Deterministic Network Switch Packet Classification for ICS Security

The patent applies preliminary action by classifying communication packets into different priority levels before routing them. The network switch examines packet headers and assigns priority classifications (e.g., high, medium, low) based on predetermined criteria such as protocol type, source/destination addresses, or application requirements. This pre-classification enables deterministic routing where high-priority packets are forwarded first, ensuring critical control commands receive bounded delivery time while maintaining overall network throughput without requiring complex real-time analysis of every packet.

The patent segments the network traffic flow into multiple priority queues based on packet classification. Instead of treating all packets uniformly, the switch divides the communication stream into distinct segments (priority levels) that are handled separately through different routing paths or scheduling mechanisms. This segmentation allows the system to provide deterministic service to time-critical packets while still processing best-effort traffic, thereby improving reliability without requiring complete reconfiguration of the entire network infrastructure.

The patent implements dynamics by making the routing behavior adaptive based on packet characteristics. The network switch dynamically selects routing paths and priority levels according to the specific requirements of each packet or packet class. For example, time-sensitive control commands receive deterministic low-latency paths, while less critical data traffic uses more flexible routing options. This dynamic approach allows the same network infrastructure to provide bounded delivery time for critical packets while maintaining adaptability to support diverse industrial protocols and traffic types simultaneously.

The patent applies local quality by providing different quality of service characteristics to different packets based on their specific requirements. Instead of enforcing uniform deterministic routing on all traffic, the switch applies deterministic guarantees only to packets that require them (identified through classification), while allowing more flexible handling for packets that can tolerate variable latency. This localized application of strict routing rules maintains time predictability for critical communications while preserving network versatility for supporting multiple protocol types and traffic patterns.

The patent extracts only the essential classification information needed for deterministic routing from the full packet data. Instead of performing deep inspection of entire packets, the switch focuses on examining specific header fields and key characteristics that determine packet priority and routing requirements. This extraction approach achieves sufficient classification accuracy for industrial control applications by identifying packet type, source, and destination information without analyzing the complete packet payload, thereby maintaining high processing speed and network throughput while still enabling accurate routing decisions.

The patent applies partial action by performing classification and inspection only to the extent necessary for deterministic routing decisions. The network switch implements selective deep packet inspection that focuses on critical fields required for protocol compliance and priority determination, rather than examining every byte of every packet. This partial inspection approach provides sufficient accuracy for routing precision while minimizing the processing overhead that would otherwise reduce network throughput, allowing the system to maintain both high-speed operation and accurate packet classification for time-critical communications.