Secure service chaining

Patent metadata

Field	Value
Publication number	US-10798187-B2
Application number	US-201715627084-A
Country	US
Kind code	B2
Filing date	Jun 19, 2017
Priority date	Jun 19, 2017
Publication date	Oct 6, 2020
Grant date	Oct 6, 2020

Abstract

In one embodiment, secure service chaining can be implemented efficiently for content delivery systems. An orchestrator can determine a service chain for processing a request from a client for content. The orchestrator can determine a capability identifying nodes of the service chain. The orchestrator can then transmit, to the client, a redirect message having the capability, wherein the redirect message redirects the request to a first node of the service chain. The nodes of the service chain can verify the capability and carry out the service chain. Service functions can be applied to the traffic flow associated with delivering the content to the user.

First claim

What is claimed is:

1. A method for service chaining, the method comprising:
determining a service chain for processing a request from a client for content;
determining a capability identifying nodes of the service chain; and
transmitting, to the client, a redirect message having the capability,
wherein,
the redirect message includes a message and a name of the content,
the redirect message redirects the request to a first node of the service chain, and
the capability of the redirect message includes a service chain identifier identifying the service chain.

2. The method of claim 1 , further comprising:
signing the capability to generate a signature to be verified by nodes of the service chain, wherein the redirect message further includes the signature.

3. The method of claim 1 , wherein the redirect message includes a signature of the message and the name of the content.

4. The method of claim 1 , wherein the capability of the redirect message comprises addresses and port numbers of the nodes of the service chain.

5. The method of claim 1 , wherein the capability of the redirect message comprises an identifier for a further capability identifying further node(s) of the service chain to be provided to the first node of the service chain.

6. The method of claim 1 , wherein the capability identifies a time period during which the capability is valid within the service chain.

7. An orchestrator for service chaining, the orchestrator comprising:
at least one memory element having instructions stored thereon; and
at least one processor coupled to the at least one memory element and configured to execute the instructions to cause the orchestrator to perform operations including:
determining a service chain for processing a request from a client for content;
determining a capability identifying nodes of the service chain; and
transmitting, to the client, a redirect message having the capability,

wherein,
the redirect message includes a message and a name of the content,
the redirect message redirects the request to a first node of the service chain, and
the capability of the redirect message includes a service chain identifier identifying the service chain.

8. The orchestrator of claim 7 , wherein the operations further include:
signing the capability to generate a signature to be verified by nodes of the service chain, wherein the redirect message further includes the signature.

9. The orchestrator of claim 7 , wherein the redirect message includes a signature of the message and the name of the content.

10. The orchestrator of claim 7 , wherein the capability of the redirect message comprises addresses and port numbers of the nodes of the service chain.

11. The orchestrator of claim 7 , wherein the capability of the redirect message comprises an identifier for a further capability identifying further node(s) of the service chain to be provided to the first node of the service chain.

12. The orchestrator of claim 7 , wherein the capability identifies a time period during which the capability is valid within the service chain.

13. One or more computer-readable non-transitory media comprising one or more instructions for service chaining, that when executed on a processor configure the processor to:
determine a service chain for processing a request from a client for content;
determine a capability identifying nodes of the service chain; and
transmit, to the client, a redirect message having the capability,

wherein,
the redirect message includes a message and a name of the content,
the redirect message redirects the request to a first node of the service chain, and
the capability of the redirect message includes a service chain identifier identifying the service chain.

14. The one or more computer-readable non-transitory media of claim 13 , wherein the instructions, that when executed on the processor, further configure the processor to:
sign the capability to generate a signature to be verified by nodes of the service chain, wherein the redirect message further includes the signature.

15. The one or more computer-readable non-transitory media of claim 13 , wherein the redirect message includes a signature of the message and the name of the content.

16. The one or more computer-readable non-transitory media of claim 13 , wherein the capability of the redirect message includes addresses and port numbers of the nodes of the service chain.

17. The one or more computer-readable non-transitory media of claim 13 , wherein the capability of the redirect message comprises an identifier for a further capability identifying further node(s) of the service chain to be provided to the first node of the service chain.

18. The one or more computer-readable non-transitory media of claim 13 , wherein the capability identifies a time period during which the capability is valid within the service chain.

Assignees

• Cisco Tech Inc

Inventors

• Mullender Sape Jurriën
• Bosch Hendrikus G P
• Duminuco Alessandro
• Napper Jeffrey

Classifications

• H04L67/02 Primary

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L67/63

  Routing a service request depending on the request content or context · CPC title

• H04L67/563

  Data redirection of data network streams · CPC title

• H04L67/51 Primary

  Discovery or management thereof, e.g. service location protocol [SLP] or web services · CPC title

• H04L63/168

  above the transport layer · CPC title