Bit-Level Network Intrusion Prevention Logic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network intrusion prevention systems (NIPS) introduce unworkable delays in delay-constrained networks, such as those with slow link speeds, leading to incorrect system behavior and potential system failures due to the buffering and evaluation of entire packets before making forwarding decisions.
Innovation Solution
A method that intercepts communications in a distributed computing environment, evaluates each element of a communication individually, and makes decisions to forward or invalidate the communication without buffering the entire packet, thereby reducing latency to less than one bit time, allowing for negligible delay in security processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a security device intercepts and evaluates a whole packet before forwarding, then network intrusion prevention is achieved, but additional delay is imposed that may lead to incorrect system behavior in delay-constrained networks
Solution Approach 1:
The patent segments the packet processing into individual bit-level operations. Instead of evaluating the entire packet as a single unit, the security device processes packets bit-by-bit through a series of sequential logic stages, allowing each bit to be evaluated and forwarded independently with minimal delay
Solution Approach 2:
The patent implements preliminary action by pre-configuring security rules and evaluation criteria before packet arrival. The security device prepares evaluation logic in advance so that when packets arrive, bits can be rapidly evaluated against pre-established criteria without requiring complex real-time analysis of the entire packet
2Measurement precision
If whole packets are buffered for evaluation, then complete communication analysis is possible, but latency increases to unacceptable levels in real-time systems
Solution Approach 1:
The patent divides the packet into individual bits and processes them sequentially through multiple logic stages. This segmentation allows the system to achieve thorough analysis by examining each bit's contribution to the overall communication pattern without requiring complete packet buffering, as each bit can be evaluated in context with previously processed bits
Solution Approach 2:
The patent maintains continuous useful action by implementing a pipeline architecture where bits are continuously evaluated and forwarded without interruption. The sequential logic stages operate in continuous flow, with each stage processing bits as they arrive rather than waiting for complete packet assembly, thereby eliminating buffering latency while maintaining analysis capability
3Reliability
If security devices are placed in-line to intercept communications, then intrusion detection capability is improved, but system delay increases leading to potential system failures
Solution Approach 1:
The patent segments the intrusion detection function into distributed sequential logic stages that operate in parallel pipelines. Each stage evaluates specific bit patterns and communication characteristics independently, allowing the system to maintain high intrusion detection capability while minimizing delay through parallel processing of segmented data streams
Solution Approach 2:
The patent replaces traditional mechanical packet buffering and software-based evaluation with electronic sequential logic circuits that operate at the bit level. This substitution of mechanics with electronic logic enables extremely fast processing speeds that minimize delay while maintaining comprehensive intrusion detection capability through deterministic logic evaluation
Data Source
AI summary
A method, computer program product, and system where a processor(s) in a distributed computing environment intercepts a communication (of sequential elements) between a first computing node and a second computing node. The processor(s) determines if the communication is undesired by evaluating data related to or comprising each element individually. The evaluating includes the processor(s) obtaining a first element (an earliest element in the sequence that has not been evaluated), determining, if the data related to or comprising the earliest element indicate that the communication is undesired, forwarding the earliest element to the second computing node, before obtaining a second element in the sequence (an element subsequent and adjacent to the earliest element in the sequence), and based on determining that the data related to or comprising the earliest element indicate that the communication is undesired, invalidating, an available element of the sequential elements such that the second computing node does not receive the communication in a usable format.