US 10,757,105 B2Granted

On-demand network security system

AssigneeAT&T Intellectual Property I, L.P.

InventorsMichael Stair, Edward Hope

Life of this patent

Estimating the term…

Loading patent…

Abstract

An on-demand virtual security system between a client and a server in communication with a network, the system including an orchestrator, wherein upon receiving a service request from at least one of the client and the server, the orchestrator instantiates a security virtual function within the network and supplies the security virtual function with at least one connectivity policy, and wherein the security virtual function applies the at least one connectivity policy to approve or disapprove a connection between the client and the server and wherein upon the security virtual function approving the connection between the client and the server, a orchestrator establishes a data session; and wherein after the data session has concluded, the orchestrator terminates the security virtual function.

Claims18

Dependent claims

An on-demand virtual security system between a client and a server in communication with a network, the system comprising:

a processor;
an orchestrator coupled with the processor;
and
a memory coupled with the processor, the memory storing executable instructions that when executed by the processor cause the processor to effectuate operations comprising:
receiving a service request from at least one of the client and the server;
in response to receiving the service request, instantiating, by the orchestrator, a security virtual function within the network and supplying the security virtual function with at least one connectivity policy;
applying, by the security virtual function, the at least one connectivity policy to approve or disapprove a connection between the client and the server;
in response to the security virtual function approving the connection between the client and the server, establishing a data session via the orchestrator;
and
in response to the data session concluding, terminating the security virtual function via the orchestrator;
and
an access router and an aggregation router in communication with the orchestrator, wherein the service request is transmitted from the access router to the orchestrator;
and wherein the security virtual function is located downstream of the access router and upstream of the aggregation router, and wherein the data session is established by connecting the access router to the aggregation router.

10 more elements

A network device comprising:

a processor;
an input/output device coupled with the processor;
and
a memory coupled with the processor, the memory comprising executable instructions that when executed by the processor cause the processor to effectuate operations comprising:
receiving a request for one of a network session and a virtual network function, wherein the request includes a single packet authorization request;
classifying the single packet authorization request at a first service classifier;
routing the request, via a service function forwarder, to a single packet authorization service function for validation;
instantiating a security virtual function in response to the request, wherein instantiating the security virtual function occurs after validation of the single packet authorization request;
configuring the security virtual function to apply at least one connection policy to allow or deny traffic in a data session;
and
in response to allowing the data session, terminating the security virtual function after the data session has concluded.

8 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/619,757Filed 12 Jun 2017
Published: US 2018/0359255 A113 Dec 2018
Granted: 25 Aug 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification10 codes

H04L 63/10
Network architectures or network communication protocols for network security: for controlling access to devices or network resources
G06F 21/31
Authentication, i.e. establishing the identity or authorisation of security principals: user authentication
G06F 21/44
Authentication, i.e. establishing the identity or authorisation of security principals: program or device authentication
G06F 21/45
Authentication, i.e. establishing the identity or authorisation of security principals: structures or tools for the administration of authentication