Physical Port Security via Bit Map Logic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional networking and switching environments rely on destination addresses for security, which can be bypassed by users assuming identities, leading to inadequate security measures.
Innovation Solution
Implementing physical port security by generating a destination port bit map and logically ANDing it with a bit map of allowed physical destination ports, using source address information to determine allowed ports, and dynamically or statically defining security rules based on time, traffic, or other parameters.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If address-based security techniques are used to control frame forwarding, then network security is improved, but users can bypass security by assuming identities
Solution Approach 1:
The patent transitions from address-based security (logical layer) to physical port-based security (physical layer). By introducing a new dimension of control at the physical port level using bit maps, the system prevents identity assumption attacks that exploit address spoofing, while maintaining address-based forwarding capabilities.
Solution Approach 2:
The patent segments the security control mechanism into two independent components: address-based forwarding rules and port-based access control. The port security bit map is segmented into individual port permissions that can be independently configured, allowing granular control over which physical ports can receive frames from specific sources.
2Reliability
If physical port security is implemented using bit maps and logical operations, then security against identity assumption is improved, but device complexity increases
Solution Approach 1:
The patent changes the security control parameter from logical addresses to physical port identifiers. By representing port permissions as bit maps where each bit corresponds to a specific port, the system simplifies the security check operation to a straightforward logical AND between the port bit map and the source address bit map, reducing computational complexity despite adding physical layer control.
Solution Approach 2:
The patent creates a simplified representation (copy) of port permissions in the form of a bit map, which mirrors the physical port configuration. This bit map copy allows rapid security decisions to be made through simple logical operations rather than complex rule evaluations, maintaining low processing overhead.
3Ease of operation
If static or dynamic bit maps are used for port security, then control over authorized ports is improved, but processing overhead increases
Solution Approach 1:
The patent performs preliminary configuration of port security permissions by pre-defining the port bit map based on static port security configurations or dynamic policies. This preliminary action allows the actual security check during frame forwarding to be reduced to a simple logical AND operation, minimizing processing time while maintaining flexible control over authorized ports.
Data Source
AI summary
A method and system of providing physical port security in a digital data network is disclosed. The system keeps bit maps of allowed physical output ports for each physical network connection. The map of allowed ports can be different for different source addresses connected to the device. When digital data, such as an IP packet, is received, the appropriate physical port security bit map is retrieved and a logical AND is done on the physical port bit map generated by the destination information. The resulting bit map is used to determine which physical ports the data is routed to, blocking any requested destinations that are not appropriate destinations based on the port security bit map.