Transfer Device Per-Frame Encryption Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing transfer devices in layer-2 networks cannot finely control encrypted communication based on information other than VLAN-ID, limiting flexibility in managing transfer frames within the same VLAN.
Innovation Solution
A transfer device with multiple ports, a frame identification unit, an address filter unit, an encryption/decryption necessity determination unit, and an encryption/decryption processing unit that determines and applies encryption or decryption based on destination information and priority, allowing per-frame control of communication mode within the same VLAN.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption is applied to all frames in a VLAN, then security is improved, but control flexibility for individual frames is reduced
Solution Approach 1:
The patent applies encryption selectively to specific frames based on their attributes (priority, destination information) rather than uniformly to all frames in a VLAN. This allows different parts of the data flow to have different encryption states, achieving both security for sensitive frames and flexibility for others.
Solution Approach 2:
The encryption state of frames is made dynamic based on frame attributes rather than being static for the entire VLAN. The system can adaptively determine whether to encrypt or transmit frames in plaintext based on real-time frame characteristics such as priority levels and destination information.
2Adaptability or versatility
If per-frame encryption control is implemented, then control flexibility is improved, but device complexity increases
Solution Approach 1:
The patent segments the frame processing function into distinct modules: frame identification unit, address filter unit, encryption necessity determination unit, encryption decryption processing unit, and switching processing unit. This modular segmentation allows complex per-frame encryption control to be achieved through coordinated simple operations in each module.
Solution Approach 2:
The system performs preliminary determination of encryption necessity before actual frame transmission. The encryption necessity determination unit evaluates frame attributes in advance and decides whether encryption is required, allowing the main transmission path to simply follow pre-determined encryption instructions rather than making complex decisions in real-time.
3Device complexity
If only VLAN-ID is used for encryption determination, then device complexity is reduced, but measurement precision for frame attributes is insufficient
Solution Approach 1:
The patent extends the encryption determination criteria from a single dimension (VLAN-ID) to multiple dimensions by incorporating priority information and destination information. This multi-dimensional approach enables more precise frame attribute discrimination while maintaining manageable device complexity through systematic processing of multiple attributes.
Data Source
AI summary
Provided is a transfer device (200) that includes a plurality of ports to and from each of which a layer-2 frame is input and output; a frame identification unit (221) that identifies whether or not the frame has been encrypted; an address filter unit (222) that decides one of the plurality of ports from which the frame is to be output; an encryption necessity determination unit (223) that has an encryption necessity determination table depending on destination information and priority information which are included in each frame, and a decryption necessity determination table depending on the destination information included in each frame, and when the frame has not been encrypted, determines whether or not encryption is necessary for the frame based on the encryption necessity determination table, and when the frame has been encrypted, determines whether or not decryption is necessary for the frame based on the decryption necessity determination table; an encryption decryption processing unit (225) that encrypts the frame for which it has been determined that encryption is necessary and decrypts the frame for which it has been determined that decryption is necessary; and a switching processing unit (224) that outputs the frame to one of the ports. Thus, the transfer device can realize both encrypted communication and plaintext communication.