Skip to content

Provisional Patent Application — Inline DUT Validation Tap with Integrated Effectiveness Measurement

DRAFT — for filing 2026-Q4. This document is the operator-facing draft of the provisional patent application. Final formal filing prepared by counsel using this material as input. Lock priority date before public demonstration of HyperBridge.Art on a non-affiliated customer bench.

Cover Sheet

Field Value
Title Inline DUT Validation Tap via Bypass-Capable NIC with Integrated Multi-Pillar Inspection Effectiveness Measurement
Inventor(s) André Luiz Gallon
Assignee TLSStress.Art project (provisional; final entity TBD)
Application type Provisional U.S. patent application (35 U.S.C. § 111(b))
Filing target 2026-Q4 (sequenced after Families B + C — provisional decryption-posture + fast-path detection)
Priority claim Earliest demonstrable conception: 2026-05-13 (ADR 0036 commit). Materialization: HB-1 PR #705 (2026-05-13), HB-2 PR #1025, HB-3 PR #1026, HB-4 PR #1027 (2026-05-24).
Related patent family Patent Family D. Extends Family A (SPAN tiered ingest + cross-correlator) by adding a 6th tier (T6 inline bypass NIC). Couples to Family B (decryption posture) and Family C (fast-path detection) via the shared 6-pillar Inspection Effectiveness Validation framework (ADR 0035).

Field of the Invention

The invention relates to network security testing and, more particularly, to a network appliance and methods for measuring the inspection effectiveness of a TLS-decrypting middlebox without requiring switch port mirroring (SPAN) configuration, by combining a bypass-capable inline Network Interface Card (NIC) tap with a multi-pillar effectiveness measurement framework.

Background

Validation of a TLS-inspecting middlebox ("Device Under Test", DUT) typically requires the validator to obtain a packet copy of the DUT's data path. The dominant approach uses switch port mirroring (Cisco SPAN, Arista mirror sessions, etc.) configured on the network switch adjacent to the DUT. Existing inspection-effectiveness validators (including those covered by the inventor's prior art ADR 0035 6-pillar framework) consume this mirrored packet stream as their input.

This approach creates several deployment blockers that exclude a significant addressable market segment:

  1. Switch lacks SPAN capability. Small office / home office customers and prosumer-managed networks frequently run switches without configurable port mirroring.
  2. SPAN sessions exhausted. Data-center customers have SPAN session slots already consumed by SIEM, DLP, or vendor-monitoring agents.
  3. Switch CPU / ASIC budget saturated. Enabling SPAN consumes significant ASIC bandwidth (Cisco Nexus, Arista 7050X, Juniper QFX). Customers operating near platform limits cannot add a SPAN session without performance impact on production traffic.
  4. Compliance restrictions. Regulated environments (financial, government, healthcare) prohibit modification of production switch configuration without a change-control window measured in months.
  5. No DC-grade switch in the path. Customers running unmanaged switches have zero SPAN options.

Existing alternatives are:

  • Commercial network packet brokers (Gigamon GigaVUE, Ixia Vision Edge, cPacket cBroker) — typical price US$30,000–US$100,000+; effective but prohibitively expensive for SMB / mid-market.
  • Passive in-line TAP appliances (Garland INT1G/INT10G, Profitap ProfiShark) — physical T-junctions; do not produce structured packet copies for downstream analysis.
  • Bypass-capable NICs sold as components (Silicom PE-series, Napatech SmartNIC, Endace DAG) — provide the hardware substrate but, on their own, do not perform DUT inspection-effectiveness measurement.

No prior art combines a bypass-capable inline NIC with the operator-side measurement framework required to produce a complete inspection-effectiveness verdict in production traffic without switch SPAN configuration. The invention closes this gap.

