Method and system for providing deep packet inspection as a service
AssigneeYissum Research Development Company of the Hebrew University of Jerusalem
InventorsDavid Hay, Yaron Koral, Yotam Harchol, Anat Brembler-Barr
Life of this patent
Estimating the term…
Abstract
A method and system for providing Deep Packet Inspection (DPI) as a service to a computer network are provided herein. The contribution of embodiments of the present invention is two-folded. First, a possible framework of having DPI deployed as a service is detailed, including the necessary algorithms and required adaptations. Second, the superior performance of the suggested design is demonstrated via simulations. Since the focus is on the algorithmic aspects and network design, an SDN implementation of the suggested design is not provided herein. However, many aspects of such an SDN implementation follow closely the guidelines known in the art.
Claims16
A method for virtualizing a deep packet inspection (DPI), the method comprising the steps of:
- initializing a plurality of different middleboxes in a computer network connectable with a DPI controller which is logically separated from said middleboxes;
- establishing communication between said plurality of different middleboxes and the DPI controller over existing protocols of said computer network;
- and
- deploying DPI instances from the DPI controller to the middleboxes responsive to requests, by combining multiple pattern sets originating from said different middleboxes such that traffic used by more than one of said middleboxes is only scanned once by said DPI controller.
A system for virtualizing a deep packet inspection (DPI), the system comprising:
- a plurality of different middleboxes in a computer network connectable with a deep packet inspection (DPI) controller which is logically separated from said different middleboxes;
- a plurality of network components configured to establishing communication between said plurality of middleboxes and the DPI controller over existing protocols of said computer network;
- and
- a DPI controller configured to deploying DPI instances to the middleboxes responsive to requests, by combining multiple pattern sets originating from said different middleboxes such that traffic used by more than one of said different middleboxes is only scanned once by said DPI controller.
A computer program product for virtualizing a deep packet inspection (DPI), the computer program product comprising:
- a non-transitory computer readable storage medium having computer readable program embodied therewith, the computer readable program comprising:
- computer readable program configured to initialize a plurality of different middleboxes in a computer network connectable with a deep packet inspection (DPI) controller which is logically separated from said different middleboxes;
- computer readable program configured to establish communication between said plurality of different middleboxes and the DPI controller over existing protocols of said computer network;
- and
- computer readable program configured to deploy DPI instances from the DPI controller to the middleboxes responsive to requests, by combining multiple pattern sets originating from said different middleboxes such that traffic used by more than one of said middleboxes is only scanned once by said DPI controller.
Dependencies are inferred from the claim text.