Data Link Rule Enforcer for MAC Address Packet Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network communication systems lack effective mechanisms to enforce data link rules at the data link layer, leading to potential malicious packet transmission and reception, which can compromise network security and integrity.
Innovation Solution
Implementing a data link rule enforcer that monitors and filters packets based on defined data link rules associated with Media Access Control (MAC) addresses, ensuring compliance with security policies by dropping non-compliant packets at the data link layer, thereby preventing malicious activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network traffic is monitored and filtered at the data link layer, then network security is improved, but device complexity increases
Solution Approach 1:
The patent introduces a data link rule enforcer as an intermediary component that sits between the network interface card and higher-level protocols. This enforcer monitors and filters packets at the data link layer by comparing source MAC addresses against configured rules, thereby improving network security without requiring complex changes to the entire system architecture.
Solution Approach 2:
The system performs preliminary actions by pre-configuring data link rules that define which source MAC addresses are authorized to send packets to specific destinations. These rules are established before actual packet filtering occurs, enabling the enforcer to quickly compare and drop non-compliant packets without complex real-time analysis.
2Reliability
If data link rules are enforced to drop non-compliant packets, then network integrity is improved, but processing time increases
Solution Approach 1:
The patent replaces complex mechanical-style packet inspection with a simpler comparison mechanism. The data link rule enforcer substitutes detailed packet analysis with direct comparison of source MAC addresses against pre-configured rules, significantly reducing processing time while maintaining network integrity through effective filtering of non-compliant packets.
3Reliability
If source address verification is performed on all packets, then security against impersonation is improved, but productivity decreases
Solution Approach 1:
The system applies partial verification by enforcing data link rules only for packets that match specific criteria defined in the configuration. Rather than verifying every single packet, the enforcer selectively applies source address verification based on pre-configured rules, maintaining security against impersonation while preserving network productivity by avoiding unnecessary processing of compliant packets.
Data Source
AI summary
A computer readable medium that includes computer readable program code embodied therein. The computer readable medium causes the computer system to receive, by a data link rule enforcer, a packet from a packet source of the packets, and obtain a data link rule applying to a data link. The data link is operatively connected to the packet source, and the data link is associated with a media access control (MAC) address. The computer readable medium further causes the computer system to determine, by the data link rule enforcer, whether the packet complies with the data link rule, and drop, by the data link rule enforcer, the packet when the packet fails to comply with the data link rule.