Network Device Identification via Clock Skew Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for identifying network devices in communications networks are prone to frequent incorrect detections due to the use of multiple data sources, and solely relying on clock skew does not provide reliable identification.
Innovation Solution
An apparatus and method that utilize a data acquisition unit to receive data from network devices, an interpretation unit to extract identification data, and analyze criteria such as physical clock similarity, IP fragment identifiers, TCP timestamps, and other parameters to determine network device associations with confidence values, minimizing incorrect detections and identifying network devices accurately.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple data sources are used to identify network devices, then identification coverage is improved, but incorrect detections increase
Solution Approach 1:
The patent transforms the identification approach by changing from using multiple independent data sources to using a single parameter - clock skew - as the primary identification criterion. This parameter change resolves the contradiction by eliminating the noise from multiple data sources while maintaining identification capability through the unique clock skew characteristics of each network device.
Solution Approach 2:
The patent extracts and isolates the clock skew parameter from the complex multi-source identification system. By taking out this specific parameter and using it as the sole basis for identification, the system achieves both high reliability and precision, avoiding the incorrect detections that arise from combining multiple data sources.
2Device complexity
If clock skew alone is used for identification, then measurement simplicity is improved, but identification reliability deteriorates
Solution Approach 1:
The patent applies self-service by using the network device's own clock mechanism as the identification source. Each device's inherent clock skew serves as its unique fingerprint, eliminating the need for complex external identification systems while maintaining high reliability. The device essentially identifies itself through its own timing characteristics.
3Reliability
If blanket monitoring is implemented, then monitoring coverage is improved, but legal compliance deteriorates
Solution Approach 1:
The patent applies local quality by enabling targeted monitoring of specific network devices through their unique clock skew identifiers. Instead of blanket monitoring of all traffic, the system can selectively monitor and identify individual devices or groups based on their clock characteristics, thereby maintaining legal compliance while achieving sufficient monitoring coverage for official duties.
Data Source
AI summary
An apparatus for identifying network devices comprises a data acquisition unit that receives data from a multiplicity of network devices. It also comprises an interpretation unit that extracts identification data from the data and determines which of the multiplicity of network devices has sent the received data. A similarity of measured data of a physical clock to a predefined pattern and/or to previously measured data of the physical clock is analysed as a first criterion of an association of received data. In addition, at least one further criterion of an association of received data can be analysed among the identification data.