Agent filters unwanted traffic and replaces redundant payloads with identifiers
A network-side or host-side processing agent enforces communication-group membership and malware/fraud signature policy and reduces bandwidth by replacing packet payload portions that match previously delivered content with identifiers (hashcodes) plus checksums. Agents run at source, in-network, or at destination; destination agents reassemble content when they receive identifiers. Enterprises and cloud providers are the primary users.
(57) What the patent covered
This write-up was generated by AI from the patent's text and may contain mistakes, so check it against the original patent before relying on it.
The independent claim covers a processing agent that, before forwarding a packet to a destination, checks that the packet is allowed by a communication-group membership policy, scans the packet for malware/fraud signatures, identifies portions of the packet payload that duplicate content previously received by the destination, removes the duplicate portion from the packet, inserts an identifier and checksum in the header to indicate the duplicate, and then sends the altered packet to the destination so the destination can reconstruct the original content.
Distinguishing feature: Combining per-packet group-membership access control and malware/fraud filtering with in-flight redundancy elimination by substituting identifiers for duplicate payload segments.
Novelty 3/5. Per-flow access control and malware scanning were common; the added element was on-path redundancy elimination tied to destination-side reconstruction, which was a notable improvement over ordinary packet filters.
Implementation
A small team would implement a user-space or eBPF-based agent on hypervisors or top-of-rack switches that intercepts outgoing packets, queries a distributed cache for group-membership and for content-hash presence, runs a signature scan, and if safe and duplicate segments are found, replaces segments with fixed-length identifiers and checksum fields in a modified header; a companion agent on the destination validates checksums and rebuilds payloads from cached content. Use existing L4/L7 hooks, Redis or in-memory key-value store for the cache, SHA-256 or fast rolling hashes for identifiers, and TLS-aware handling for encrypted flows (likely requiring integration with endpoints).
Components: Processing agent (host or network function), lookup service or cache for group membership and seen-content records, malware/fraud signature database, hash/identifier generator and checksum logic, destination-side reassembly module.
Buildability 5/5. Main engineering effort is integration with packet path (kernel/eBPF, switch software or SDN) and keeping a low-latency distributed cache of prior content; signature scanning and cache lookups must be performant.
Market demand
No demand check has been run for this patent. Likely search terms: on-path redundancy elimination, packet-level group membership filter, content-hash replacement for duplicate payloads. The links in the sidebar open these searches.
Buyers: Cloud providers, enterprise datacenter operators, virtualized hosting providers.
Before manufacturing
No related continuation or divisional patents in force were found. Design patents, trademarks and unrelated patents may still cover the product.
Practical risks include handling encrypted traffic (requires endpoint cooperation), cache coherence and state growth for seen-content records, and performance/latency tradeoffs when adding signature scans and cache lookups.
About 1.5% of lapsed patents are later revived by their owners. This page is a research lead, not legal advice. Obtain a freedom-to-operate opinion before manufacturing.