Single Proxies in Secure Communication Using Service Function Chaining

An apparatus comprising:

• a network interface unit configured to send and receive communications over a network;
• and
• a processor configured to:
• receive, via the network interface unit, a message configured to set up a secure communication session between a client and a server, the apparatus acting as a proxy in the secure communication session, wherein data packets in the secure communication session are subject to a plurality of service functions;
• determine a service chain comprising an assignment of at least one service node among a plurality of service nodes to each of the plurality of service functions;
• generate a first service header comprising metadata indicating that the service nodes other than the apparatus will not act as proxies in the secure communication session;
• and
• transmitting, via the network interface unit, the message and the first service header to a next service node in the service chain.

A method comprising:

• receiving at a service node among a plurality of service nodes, a message configured to set up a secure communication session between a client and a server, wherein data packets in the secure communication session are subject to a plurality of service functions according to a service chain comprising the plurality of service nodes;
• receiving a first service header comprising metadata indicating that the service node will not act as a proxy in the secure communication session;
• and
• transmitting the message and the first service header to a next service node in the service chain.