# US 10,320,748 B2 · Single packet authorization in a cloud computing environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,320,748 B2 - Document ID: US10320748B2 - Status: Granted - Kind: B2 - Application number: 15/441,004 - Filed: 2017-02-23 - Published: 2018-08-23 - Granted: 2019-06-11 - Earliest claimed: 2017-02-23 - Assignees: AT&T Intellectual Property I, L.P. - Applicants: AT&T Intellectual Property I, L.P. - Inventors: Michael Stair; Daniel Solero - Web page: https://patentgrep.com/patent/US10320748B2 ## CPC - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/108: {when the policy decisions are valid for a limited amount of time} - H04W 12/088: using filters or firewalls - H04L 63/0263: {Rule management} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Concepts and technologies disclosed herein are directed to single packet authorization (“SPA”) in a cloud computing environment. A compute node can include a virtual switch operating on at least a portion of a plurality of hardware resources of a cloud computing environment, a virtual firewall, a cloud workload executing a cloud service, and a SPA service. The virtual switch can receive a SPA request from a SPA client executing on a computing device. The virtual switch can forward the SPA request to the virtual firewall and to the SPA service. The virtual firewall can deny the SPA request in accordance with a firewall policy. The SPA service can utilize a SPA validation scheme to validate the SPA request. The virtual firewall can implement a temporary firewall policy to allow incoming packets from the SPA client and directed to the cloud service. ## Claims ### Claim 1 A compute node comprising: a virtual switch operating on at least a portion of a plurality of hardware resources of a cloud computing environment; a virtual firewall; a cloud workload executing a cloud service; and a single packet authorization service; wherein the virtual switch receives a single packet authorization request from a single packet authorization client executing on a computing device external to and in communication with the cloud computing environment via a network, and forwards the single packet authorization request to the virtual firewall and to the single packet authorization service; and wherein the virtual firewall denies the single packet authorization request in accordance with a firewall policy; wherein the single packet authorization service utilizes a single packet authorization validation scheme to validate the single packet authorization request; and wherein the virtual firewall implements a temporary firewall policy to allow incoming packets from the single packet authorization client and directed to the cloud service. ### Claim 2 (depends on 1) The compute node of claim 1, wherein the cloud workload comprises a virtual machine. ### Claim 3 (depends on 1) The compute node of claim 1, wherein the single packet authorization request is encoded with a credential. ### Claim 4 (depends on 3) The compute node of claim 3, wherein the single packet authorization validation scheme comprises verifying that the credential is valid and that access to the cloud workload is allowed. ### Claim 5 (depends on 1) The compute node of claim 1, further comprising a software-defined networking controller; and wherein the single packet authorization service is a function of the software-defined networking controller. ### Claim 6 (depends on 1) The compute node of claim 1, wherein the virtual firewall determines whether the temporary firewall policy has expired, and in response to determining that the temporary firewall policy has expired, denying incoming packets from the single packet authorization client. ### Claim 7 (depends on 1) The compute node of claim 1, further comprising a further cloud workload; and wherein the single packet authorization service also serves the further cloud workload. ### Claim 8 (depends on 1) The compute node of claim 1, wherein the single packet authorization request specifies a port and a protocol to be allowed in accordance with the temporary firewall policy. ### Claim 9 A method comprising: receiving, by a virtual switch operating on a compute node that, in turn, is operating on at least a portion of a plurality of hardware resources of a cloud computing environment, a single packet authorization request from a single packet authorization client executing on a computing device external to and in communication with the cloud computing environment via a network; forwarding, by the virtual switch, the single packet authorization request to a virtual firewall and to a single packet authorization service; denying, by the virtual firewall, the single packet authorization request in accordance with a firewall policy; utilizing, by the single packet authorization service, a single packet authorization validation scheme to validate the single packet authorization request; and implementing, by the virtual firewall, a temporary firewall policy to allow incoming packets from the single packet authorization client and directed to a cloud workload executing a cloud service within the compute node. ### Claim 10 (depends on 9) The method of claim 9, wherein the cloud workload comprises a virtual machine. ### Claim 11 (depends on 9) The method of claim 9, wherein the single packet authorization request is encoded with a credential. ### Claim 12 (depends on 11) The method of claim 11, wherein the single packet authorization validation scheme comprises verifying that the credential is valid and that access to the cloud workload is allowed. ### Claim 13 (depends on 9) The method of claim 9, further comprising determining whether the temporary firewall policy has expired, and in response to determining that the temporary firewall policy has expired, denying incoming packets from the single packet authorization client. ### Claim 14 (depends on 9) The method of claim 9, wherein the single packet authorization request specifies a port and a protocol to be allowed in accordance with the temporary firewall policy. ### Claim 15 A computer-readable storage medium having instructions stored thereon that, when executed by at least a portion of processing resources of a plurality of hardware resources of a cloud computing environment, cause the at least the portion of processing resources to perform operations comprising: receiving, by a virtual switch, a single packet authorization request from a single packet authorization client executing on a computing device external to and in communication with the cloud computing environment via a network; forwarding, by the virtual switch, the single packet authorization request to a virtual firewall and to a single packet authorization service; denying, by the virtual firewall, the single packet authorization request in accordance with a firewall policy; utilizing, by the single packet authorization service, a single packet authorization validation scheme to validate the single packet authorization request; and implementing, by the virtual firewall, a temporary firewall policy to allow incoming packets from the single packet authorization client and directed to a cloud workload executing a cloud service within the compute node. ### Claim 16 (depends on 15) The computer-readable storage medium of claim 15, wherein the cloud workload comprises a virtual machine. ### Claim 17 (depends on 15) The computer-readable storage medium of claim 15, wherein the single packet authorization request is encoded with a credential. ### Claim 18 (depends on 17) The computer-readable storage medium of claim 17, wherein the single packet authorization validation scheme comprises verifying that the credential is valid and that access to the cloud workload is allowed. ### Claim 19 (depends on 15) The computer-readable storage medium of claim 15, wherein the operations further comprise determining whether the temporary firewall policy has expired, and in response to determining that the temporary firewall policy has expired, denying incoming packets from the single packet authorization client. ### Claim 20 (depends on 19) The computer-readable storage medium of claim 19, wherein the single packet authorization request specifies a port and a protocol to be allowed in accordance with the temporary firewall policy.