Network Packet Filtering Layer for Flexible Cybersecurity Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cybersecurity methods, whether hardware-based or software-based, face limitations in flexibility and resource efficiency, failing to effectively and quickly control network packet security in devices.
Innovation Solution
A system combining a network card, driver, network accelerator with a data layer and man-in-the-middle attack tool, and a TCP/IP model within the operating system's first space, filters out malicious packets and performs data conversion to ensure secure communication with the application layer, optimizing resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware-based detection is used for cybersecurity, then detection reliability is improved, but flexibility and configurability deteriorate
Solution Approach 1:
The patent segments the cybersecurity detection system into multiple functional layers: a first space containing the driver, network accelerator, and man-in-the-middle attack tool for packet parsing and filtering, and a second space containing the TCP/IP model and application layer for higher-level processing. This segmentation allows each layer to specialize in specific tasks, improving overall reliability while maintaining flexibility through configurable filtering rules in the network accelerator.
Solution Approach 2:
The network accelerator acts as an intermediary component between the hardware network card and the TCP/IP model. It receives network packets from the driver, parses attributes, filters malicious packets using configurable rules, and passes cleaned packets to the TCP/IP model. This intermediary layer provides both reliable detection through dedicated filtering functionality and flexibility through configurable rules that can be adapted to different security threats.
2Adaptability or versatility
If purely software-based detection is used for cybersecurity, then flexibility and configurability are improved, but processing speed and resource efficiency deteriorate
Solution Approach 1:
The patent divides the software processing workload into distinct segments: the driver handles basic packet reception, the network accelerator performs attribute parsing and malicious packet filtering using efficient data structures, and the TCP/IP model manages higher-level protocols. This segmentation reduces the processing burden on any single software component, improving overall processing speed while maintaining flexibility through configurable filtering rules in the network accelerator.
Solution Approach 2:
The network accelerator performs partial action by filtering only the most critical security-related attributes from network packets before passing them to the TCP/IP model. Instead of processing every packet through all software layers, the system identifies and filters malicious packets at the network accelerator level, reducing the excessive action of full packet processing for all packets and improving resource efficiency.
3Reliability
If comprehensive network packet processing is performed, then cybersecurity coverage is improved, but computing resource consumption increases
Solution Approach 1:
The patent extracts the malicious packet filtering function from the comprehensive packet processing path and places it in a dedicated network accelerator component. This extraction allows the system to identify and remove malicious packets early in the processing chain, preventing them from consuming computing resources in subsequent processing stages. The network accelerator uses efficient attribute parsing and filtering algorithms to achieve comprehensive security coverage with reduced resource consumption.
Solution Approach 2:
The system applies partial action by performing comprehensive security filtering only on packets that pass the initial network accelerator check, rather than processing all packets through every security layer. This approach maintains high cybersecurity coverage for suspicious packets while reducing computing resource consumption for benign packets that are filtered out earlier in the process.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Embodiments of this application provide a system for improving cybersecurity, including: a driver in a first space of an operating system, configured to parse a network packet to obtain a first network packet, so that the operating system reads content in the first network packet; a network accelerator in the first space of the operating system, including a data layer and a man-in-the-middle attack tool, where the man-in-the-middle attack tool is configured to filter out malicious packets from the first network packet based on attributes of the first network packet, to obtain a second network packet; a TCP/IP model in the first space of the operating system, configured to parse the second network packet to establish communication with a first application layer in a second space of the operating system; and the first application layer in the second space of the operating system, including a conversion module, where the conversion module is configured to perform data conversion on the second network packet to enable the first application layer.