# US 12,003,415 B2 · Message validation using data-link layer fields > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,415 B2 - Document ID: US12003415B2 - Status: Granted - Kind: B2 - Application number: 18/221,604 - Filed: 2023-07-13 - Published: 2023-11-09 - Granted: 2024-06-04 - Earliest claimed: 2019-05-06 - Applicants: Seth Gregory Friedman - Inventors: Seth Gregory Friedman - Web page: https://patentgrep.com/patent/US12003415B2 ## CPC - H04L 12/4645: {Details on frame tagging (routing of packets H04L45/00; support for virtual LAN H04L49/354)} - H04L 45/70: {Routing based on monitoring results} - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 45/66: {Layer 2 routing, e.g. in Ethernet based MAN's} - H04L 63/0245: {Filtering by information in the payload} - H04L 63/0263: {Rule management} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A device may include a first interface and a second interface. The device may also include memory containing a set of rules and representations of pre-defined violations thereof. The device may also include digital logic programmed to: (i) receive, by way of the first interface, an Ethernet frame containing Ethernet header fields and an Ethernet payload, wherein the Ethernet payload contains a payload; (ii) extract data from the Ethernet header fields, wherein the data defines a transaction that is functionally equivalent to a further transaction that is defined by the payload; (iii) apply the set of rules to the transaction, wherein doing so involves comparing fields in the data to values and concluding that the transaction does not contain any pre-defined violations; and (iv) modify the Ethernet frame to contain content based on the payload, and transmit the Ethernet frame out the second interface. ## Claims ### Claim 1 A device comprising: a network interface; memory; and digital logic programmed to: receive, by way of the network interface, a frame containing a header and an application payload, wherein the application payload encodes a transaction in a first format and the header encodes content from the transaction in a second format that is different from the first format; compare, in accordance with a set of rules, at least some of the transaction in the second format located in the header to one or more values stored in the memory; based on the comparison of at least some of the transaction in the second format, determine that the transaction in the first format is invalid, wherein determining that the transaction in the first format is invalid comprises determining, from at least some of the transaction in the second format and the set of rules, that an item in the transaction in the first format is singly or in combination with other items in the transaction in the first format: (i) in conflict with, or a duplicate of, a previous transaction, (ii) prohibited, (iii) defines a quantity more than a threshold quantity, or (iv) defines a value that, in combination with other values related to the transaction, is more than a threshold value; and based on the transaction in the first format being invalid, refrain from forwarding the frame. ### Claim 2 (depends on 1) The device of claim 1, wherein comparing at least some of the transaction in the second format to the one or more values stored in the memory comprises determining whether the transaction in the second format contains at least one pre-defined violation of the set of rules. ### Claim 3 (depends on 1) The device of claim 1, wherein determining that the transaction in the first format is invalid comprises determining that the transaction in the first format contains at least one pre-defined violation of the set of rules. ### Claim 4 (depends on 1) The device of claim 1, wherein the transaction in the second format is located within one or more 802.1Q fields within the header. ### Claim 5 (depends on 1) The device of claim 1, wherein the one or more 802.1Q fields are not formatted in accordance with 802.1Q standards. ### Claim 6 (depends on 1) The device of claim 1, wherein the one or more 802.1Q fields do not contain virtual local area network (VLAN) tags. ### Claim 7 (depends on 1) The device of claim 1, wherein the digital logic is further programmed to: receive, by way of the network interface, a second frame containing a second header and a second application payload, wherein the second application payload encodes a second transaction in the first format and the second header encodes the second transaction in the second format; compare, in accordance with the set of rules, at least some of the second transaction in the second format to the one or more values stored in the memory; based on the comparison of at least some of the second transaction in the second format, determine that the second transaction in the first format is valid; and based on the second transaction in the first format being valid, forward a representation of the second frame to a destination device. ### Claim 8 (depends on 7) The device of claim 7, further comprising: a second network interface, wherein forwarding the representation of the second frame to the destination device comprises forwarding the representation of the second frame by way of the second network interface. ### Claim 9 (depends on 1) The device of claim 1, wherein the frame is received from a source device, and wherein