# US 12,184,484 B1 · Programmable switching device for network infrastructures

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,184,484 B1
- Document ID: US12184484B1
- Status: Granted
- Kind: B1
- Application number: 18/819,101
- Filed: 2024-08-29
- Published: 2024-12-19
- Granted: 2024-12-31
- Earliest claimed: 2019-12-10
- Assignees: Amyna Systems Inc.
- Applicants: AMYNA Systems
- Inventors: James Kyriannis; Min Kyriannis
- Web page: https://patentgrep.com/patent/US12184484B1

## CPC

- H04L 43/028: by filtering
- G06N 20/00: Machine learning
- H04L 41/0803: Configuration setting
- H04L 41/0813: characterised by the conditions triggering a change of settings
- H04L 41/0843: {based on generic templates}
- H04L 41/0894: Policy-based network configuration management
- H04L 41/16: using machine learning or artificial intelligence
- H04L 43/06: Generation of reports
- H04L 43/20: the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
- H04L 63/02: {for separating internal from external traffic, e.g. firewalls}
- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- H04L 63/0245: {Filtering by information in the payload}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/18: {using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

A programmable switching device within a network infrastructure that includes at least one port; and at least one programmable filter communicatively coupled to the at least one port, wherein the at least one programmable filter is configured to permit/deny data packets being transmitted to or from a networked device connected to the at least one port based on a set of defined rules.

## Claims

### Claim 1

A method comprising:
identifying, by one or more network devices of a network infrastructure, a first data packet destined for a first connected device communicatively coupled to a first port of a programmable switch device;
identifying, by the one or more network devices, a first tuple including a first node identifier identifying the first connected device, the first node identifier generated using a first MAC address of the first connected device, a first IP address assigned to the first connected device, and a first communications protocol over which the first data packet is to be transmitted to the first connected device;
determining, by the one or more network devices, to restrict transmission of the first data packet to the first connected device responsive to applying, to the first data packet, one or more network policies using the first node identifier of the first tuple and a first port identifier identifying the first port of the programmable switching device and a first switch identifier identifying the programmable switching device, wherein the one or more network policies are configured by a controller included in the one or more network devices responsive to analyzing data flow characteristics of data packets routed through the one or more network devices;
dropping, by the one or more network devices, the first data packet prior to transmission to the first connected device;
identifying, by the one or more network devices, a second data packet destined for the first connected device;
identifying, by the one or more network devices, a second tuple including a second node identifier identifying the first connected device, the second node identifier generated i) using at most two of a) the first MAC address, b) the first IP address, or c) the first communications protocol and ii) using at least one of a) a second MAC address of the first connected device, b) a second IP address assigned to the first connected device, or c) a second communications protocol over which the first data packet is to be transmitted to the first connected device;
determining, by the one or more network devices, to allow transmission of the second data packet to the network device responsive to applying, to the second data packet, the one or more network policies using the second node identifier of the second tuple; and
transmitting, by the one or more network devices, the second data packet to the first connected device.

### Claim 2 (depends on 1)

The method of claim 1, wherein the first tuple includes a first source IP address assigned to a first source device from which the first data packet originated and wherein the second tuple includes either the first source IP address or a second source IP address assigned to the first source device from which the second data packet originated.

### Claim 3 (depends on 1)

The method of claim 1, wherein the first tuple includes a first source IP address assigned to a first source device from which the first data packet originated and wherein the second tuple includes a second source IP address assigned to a second source device from which the second data packet originated.

### Claim 4 (depends on 1)

The method of claim 1, wherein the programmable switch device is a first programmable switch device and the method further comprising:
identifying, by the one or more network devices, a third data packet destined for the first connected device communicatively coupled to a second programmable switch device;
identifying, by the one or more network devices, a third tuple including a third node identifier identifying the first connected device, the third node identifier generated i) using at most two of a) the first MAC address, b) the first IP address, or c) the first communications protocol and ii) using at least one of a) a second MAC address of the third connected device, b) a second IP address assigned to the first connected device, or c) a second communications protocol over which the first data packet is to be transmitted to the first connected device;
determining, by the one or more network devices, to restrict transmission of the third data packet to the first connected device responsive to applying, to the third data packet, the one or more network policies using the third node identifier of the third tuple; and
dropping, by the one or more network devices, the third data packet prior to transmission to the first connected device.

### Claim 5 (depends on 1)

The method of claim 1, wherein the programmable switch device is a first programmable switch device and the method further comprising:
identifying, by the one or more network devices, a third data packet destined for a second connected device communicatively coupled to a second programmable switch device;
identifying, by the one or more network devices, a third tuple including a third node identifier identifying the second connected device, the third node identifier generated using a second MAC address of the second connected device, a second IP address assigned to the second connected device and a communications protocol over which the third data packet is to be transmitted to the second connected device;
determining, by the one or more network devices, to restrict transmission of the third data packet to the second connected device responsive to applying, to the third data packet, the one or more network policies using the third node identifier of the third tuple; and
dropping, by the one or more network devices, the third data packet prior to transmission to the second connected device.

