On-demand network security system

A non-transitory computer-readable storage medium storing executable instructions that when executed by a computing device cause said computing device to effectuate operations, the operations comprising:

• classifying a single packet authorization request at a first service classifier, wherein the single packet authorization request is included in a request for one of a network session and a virtual network function;
• routing the request, via a service function forwarder, to a single packet authorization service function for validation;
• instantiating a security virtual function in response to the request, wherein the instantiating the security virtual function occurs after validation of the single packet authorization request;
• and
• configuring the security virtual function to apply at least one connection policy to allow or deny traffic in a data session.

A system comprising:

• one or more processors;
• and
• a memory coupled with the one or more processors, the memory storing executable instructions that when executed by the one or more processors, cause the one or more processors to effectuate operations, the operations comprising:
• receiving a request for one of a network session and a virtual network function, wherein the request includes a single packet authorization request;
• routing the request, via a service function forwarder, to a single packet authorization service function for validation;
• instantiating a security virtual function in response to the request, wherein the instantiating the security virtual function occurs after validation of the single packet authorization request;
• and
• configuring the security virtual function to apply at least one connection policy to allow or deny traffic in a data session.