On-demand network security system

Abstract

A computer-implemented method includes receiving a request for one of a network session and a virtual network function, wherein the request includes a single packet authorization request. The method further includes classifying the single packet authorization request at a first service classifier. The method further includes routing the request, via a service function forwarder, to a single packet authorization service function for validation. The method further includes instantiating a security virtual function in response to the request, wherein instantiating the security virtual function occurs after validation of the single packet authorization request. The method further includes configuring the security virtual function to apply at least one connection policy to allow or deny traffic in a data session. The method further includes, in response to allowing the data session, terminating the security virtual function after the data session has concluded.

1 . A method comprising:
 receiving, by a computer system including a processor, a request for one of: a network session or a virtual network function, wherein the request includes a single packet authorization request;   classifying, by the computer system, the single packet authorization request at a first service classifier;   routing, by the computer system, the request, via a service function forwarder, to a single packet authorization service function for validation; and   instantiating, by the computer system, a security virtual function in response to the request, wherein the instantiating the security virtual function occurs after validation of the single packet authorization request, and wherein the security virtual function is configured to apply at least one connection policy to allow or deny traffic in a data session.   
     
     
         2 . The method of  claim 1 , further comprising defining an orchestrator in communication with the service function forwarder. 
     
     
         3 . The method of  claim 1 , wherein the security virtual function communicates with the service function forwarder to apply the at least one connection policy to allow or deny traffic between the first service classifier and a second service classifier. 
     
     
         4 . The method of  claim 3 , wherein the first service classifier is in communication with a client and the second service classifier is in communication with a server. 
     
     
         5 . The method of  claim 4 , wherein the client communicates with the first service classifier via an access router. 
     
     
         6 . The method of  claim 4 , wherein the server communicates with the second service classifier via an aggregation router. 
     
     
         7 . The method of  claim 1 , wherein the security virtual function is provisioned for a time period associated with the data session. 
     
     
         8 . The method of  claim 1 , further comprising providing a control plane report to an orchestrator in response to a successful fulfillment of the single packet authorization request. 
     
     
         9 . The method of  claim 1 , wherein the security virtual function operates as a virtual firewall between a client and a server during the data session. 
     
     
         10 . A non-transitory computer-readable storage medium storing executable instructions that when executed by a computing device cause said computing device to effectuate operations, the operations comprising:
 classifying a single packet authorization request at a first service classifier, wherein the single packet authorization request is included in a request for one of a network session and a virtual network function;   routing the request, via a service function forwarder, to a single packet authorization service function for validation;   instantiating a security virtual function in response to the request, wherein the instantiating the security virtual function occurs after validation of the single packet authorization request; and   configuring the security virtual function to apply at least one connection policy to allow or deny traffic in a data session.   
     
     
         11 . The non-transitory computer-readable storage medium of  claim 10 , wherein the operations further comprise defining an orchestrator in communication with the service function forwarder. 
     
     
         12 . The non-transitory computer-readable storage medium of  claim 10 , wherein the security virtual function communicates with the service function forwarder to apply the at least one connection policy to allow or deny traffic between the first service classifier and a second service classifier. 
     
     
         13 . The non-transitory computer-readable storage medium of  claim 12 , wherein the first service classifier is in communication with a client and the second service classifier is in communication with a server. 
     
     
         14 . The non-transitory computer-readable storage medium of  claim 13 , wherein the client communicates with the first service classifier via an access router. 
     
     
         15 . The non-transitory computer-readable storage medium of  claim 13 , wherein the server communicates with the second service classifier via an aggregation router. 
     
     
         16 . The non-transitory computer-readable storage medium of  claim 10 , wherein the security virtual function is provisioned for a time period associated with the data session. 
     
     
         17 . The non-transitory computer-readable storage medium of  claim 10 , wherein the operations further comprise providing a control plane report to an orchestrator in response to a successful fulfillment of the single packet authorization request. 
     
     
         18 . The non-transitory computer-readable storage medium of  claim 10 , wherein the security virtual function operates as a virtual firewall between a client and a server during the data session. 
     
     
         19 . A system comprising:
 one or more processors; and   a memory coupled with the one or more processors, the memory storing executable instructions that when executed by the one or more processors, cause the one or more processors to effectuate operations, the operations comprising:
 receiving a request for one of a network session and a virtual network function, wherein the request includes a single packet authorization request; 
 routing the request, via a service function forwarder, to a single packet authorization service function for validation; 
 instantiating a security virtual function in response to the request, wherein the instantiating the security virtual function occurs after validation of the single packet authorization request; and 
 configuring the security virtual function to apply at least one connection policy to allow or deny traffic in a data session. 
   
     
     
         20 . The system of  claim 19 , wherein the security virtual function communicates with the service function forwarder to apply the at least one connection policy to allow or deny traffic between a first service classifier and a second service classifier.