System and method for security service collaboration
AssigneeTelefonaktiebolaget LM Ericsson (publ)
InventorsDaniel Migault, Makan Pourzandi, Bruno Medeiros de Barros, Tereza Cristina Carvalho, Thiago Rodrigues Meira de Almeida
Life of this patent
Estimating the term…
Abstract
Systems and methods are provided for mitigating security attacks by enabling collaboration between security service functions. A Service Function Chaining (SFC) node receives a packet and determines whether to apply a service function to the packet. Responsive to determining that the packet has been treated by the service function, the packet can be reclassified and switched to a different SFC path.
Claims21
A method at a service function chaining (SFC) node, comprising:
- receiving a packet including a first SFC Path identifier (ID) and a first SFC Index;
- determining whether to apply a first service function to the packet;
- setting a treated indicator in the packet in accordance with applying the first service function to the packet;
- and one of:
- responsive to determining that the packet has not been treated by the first service function:
- forwarding the packet in accordance with first SFC Path ID and first SFC Index;
- or
- responsive to determining that the packet has been treated by the first service function:
- selecting a second SFC Path ID and a second SFC Index associated with the first SFC Path ID and the first SFC Index;
- modifying the packet by replacing the first SFC Path ID and first SFC Index with the second SFC Path ID and second SFC Index;
- and
- forwarding the modified packet in accordance with the second SFC Path ID and second SFC Index.
A service function chaining (SFC) node comprising circuitry including a processor and a memory, the memory containing instructions executable by the processor whereby the SFC node is operative to:
- receive a packet including a first SFC Path identifier (ID) and a first SFC Index;
- determine whether to apply a first service function to the packet;
- set a treated indicator in the packet in accordance with applying the first service function to the packet;
- and one of:
- responsive to determining that the packet has not been treated by the first service function:
- forward the packet in accordance with first SFC Path ID and first SFC Index;
- or
- responsive to determining that the packet has been treated by the first service function:
- select a second SFC Path ID and a second SFC Index associated with the first SFC Path ID and the first SFC Index;
- modify the packet by replacing the first SFC Path ID and first SFC Index with the second SFC Path ID and second SFC Index;
- and
- forward the modified packet in accordance with the second SFC Path ID and second SFC Index.
A non-transitory computer readable storage medium storing executable instructions, which when executed by a processor, cause the processor to:
- receive a packet including a first SFC Path identifier (ID) and a first SFC Index;
- determine whether to apply a first service function to the packet;
- set a treated indicator in the packet in accordance with applying the first service function to the packet;
- and one of:
- responsive to determining that the packet has not been treated by the first service function:
- forward the packet in accordance with first SFC Path ID and first SFC Index;
- or
- responsive to determining that the packet has been treated by the first service function:
- select a second SFC Path ID and a second SFC Index associated with the first SFC Path ID and the first SFC Index;
- modify the packet by replacing the first SFC Path ID and first SFC Index with the second SFC Path ID and second SFC Index;
- and
- forward the modified packet in accordance with the second SFC Path ID and second SFC Index.
Dependencies are inferred from the claim text.