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The application identification process is segmented into multiple independent verification components: application identifier verification, application distinguishing parameter verification, and route selection policy rule matching. Each component handles a specific aspect of verification, improving overall identification accuracy while maintaining manageable complexity through functional decomposition

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system performs preliminary verification of application identifiers and distinguishing parameters before allowing route selection. By pre-validating application credentials against stored policy rules, the system ensures security requirements are met before traffic routing decisions are made, preventing malicious traffic from bypassing security checks

Inventive Principle:

Principle #10Preliminary action

2Productivity

If no verification of application identifiers is performed, then the route selection process is fast, but network resources may be infringed by malicious applications

Engineering Contradiction:

Improveroute selection speedVSAvoidnetwork resource infringement risk

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The system implements feedback mechanisms where application identifiers and distinguishing parameters are continuously verified against route selection policy rules. The verification outcome feeds back into the route selection decision, allowing legitimate applications to proceed quickly while blocking malicious ones, thus maintaining both speed and security

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

Route selection policy rules serve as an intermediary layer between application identification and traffic routing. This intermediary contains pre-defined security criteria and routing instructions, allowing the system to verify applications against established policies without requiring complex real-time analysis, thus maintaining fast processing while preventing resource infringement

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If multiple verification parameters are used to identify applications, then security is improved, but the complexity of the route selection policy increases

Engineering Contradiction:

Improveapplication authentication securityVSAvoidroute selection policy complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

Multiple verification parameters are segmented into distinct functional components: application identifier, application distinguishing parameters, and route selection policy rules. Each component has a specific verification responsibility, allowing the system to maintain high security through comprehensive verification while managing complexity through clear functional separation

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system changes verification parameters dynamically based on application type and traffic characteristics. Different applications may require different combinations of verification parameters, allowing the system to maintain high security where needed while reducing verification complexity for trusted applications, thus balancing security and policy complexity

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS20260032556A1Communication method and communication apparatus

Publication Date: 2026.01.29 HUAWEI TECH CO LTD

AI summary

Embodiments of this application provide a communication method and a communication apparatus. The method includes: When the communication apparatus detects an application, the communication apparatus determines, based on a second application identifier and a second application distinguishing parameter that are associated with the application, that the application matches a route selection policy rule, and associates the application with a session according to the route selection policy rule. The route selection policy rule includes a first application identifier and a first application distinguishing parameter.