### Claim 6 (depends on 1)

The method of claim 1, wherein the one or more network policies include a set of defined rules.

### Claim 7 (depends on 1)

The method of claim 1, wherein the one or more network policies are configured by at least one machine learning algorithm, Artificial Intelligence (AI) or automation technique.

### Claim 8 (depends on 1)

The method of claim 1, wherein the first tuple includes the first port identifier identifying the first port of the programmable switching device and the first switch identifier identifying the programmable switching device.

### Claim 9 (depends on 1)

The method of claim 1, wherein the one or more network devices includes a controller and wherein the controller is configured to maintain a list of switch identifiers including a first switch identifier identifying the programmable switch device and a second switch identifier identifying a second programmable switch device.

### Claim 10

A system comprising:
one or more network devices including one or more processors, the one or more network devices configured to:
identify a first data packet destined for a first connected device communicatively coupled to a first port of a programmable switch device;
identify a first tuple including a first node identifier identifying the first connected device, the first node identifier generated using a first MAC address of the first connected device, a first IP address assigned to the first connected device, and a first communications protocol over which the first data packet is to be transmitted to the first connected device;
determine to restrict transmission of the first data packet to the first connected device responsive to applying, to the first data packet, one or more network policies using the first node identifier of the first tuple, and a first port identifier identifying the first port of the programmable switching device and a first switch identifier identifying the programmable switching device, wherein the one or more network policies are configured by a controller included in the one or more network devices responsive to analyzing data flow characteristics of data packets routed through the one or more network devices;
drop the first data packet prior to transmission to the first connected device;
identify a second data packet destined for the first connected device;
identify a second tuple including a second node identifier identifying the first connected device, the second node identifier generated i) using at most two of a) the first MAC address, b) the first IP address, or c) the first communications protocol and ii) using at least one of a) a second MAC address of the first connected device, b) a second IP address assigned to the first connected device, or c) a second communications protocol over which the first data packet is to be transmitted to the first connected device;
determine to allow transmission of the second data packet to the network device responsive to applying, to the second data packet, the one or more network policies using the second node identifier of the second tuple; and
transmit the second data packet to the first connected device.

### Claim 11 (depends on 10)

The system of claim 10, wherein the first tuple includes a first source IP address assigned to a first source device from which the first data packet originated and wherein the second tuple includes either the first source IP address or a second source IP address assigned to the first source device from which the second data packet originated.

### Claim 12 (depends on 10)

The system of claim 10, wherein the first tuple includes a first source IP address assigned to a first source device from which the first data packet originated and wherein the second tuple includes a second source IP address assigned to a second source device from which the second data packet originated.

### Claim 13 (depends on 10)

The system of claim 10, wherein the programmable switch device is a first programmable switch device and the one or more network devices further configured to:
identify a third data packet destined for the first connected device communicatively coupled to a second programmable switch device;
identify a third tuple including a third node identifier identifying the first connected device, the third node identifier generated i) using at most two of a) the first MAC address, b) the first IP address, or c) the first communications protocol and ii) using at least one of a) a second MAC address of the third connected device, b) a second IP address assigned to the first connected device, or c) a second communications protocol over which the first data packet is to be transmitted to the first connected device;
determine to restrict transmission of the third data packet to the first connected device responsive to applying, to the third data packet, the one or more network policies using the third node identifier of the third tuple; and
drop the third data packet prior to transmission to the first connected device.

### Claim 14 (depends on 10)

The system of claim 10, wherein the programmable switch device is a first programmable switch device and the one or more network devices further configured to:
identify a third data packet destined for a second connected device communicatively coupled to a second programmable switch device;
identify a third tuple including a third node identifier identifying the second connected device, the third node identifier generated using a second MAC address of the second connected device, a second IP address assigned to the second connected device and a communications protocol over which the third data packet is to be transmitted to the second connected device;
determine to restrict transmission of the third data packet to the second connected device responsive to applying, to the third data packet, the one or more network policies using the third node identifier of the third tuple; and
drop the third data packet prior to transmission to the second connected device.

### Claim 15 (depends on 10)

The system of claim 10, wherein the one or more network policies include a set of defined rules.

### Claim 16 (depends on 10)

The system of claim 10, wherein the one or more network policies are configured by at least one machine learning algorithm, Artificial Intelligence (AI) or automation technique.

### Claim 17 (depends on 10)

The system of claim 10, wherein the first tuple includes the first port identifier identifying the first port of the programmable switching device and the first switch identifier identifying the programmable switching device.

### Claim 18 (depends on 10)

The system of claim 10, wherein the one or more network devices includes a controller and wherein the controller is configured to maintain a list of switch identifiers including a first switch identifier identifying the programmable switch device and a second switch identifier identifying a second programmable switch device.

### Claim 19 (depends on 10)

The system of claim 10, wherein the one or more network policies include a set of defined rules that creates network security-based isolation between the networked devices.

### Claim 20 (depends on 10)

The system of claim 10, wherein the one or more network policies include a set of defined rules that creates network security-based segmentation between the networked devices.