Interface IP Cache for Automated Network Traffic Authorization

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing network devices face challenges in efficiently managing unauthorized access to services by endpoint devices, leading to resource wastage and monetary loss due to cumbersome and error-prone manual configuration of firewalls, especially when dealing with numerous endpoint devices with varying service subscriptions.

Innovation Solution

Implementing a network device with data structures associated with specific interfaces, allowing it to determine whether to forward or refrain from forwarding traffic based on IP addresses, reducing the need for manual configuration and minimizing unauthorized access by using advertisements to automatically update these structures.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If manual configuration of firewalls is used to manage unauthorized access, then security control is achieved, but device complexity and error-proneness increase

Engineering Contradiction:

Improvesecurity controlVSAvoidmanual configuration complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The network device automatically receives advertisements from server devices and configures its own forwarding behavior based on these advertisements. The device autonomously determines whether to forward or drop packets by checking the advertisement cache, eliminating the need for manual firewall configuration and reducing operational complexity while maintaining security control.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The network device pre-receives and stores advertisements from server devices before actual traffic forwarding is needed. By having the advertisement cache populated in advance with server device identifiers and forwarding instructions, the device can quickly make forwarding decisions without real-time configuration, reducing errors and improving reliability.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If manual firewall configuration is used for numerous endpoint devices, then access control is maintained, but time consumption and productivity decrease

Engineering Contradiction:

Improveaccess controlVSAvoidconfiguration time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

Inventive Principle:

Principle #10Preliminary action

3Productivity

If data structures are maintained for each interface to enable automated forwarding decisions, then productivity and automation are improved, but device complexity increases

Engineering Contradiction:

Improvetraffic forwarding efficiencyVSAvoiddata structure management

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The network device maintains separate advertisement caches for different interfaces, with each cache storing advertisements received on that specific interface. This segmentation allows the device to efficiently manage forwarding decisions on a per-interface basis using simple data structures, improving productivity without overwhelming complexity.

Inventive Principle:

Principle #1Segmentation

4Loss of energy

If automated advertisement-based forwarding is implemented, then unauthorized access is reduced and resource wastage decreases, but device complexity increases

Engineering Contradiction:

Improveresource wastageVSAvoidautomated update mechanism

Core Design Contradiction:

Loss of energyVSDevice complexity

Solution Approach 1:

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS12574322B2Data structure associated with an interface of a network device

Publication Date: 2026.03.10 JUNIPER NETWORKS INC

AI summary

In some implementations, a network device may receive traffic via an interface of the network device. The network device may determine an Internet protocol (IP) address of the traffic. The network device may identify, based on determining the IP address of the traffic, the interface of the network device. The network device may identify a data structure associated with the interface. The network device may determine whether an entry of the data structure is associated with the IP address. The network device may selectively: forward the traffic, based on determining that an entry of the data structure is associated with the IP address, or refrain from forwarding the traffic, based on determining that no entry of the data structure is associated with the IP address.