Summary of the Invention

A network appliance for measuring the inspection effectiveness of a TLS-decrypting middlebox without dependency on switch port mirroring, comprising:

(a) a network interface card configured as a transparent Layer 2 bridge between an upstream device and the middlebox, with vendor-specific hardware fail-to-wire (T1, e.g., Silicom PE-series via bp_lib ioctl) or software fail-to-wire via Linux kernel bridge fallback (T2, e.g., Mellanox ConnectX), preserving physical link continuity when the bridge service fails;

(b) a packet-copy plane that duplicates traffic traversing the bridge into a structured PacketBatch data stream conforming to a wire format identical to switch-SPAN-fed deployments, such that downstream effectiveness-measurement modules consume from the inline tap and from switch SPAN interchangeably;

(c) a deterministic heartbeat-and-watchdog control plane that monitors the userspace forwarder and, on detected failure (configurable consecutive missed heartbeats), invokes the vendor bypass mechanism — engaging hardware relay (T1) or installing a kernel bridge fallback (T2) within a recovery time consistent with upstream TCP retransmission timers;

(d) a bypass-state event audit log appended to a cryptographic hash chain (SHA-256 chain with genesis prev-hash = SHA-256 of the empty string), enabling tamper-evident retrospective verification of every bypass engagement and recovery;

(e) a coupling to a multi-pillar inspection-effectiveness measurement framework comprising: - a wire-side cross-correlator that pairs the observed packet stream against device-under-test syslog and NetFlow records to identify per-flow disagreements; - a decryption coverage measurement engine operating on observed certificate-issuer evidence; - a fast-path detection engine operating on per-packet latency bimodality and/or mid-session canary signature injection; - a composite effectiveness score derived from the foregoing measurements;

such that the same physical hardware tap delivers both line-rate transparent forwarding of the middlebox's production traffic and complete inspection-effectiveness measurement of that traffic — without requiring switch SPAN configuration, without dependency on commercial network packet brokers, and with a fail-to-wire envelope that protects the operator's production data plane against forwarder service crashes.

Independent Claim

Claim 1. A network appliance for measuring the inspection effectiveness of a TLS-decrypting middlebox, the appliance comprising:

1.1. a bypass-capable network interface card (NIC) having at least two data ports, the NIC configured to operate in a first mode as a transparent Layer 2 bridge passing traffic between the two ports without re-encapsulation, and in a second mode in which the two ports are electrically or programmatically coupled to maintain physical link continuity in the event of a software fault;

1.2. a packet duplication plane configured to copy packets traversing the bridge into a structured packet-batch data stream;

1.3. a heartbeat-and-watchdog controller that monitors the operational state of the packet duplication plane, the controller configured to invoke transition to the second mode in response to a configurable number of consecutive missed heartbeats from the duplication plane;

1.4. a bypass-state event log appended to a cryptographic hash chain such that any subsequent modification of a prior log entry produces a detectable hash-chain mismatch when the chain is re-walked;

1.5. an inspection-effectiveness measurement subsystem coupled to the packet-batch data stream of clause 1.2 and comprising (i) a wire-versus-syslog cross-correlator, (ii) a decryption coverage measurement engine, (iii) a fast-path detection engine, and (iv) a composite effectiveness score derivable from outputs of (i), (ii), and (iii);

wherein the appliance delivers both line-rate transparent forwarding of the middlebox's production traffic and inspection-effectiveness measurement of that traffic without requiring configuration of switch port mirroring on adjacent network infrastructure.

Dependent Claims (planned)

Claim 2 (T1 HW relay embodiment) — The appliance of claim 1, wherein the second mode comprises engagement of a hardware relay on the NIC via a vendor-supplied bypass library call (e.g., bp_set_bypass_state(NIC_HANDLE, BP_STATE_BYPASS)), said engagement completing within 5 to 50 milliseconds.

Claim 3 (T2 SW kernel-bridge embodiment) — The appliance of claim 1, wherein the second mode comprises installation of a kernel bridge by issuing iproute2 commands enslaving both NIC ports into a bridge interface, said installation completing within 200 to 1000 milliseconds, and wherein recovery comprises issuing ip link set ... nomaster to release the ports back to the duplication plane followed by removal of the kernel bridge interface.

Claim 4 (recovery hysteresis) — The appliance of claim 1, wherein the controller restores the first mode only after a configurable hysteresis window of healthy heartbeats has elapsed, the hysteresis window thereby preventing oscillation between modes under transient backpressure.

