# US 2016/0366191 A1 · Single Proxies in Secure Communication Using Service Function Chaining > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2016/0366191 A1 - Document ID: US20160366191A1 - Status: Published application - Kind: A1 - Application number: 14/734,164 - Filed: 2015-06-09 - Published: 2016-12-15 - Earliest claimed: 2015-06-09 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Prashanth Patil; Tirumaleswar Reddy; Daniel G. Wing; James Guichard - Web page: https://patentgrep.com/patent/US20160366191A1 ## CPC - H04L 65/1069: Session establishment or de-establishment - H04L 63/0281: {Proxies} - H04L 63/0471: {applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding} - H04L 63/166: {at the transport layer} - H04L 67/141: Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) - H04L 67/56: Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A first service node receives a message configured to set up a secure communication session between a client and a server, in which the first service node acts as a proxy. Data packets in the secure communication session are subject to multiple service functions that require decryption of the data packets. A service function chain assigns a service node to each of the service functions. A service header is generated including metadata instructing the service nodes other than the first service node not to act as proxies in the secure communication session. The message and the service header are transmitted to a second service node in the service function chain. ## Claims ### Claim 1 A method comprising: receiving at a first service node among a plurality of service nodes, a message configured to set up a secure communication session between a client and a server, the first service node acting as a proxy in the secure communication session, wherein data packets in the secure communication session are subject to a plurality of service functions; determining a service chain comprising an assignment of at least one of the plurality of service nodes to each of the plurality of service functions; generating a first service header comprising metadata indicating that the service nodes other than the first service node will not act as proxies in the secure communication session; and transmitting the message and the first service header to a second service node in the service chain. ### Claim 2 (depends on 1) The method of claim 1, further comprising: receiving the data packets in the secure communication session; generating a second service header comprising cryptographic information related to the secure communication session; and transmitting the data packets in the secure communication session with the second service header to the second service node in the service chain. ### Claim 3 (depends on 2) The method of claim 2, further comprising processing the data packets in the secure communication session with at least one service function among the plurality of service functions. ### Claim 4 (depends on 2) The method of claim 2, wherein the cryptographic information comprises at least one of an encryption key, a decryption key, a Message Authentication Code (MAC) key, or a cipher suite. ### Claim 5 (depends on 2) The method of claim 2, further comprising encrypting the cryptographic information related to the secure communication session in the second service header. ### Claim 6 (depends on 1) The method of claim 1, further comprising dividing the secure communication session into a first session between the client and the first service node and a second session between the first service node and the server. ### Claim 7 (depends on 6) The method of claim 6, further comprising: receiving the data packets in the secure communication session from the client in the first session; encrypting cryptographic information related to the second session; generating a second service header comprising the encrypted cryptographic information; and transmitting the data packets in the secure communication session with the second service header to the second service node in the service chain. ### Claim 8 An apparatus comprising: a network interface unit configured to send and receive communications over a network; and a processor configured to: receive, via the network interface unit, a message configured to set up a secure communication session between a client and a server, the apparatus acting as a proxy in the secure communication session, wherein data packets in the secure communication session are subject to a plurality of service functions; determine a service chain comprising an assignment of at least one service node among a plurality of service nodes to each of the plurality of service functions; generate a first service header comprising metadata indicating that the service nodes other than the apparatus will not act as proxies in the secure communication session; and transmitting, via the network interface unit, the message and the first service header to a next service node in the service chain. ### Claim 9 (depends on 8) The apparatus of claim 8, wherein the processor is further configured to: receive the data packets in the secure communication session via the network interface unit; generate a second service header comprising cryptographic information related to the secure communication session; and transmit, via the network interface unit, the data packets in the secure communication session with the second service header to the next service node in the service chain. ### Claim 10 (depends on 9) The apparatus of claim 9, wherein the processor is further configured to process the data packets in the secure communication session with at least one service function among the plurality of service functions. ### Claim 11 (depends on 9) The apparatus of claim 9, wherein the cryptographic information comprises at least one of an encryption key, a decryption key, a Message Authentication Code (MAC) key, or a cipher suite. ### Claim 12 (depends on 9) The apparatus of claim 9, wherein the processor is further configured to encrypt the cryptographic information related to the secure communication session in the second service header. ### Claim 13 (depends on 8) The apparatus of claim 8, wherein the processor is further configured to divide the secure communication session into a first session between the client and the apparatus and a second session between the apparatus and the server. ### Claim 14 (depends on 13) The apparatus of claim 13, wherein the processor is further configured to: receive, via the network interface unit, the data packets in the secure communication session from the client in the first session; encrypt cryptographic information related to the second session; generate a second service header comprising the encrypted cryptographic information; and transmit, via the network interface unit, the data packets in the secure communication session with the second service header to the next service node in the service chain. ### Claim 15 A method comprising: receiving at a service node among a plurality of service nodes, a message configured to set up a secure communication session between a client and a server, wherein data packets in the secure communication session are subject to a plurality of service functions according to a service chain comprising the plurality of service nodes; receiving a first service header comprising metadata indicating that the service node will not act as a proxy in the secure communication session; and transmitting the message and the first service header to a next service node in the service chain. ### Claim 16 (depends on 15) The method of claim 15, further comprising: receiving the data packets in the secure communication session; receiving a second service header comprising cryptographic information related to the secure communication session; decrypting the data packets with the cryptographic information; and processing the decrypted data packets with at least one service function among the plurality of service functions. ### Claim 17 (depends on 16) The method of claim 16, further comprising transmitting the data packets which have been processed and the second service header to the next service node in the service chain. ### Claim 18 (depends on 16) The method of claim 16, further comprising: re-encrypting the decrypted data packets that have been processed with the at least one service function; and transmitting the re-encrypted data packets and the second service header to the next service node in the service chain. ### Claim 19 (depends on 16) The method of claim 16, wherein the cryptographic information comprises at least one of an encryption key, a decryption key, a Message Authentication Code (MAC) key, or a cipher suite. ### Claim 20 (depends on 16) The method of claim 16, further comprising encrypting the cryptographic information related to the secure communication session in the second service header.