the source device is coupled to the device by no more than one or two datalink layer segments. ### Claim 10 (depends on 1) The device of claim 1, wherein the frame is received from a source device, and wherein the source device is physically integrated with the device in a chassis. ### Claim 11 (depends on 1) The device of claim 1, wherein the frame is received from a source device, and wherein the digital logic is further configured to: based on the transaction in the first format being invalid, block further datalink frames received from the source device from being processed by the digital logic. ### Claim 12 (depends on 1) The device of claim 1, wherein the transaction in the second format is encoded in a sequence of fields, the fields associated with respective starting bit locations and respective ending bit locations, and wherein comparing at least some of the transaction in the second format located in the header to the one or more values stored in the memory comprises: copying at least some the transaction in the second format into locations of the memory based on the respective starting bit locations and respective ending bit locations. ### Claim 13 A device comprising: a network interface; memory; and digital logic programmed to: receive, by way of the network interface, a frame containing a header and an application payload, wherein the application payload encodes a transaction in a first format and the header encodes content of the transaction in a second format that is different from the first format; compare, in accordance with a set of rules, at least some of the transaction in the second format located in the header to one or more values stored in the memory; based on the comparison of at least some of the transaction in the second format, determine that the transaction in the first format is valid, wherein determining that the transaction in the first format is valid comprises determining, from at least some of the transaction in the second format and the set of rules, that no item in the transaction in the first format is singly or in combination with other items in the transaction in the first format: (i) in conflict with, or a duplicate of, a previous transaction, (ii) prohibited, (iii) defines a quantity more than a threshold quantity, or (iv) defines a value that, in combination with other values related to the transaction, is more than a threshold value; and based on the transaction in the first format being valid, forward a representation of the frame to a destination device. ### Claim 14 (depends on 13) The device of claim 13, wherein the transaction in the second format is located within one or more 802.1Q fields within the header. ### Claim 15 A method comprising: receiving, by digital logic and by way of a network interface, a frame containing a header and an application payload, wherein the application payload encodes a transaction in a first format and the header encodes content from the transaction in a second format that is different from the first format; comparing, by the digital logic and in accordance with a set of rules, at least some of the transaction in the second format located in the header to one or more values stored in memory; based on the comparison of at least some of the transaction in the second format, determining, by the digital logic, that the transaction in the first format is valid, wherein determining that the transaction in the first format is valid comprises determining, from at least some of the transaction in the second format and the set of rules, that no item in the transaction in the first format is singly or in combination with other items in the transaction in the first format: (i) in conflict with, or a duplicate of, a previous transaction, (ii) prohibited, (iii) defines a quantity more than a threshold quantity, or (iv) defines a value that, in combination with other values related to the transaction, is more than a threshold value; and based on the transaction in the first format being valid, forwarding, by the digital logic, a representation of the frame to a destination device. ### Claim 16 (depends on 15) The method of claim 15, wherein comparing at least some of the transaction in the second format to the one or more values stored in the memory comprises determining whether the transaction in the second format contains a pre-defined violation of the set of rules. ### Claim 17 (depends on 15) The method of claim 15, wherein determining that the transaction in the first format is valid comprises determining that the transaction in the first format contains no pre-defined violation of the set of rules. ### Claim 18 (depends on 15) The method of claim 15, wherein the transaction in the second format is encoded in a sequence of fields, the fields associated with respective starting bit locations and respective ending bit locations, and wherein comparing at least some of the transaction in the second format located in the header to the one or more values stored in the memory comprises: copying at least some the transaction in the second format into locations of the memory based on the respective starting bit locations and respective ending bit locations. ### Claim 19 (depends on 15) The method of claim 15, wherein the transaction in the second format is located within one or more 802.1Q fields within the header.