Policy driven service insertion with middleware for cloud applications
AssigneePalo Alto Networks, Inc.
InventorMin Hao Chen
Life of this patent
Estimating the term…
Abstract
Middleware forwards packets to a service prior to modification according to functionality of the middleware. Packets received from the service are identified as having been previously received. The packets are then modified by the middleware and forwarded to a destination. A hash of a packet and a TTL thereof may be stored by the middleware prior to forwarding the packet to the service. The TTL of the packet may be decremented before forwarding. A packet having a hash matching a stored hash and a TTL lower than the stored TTL may be deemed to have been previously received. Modification may include NAT, encryption, and/or description. The service may be a firewall, IDS, and/or IPS.
Claims20
A method comprising:
- receiving, by middleware executing on a computing device, a first packet from a source;
- (a) determining, by the middleware, by evaluating the first packet with respect to a policy, that the first packet should be sent to a service that is not a destination referenced by the first packet;
- and
- in response to (a):
- forwarding, by the middleware, the first packet to a service that is not a destination referenced by the first packet;
- receiving, by the middleware, a second packet from the service;
- determining, by the middleware, that the second packet matches the first packet;
- and
- in response to determining that the second packet matches the first packet, forwarding, by the middleware, the second packet to the destination.
A system comprising:
- one or more processing devices;
- one or more memory devices coupled to the one or more processing devices, the one or more memory devices storing executable code that, when executed by the one or more processing devices, causes the one or more processing devices to:
- receive, by middleware executed by the one or more processing devices, a first packet from a source;
- forward, by the middleware, the first packet to a service that is not a destination referenced by the first packet;
- receive, by the middleware, a second packet from the service;
- determine, by the middleware, that the second packet matches the first packet;
- and
- in response to determining that the second packet matches the first packet, forward, by the middleware, the second packet to the destination.
Dependencies are inferred from the claim text.