Packet Tagging for Network Service Segregation
Solution Overview
Problem
Conventional service provider networks lack effective mechanisms to segregate and manage control packets and tagged data packets across different subscribers, leading to potential unauthorized changes in network configurations and burdensome tag coordination.
Innovation Solution
The implementation of tools that assign packets to network services by adding tags to untagged control packets and routing tagged or untagged data packets to appropriate network services based on predefined configurations, ensuring proper segregation and preventing unauthorized actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional service provider networks act on control packet requests, then network configuration changes are enabled, but unauthorized changes and security risks increase
Solution Approach 1:
The patent introduces an intermediary mechanism where control packets are assigned to network services before being processed. This intermediary assignment step ensures that only authorized network services can process control packets, preventing unauthorized configuration changes while maintaining legitimate network management functionality.
Solution Approach 2:
The patent segments control packets into different network services based on tags. By dividing control packets into distinct service categories, the system can selectively process only authorized control operations while blocking unauthorized ones, thus improving security without completely eliminating configuration flexibility.
2Productivity
If service providers use a single network infrastructure for multiple subscribers, then infrastructure utilization is improved, but packet segregation and security isolation become more complex
Solution Approach 1:
The patent applies local quality by assigning different tags to different network services on the same physical infrastructure. This allows the network to maintain a single shared infrastructure while creating distinct logical pathways for different subscribers and services, simplifying the management of multi-subscriber environments.
Solution Approach 2:
The tag assignment mechanism acts as an intermediary layer between the physical network infrastructure and the logical service requirements. This intermediary tagging system enables the network to multiplex multiple subscriber traffic streams over a single infrastructure while maintaining clear segregation through tags, reducing the complexity of managing multiple separate infrastructures.
3Reliability
If networks drop tagged data packets not in the predefined tag set, then network security is improved, but coordination burden between subscribers and service provider increases
Solution Approach 1:
The patent enables subscribers to self-assign tags to their data packets without requiring coordination with the service provider. Subscribers can independently choose tags for their network services, and the network infrastructure automatically processes these tags according to predefined policies, eliminating the need for complex tag coordination while maintaining security.
Solution Approach 2:
The patent changes the approach from static predefined tag sets to dynamic tag assignment where subscribers can select from available tags independently. This parameter change from fixed tag configurations to flexible tag selection reduces coordination complexity while maintaining network security through automated tag validation and processing.
4Speed
If control packets are processed directly by network devices, then network responsiveness is improved, but unauthorized configuration changes increase
Solution Approach 1:
The patent applies preliminary action by assigning control packets to network services before processing occurs. This preliminary assignment step happens quickly and automatically, enabling the network to maintain fast response times while adding a security layer that prevents unauthorized configuration changes through authorized service routing.
Data Source
AI summary
This document describes tools that assign packets to a network service. The tools receive a control packet lacking a tag associating the control packet with a network service and assign the control packet to a network service by adding a tag to the control packet. The tools may also receive a tagged data packet on a port and determine that the tag does not match any of a set of network tags associated with the port. Consequently, the tools assign the data packet to a default network service. The tools may also receive a set of conditions for a port and assign data packets received on the port that satisfy one of the conditions to a network service associated with the satisfied condition and data packets that do not satisfy one of the conditions to a default network service.