# US 10,374,922 B2 · In-band, health-based assessments of service function paths > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,374,922 B2 - Document ID: US10374922B2 - Status: Granted - Kind: B2 - Application number: 15/051,809 - Filed: 2016-02-24 - Published: 2017-08-24 - Granted: 2019-08-06 - Earliest claimed: 2016-02-24 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Gonzalo Salgueiro; Joseph Michael Clarke; Carlos M. Pignataro - Web page: https://patentgrep.com/patent/US10374922B2 ## CPC - H04L 43/0817: by checking functioning - H04L 43/091: Measuring contribution of individual network components to actual service level - H04L 43/50: Testing arrangements - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In one embodiment, a device in a network places a path of a service function chain into a testing state. The device causes a self-assessment instruction to be propagated along the path while the path is in the testing state. The device analyzes self-assessment results from nodes along the path. The device adjusts a state of the path based on the analyzed self-assessment results. ## Claims ### Claim 1 A method, comprising: placing into a testing state, by a device in a network, a path of nodes in a computer network that a service function chain traverses; causing, by the device, a self-assessment instruction to be propagated along the path while the path is in the testing state, wherein the self-assessment instruction instructs each node along the path to perform a security posture assessment and a health assessment; analyzing, by the device, self-assessment results from each of the nodes along the path to determine whether the path is secure and healthy; and adjusting, by the device, a state of the path based on the analyzed self-assessment results, wherein adjusting includes: placing, by the device, the path into an inactive state, in response to a determination that the security posture assessment indicates that one or more of the nodes along the path failed the security posture assessment or a determination that the path is not healthy, wherein in the inactive state traffic is not allowed to traverse the path, and placing, by the device, the path into an active state, in response to at least a determination that each of the nodes along the path passes both the security assessment and the health assessment; wherein the self-assessment instruction is an Open Vulnerability Assessment Language (OVAL)-based instruction. ### Claim 2 (depends on 1) The method as in claim 1, wherein the self-assessment instruction is encapsulated in a network service header (NSH). ### Claim 3 (depends on 1) The method as in claim 1, further comprising: receiving, at the device, the self-assessment results from the nodes. ### Claim 4 (depends on 3) The method as in claim 3, wherein the received self-assessment results indicate that a particular node along the path could not process the self-assessment instruction. ### Claim 5 (depends on 1) The method as in claim 1, wherein the OVAL-based instruction is compressed using text compression or binary encoding. ### Claim 6 An apparatus, comprising: one or more network interfaces to communicate with a network; a processor coupled to the network interfaces and configured to execute one or more processes; and a memory configured to store a process executable by the processor, the process when executed operable to: place into a testing state a path of nodes in a computer network that a service function chain traverses; cause a self-assessment instruction to be propagated along the path while the path is in the testing state, wherein the self-assessment instruction instructs each node along the path to perform a security posture assessment and a health assessment; analyze self-assessment results from each of the nodes along the path to determine whether the path is secure and healthy; and adjust a state of the path based on the analyzed self-assessment results, wherein adjusting includes: placing the path into an inactive state, in response to a determination that the security posture assessment indicates that one or more of the nodes along the path failed the security posture assessment or a determination that the path is not healthy, wherein in the inactive state traffic is not allowed to traverse the path, and placing the path into an active state, in response to at least determination that each of the nodes along the path passes both the security assessment and the health assessments; wherein the self-assessment instruction is an Open Vulnerability Assessment Language (OVAL)-based instruction. ### Claim 7 (depends on 6) The apparatus as in claim 6, wherein the self-assessment instruction is encapsulated in a network service header (NSH). ### Claim 8 (depends on 6) The apparatus as in claim 6, wherein the process when executed is further operable to: receive the self-assessment results from the nodes. ### Claim 9 (depends on 8) The apparatus as in claim 8, wherein the received self-assessment results indicate that a particular node along the path could not process the self-assessment instruction. ### Claim 10 (depends on 6) The apparatus as in claim 6 wherein the OVAL-based instruction is compressed using text compression or binary encoding. ### Claim 11 A tangible, non-transitory, computer-readable media having software encoded thereon, the software when executed by a processor operable to: place into a testing state a path of nodes in a computer network that a service function chain traverses; cause a self-assessment instruction to be propagated along the path while the path is in the testing state, wherein the self-assessment instruction instructs each node along the path to perform a security posture assessment and a health assessment; analyze self-assessment results from each of the nodes along the path to determine whether the path is secure and healthy; and adjust a state of the path based on the analyzed self-assessment results, wherein adjusting includes: placing the path into an inactive state, in response to a determination that the security posture assessment indicates that one or more of the nodes along the path failed the security posture assessment or a determination that the path is not healthy, wherein in the inactive state traffic is not allowed to traverse the path, and placing the path into an active state, in response to at least a determination that each of the nodes along the path passes both the security assessment and the health assessments; wherein the self-assessment instruction is an Open Vulnerability Assessment Language (OVAL)-based instruction. ### Claim 12 (depends on 11) The computer-readable media as in claim 11, wherein the self-assessment instruction is encapsulated in a network service header (NSH).