Claim 5 (wire-format compatibility) — The appliance of claim 1, wherein the packet-batch data stream conforms to a wire format compatible with a switch-SPAN-fed instance of the inspection-effectiveness measurement subsystem, enabling mixed deployments in which a single instance of said subsystem consumes packet-batch streams originating from both an inline NIC tap and one or more switch port mirroring sessions.

Claim 6 (driver registry) — The appliance of claim 1, further comprising a driver registry permitting runtime selection of a vendor-specific NIC backend (e.g., Silicom, Mellanox, Napatech, Endace) without modification of the controller or the duplication plane, the registry enforcing at startup that the selected driver's reported tier matches the deployment's configured tier.

Claim 7 (audit-event ingest to dashboard) — The appliance of claim 1, wherein bypass-state events are mirrored to a persistent datastore enabling a dashboard user interface to render a tamper-evident bypass timeline filtered by tier, vendor driver, and reason, the dashboard further presenting a chain-verification function that re-derives every entry hash and surfaces tampered entries with their failing sequence numbers.

Claim 8 (signed deployment manifest) — The appliance of claim 1, wherein the active driver-tier configuration is bound at boot time to a signed deployment manifest, such that a misconfiguration in which the configured tier disagrees with the loaded driver's reported tier results in a fatal startup error, thereby preventing a production deployment from silently degrading to a lab-only tier without operator awareness.

FTO Scan Plan

Density of prior art in network packet brokers + bypass NICs is HIGH. Prior art to investigate before drafting the formal application:

  • Silicom bypass-NIC patents (US 7,142,539; US 7,433,956 family)
  • Gigamon GigaTAP patent portfolio
  • cPacket Networks (US 8,953,439 series)
  • Apcon (US 8,289,985 series)
  • Ixia / Keysight Network Visibility line
  • Academic literature on inline middlebox monitoring (Akamai, USENIX NSDI papers 2018–2024)
  • Recent NVIDIA BlueField DPU patents

The novelty lever is the combination with the 6-pillar inspection-effectiveness framework (ADR 0035) and the deployment-time tier guard (claim 8), not the bypass NIC primitive itself. FTO scan budget: 6–8 hours of legal / IP work (heavier than Family B + Family C because the bypass-NIC patent space is more crowded than the fast-path-detection space).

Filing sequence: Family B → Family C → Family D, spreading filing fees and counsel bandwidth across 2026-Q3 / Q3 / Q4.

Reduction to Practice

Materialized in the following pull requests (publicly visible commits establish reduction-to-practice for priority-date purposes):

  • HB-1 (2026-05-13) — T3 (lab) software-bridge backend + watchdog + audit log
  • HB-1.6 (2026-05-13) — capture plane → SPAN-1 forwarder
  • HB-1.7 (2026-05-13) — AF_PACKET capture engine
  • HB-1.8 (2026-05-13) — IPFIX synthesizer to FLOW.Art
  • HB-2 (2026-05-24) — Driver HAL + registry + Silicom T1 driver
  • HB-3 (2026-05-24) — Mellanox T2 driver + watchdog DriverBypasser
  • HB-4 (2026-05-24) — Postgres mirror + SHA-256 hash-chain admin viewer
  • HB-5 — this provisional draft + customer datasheet (no software)

The 6-pillar effectiveness framework that the appliance couples to is the subject of:

  • Family A (SPAN tiered ingest + cross-correlator) — ADR 0024 + 0034
  • Family B (decryption posture) — docs/patents/provisional-decryption-posture.md
  • Family C (fast-path detection) — docs/patents/provisional-fast-path-detection.md

References

  • ADR 0036 — HyperBridge.Art inline bypass-capable NIC tap
  • ADR 0035 — DUT Inspection Effectiveness Validation (6-pillar framework)
  • ADR 0034 — 3-way fusion correlator
  • ADR 0029 — Sealed audit log chain
  • ADR 0024 — SPAN.Art line-rate capture (5-tier ingest hierarchy)
  • Memo — discuss_hyperbridge_art_2026_05_13.md (strategic intent)