# US 12,192,102 B2 · System and method for transport overhead and header field cybersecurity > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,102 B2 - Document ID: US12192102B2 - Status: Granted - Kind: B2 - Application number: 17/586,628 - Filed: 2022-01-27 - Published: 2023-08-17 - Granted: 2025-01-07 - Earliest claimed: 2022-01-27 - Assignees: Eagle Technology, LLC - Applicants: Eagle Technology, LLC - Inventors: Cypryan T. Klish, II - Web page: https://patentgrep.com/patent/US12192102B2 ## CPC - H04L 45/74: Address processing for routing - H04L 47/12: Avoiding congestion; Recovering from congestion - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods for improving network element security. The methods comprise: obtaining a transport frame by the network element; analyzing, by the network element, the transport frame to determine whether or not any vulnerable overhead field values in at least one of a header of a mapping layer frame and a header of a transport layer frame have values other than expected values; modifying, by the network element, at least one reserved target field value in the transport frame when a determination is made that the at least one vulnerable overhead field value has a value other than the expected value; and communicating, by the network element, the transport frame with the modified at least one reserved target value over a network. ## Claims ### Claim 1 A method for improving network element security, comprising: obtaining a transport frame by a network element; analyzing, by the network element, the transport frame to determine whether or not any vulnerable overhead field values in at least one octet of a header of a mapping layer frame and overhead octets of a transport layer frame have values other than expected values; obtaining, by the network element, a policy or rule for processing the transport frame in response to a determination that at least one vulnerable overhead field value of the vulnerable overhead field values has a value other than the expected value; modifying, by the network element, at least one reserved target field value in the transport frame when a determination is made that the at least one vulnerable overhead field value has a value other than the expected value; and communicating, by the network element, the transport frame with the modified at least one reserved target value over a network or to a mapping layer formatting circuit; wherein the policy or rule requires that the network element ignore that a given vulnerable overhead field value of the vulnerable overhead field values has a value other than the expected value, and communicate the transport frame over a network when all other ones of the vulnerable overhead field values have the expected values. ### Claim 2 (depends on 1) The method according to claim 1, further comprising communicating the transport frame over a network when a determination is made that each of the vulnerable overhead field values has the expected value. ### Claim 3 (depends on 1) The method according to claim 1, wherein the policy or rule further requires that the at least one reserved target field value be set to the expected value, be set to zero, or be set to a pre-defined value for preventing an infiltration of a given network. ### Claim 4 (depends on 1) The method according to claim 1, wherein the policy or rule further requires that the network element issue an alarm or output a notification. ### Claim 5 (depends on 1) The method according to claim 1, wherein the policy or rule is selected based on a result from performance of a machine learning algorithm to detect a pattern of values in the vulnerable overhead field values in at least one of the header of the mapping layer frame and the header of the transport layer frame. ### Claim 6 (depends on 5) The method according to claim 5, wherein the result from the machine learning identifies at least one of a source of malicious activity or a type of malicious activity. ### Claim 7 (depends on 1) The method according to claim 1, wherein the mapping layer frame comprises a Generic Framing Procedure (GFP) frame, an Asynchronous Mapping Procedure (AMP) frame, a Bit-synchronous Mapping Procedure (BMP) frame, Generic Mapping Procedure (GMP) or an Idle Mapping Procedure (IMP) frame. ### Claim 8 (depends on 1) The method according to claim 1, wherein the transport layer frame comprises an Optical Transport Network (OTN) frame, a Synchronous Digital Hierarchy (SDH) network frame, or a Synchronous Optical Network (SONET) frame. ### Claim 9 A system, comprising: a processor; a non-transitory computer-readable storage medium comprising programming instructions that are configured to cause the processor to implement a method for improving network element security, wherein the programming instructions comprise instructions to: obtain a transport frame; analyze the transport frame to determine whether or not any reserved overhead field values in at least one of a header of a mapping layer frame and a header of a transport layer frame have values other than expected values; obtain a policy or rule for processing the transport frame in response to a determination that at least one vulnerable overhead field value of the vulnerable overhead field values has a value other than the expected value; modify at least one reserved target field value in the transport frame when a determination is made that the at least one reserved overhead field value has a value other than the expected value; and communicate the transport frame with the modified at least one reserved target value over a network or to a mapping layer formatting circuit; wherein the policy or rule requires that the network element ignore that a given vulnerable overhead field value of the vulnerable overhead field values has a value other than the expected value, and communicate the transport frame over a network when all other ones of the vulnerable overhead field values have the expected values. ### Claim 10 (depends on 9) The system according to claim 9, wherein the programming instructions comprise instructions to communicate the transport frame over a network when a determination is made that each of the vulnerable overhead field values has the expected value. ### Claim 11 (depends on 9) The system according to claim 9, wherein the policy or rule further requires that the at least one reserved target field value be set to the expected value, be set to zero, or be set to a pre-defined value for preventing an infiltration of a given network. ### Claim 12 (depends on 9) The system according to claim 9, wherein the policy or rule further requires that the network element issue an alarm or output a notification. ### Claim 13 (depends on 9) The system according to claim 9, wherein the policy or rule is selected based on a result from performance of a machine learning algorithm to detect a pattern of values in the vulnerable overhead field values in at least one of the header of the mapping layer frame and the header of the transport layer frame. ### Claim 14 (depends on 13) The system according to claim 13, wherein the result from the machine learning identifies at least one of a source of malicious activity or a type of malicious activity. ### Claim 15 (depends on 9) The system according to claim 9, wherein the mapping layer frame comprises a Generic Framing Procedure (GFP) frame, an Asynchronous Mapping Procedure (AMP) frame, a Bit-synchronous Mapping Procedure (BMP) frame, Generic Mapping Procedure (GMP) or an Idle Mapping Procedure (IMP) frame. ### Claim 16 (depends on 9) The system according to claim 9, wherein the transport layer frame comprises an Optical Transport Network (OTN) frame, a Synchronous Digital Hierarchy (SDH) network frame, or a Synchronous Optical Network (SONET) frame.