Method to enable deep packet inspection (DPI) in openflow-based software defined network (SDN)

A non-transitory computer readable storage medium having embodied thereon a program executable by a processor to perform a method for inspecting packets, the method comprising:

• communicating with a firewall over a network interface according to an Open Flow standard with extended capabilities, wherein at least one communication between a network switch and the firewall includes information relating to a deep packet inspection (DPI) function and one or more fields of information that are associated with the DPI function,
• receiving a series of discrete packets at the network switch;
• sending a plurality of communications from the network switch to the firewall, wherein at least some of the sent communications include at least a portion of a plurality of packets of the series of discrete packets, and wherein the firewall performs DPI on at least the portion of the plurality of packets sent to the firewall based on the information included in the one or more fields that are associated with the DPI function;
• receiving one or more communications by the network switch from the firewall;
• identifying that at least one of the one or more communications received by the network switch from the firewall includes an allow message associated with a first packet of the series of discrete packets;
• and
• sending the first packet from the network switch to a destination based on the received allow message.

A network switch apparatus for packet inspection, the apparatus comprising:

• a network interface that:
• communicates with a firewall according to an Open Flow standard with extended capabilities, wherein at least one communication with the firewall includes information relating to a deep packet inspection (DPI) function and one or more fields of information that are associated with the DPI function,
• receives a series of discrete packets,
• sends a plurality of communications to the firewall, wherein at least some of the sent communications include at least a portion of a plurality of packets of the series of discrete packets, and wherein the firewall performs DPI on at least the portion of the plurality of packets sent to the firewall based on the information included in the one or more fields that are associated with the DPI function;
• and
• receives one or more communications from the firewall;
• and
• a hardware processor that executes instructions stored in memory, wherein execution of the instructions by the processor identifies that at least one of the one or more communications received by the network switch from the firewall includes an allow message associated with a first packet of the series of discrete packets;
• wherein the network interface sends the first packet to a destination based on the received allow message.