Secure Service Chaining via Signed Capability Redirect
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing service chaining technologies face challenges in implementing efficient and flexible service chaining for content delivery systems that utilize HTTP or HTTPS, particularly in requiring additional signaling and burdening the first node to label incoming traffic flows, and in ensuring security and authorized content delivery.
Innovation Solution
A mechanism using a redirect message with a digitally signed capability is implemented to redirect clients to a service chain, allowing nodes to verify and apply service functions securely, thereby avoiding additional overhead and ensuring authorized content delivery.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional service chaining is implemented with additional signaling and first node labeling, then service functions can be applied to traffic flows, but signaling overhead increases and system complexity increases
Solution Approach 1:
The patent extracts the service chain identification information from the traffic flow labeling mechanism and places it directly in the HTTP request URL. This removes the need for complex signaling between network elements and eliminates the burden on the first node to label incoming traffic, while still enabling service functions to be applied correctly.
Solution Approach 2:
The client device itself is empowered to include service chain identification information in its HTTP requests. This self-service approach eliminates the need for external signaling mechanisms and first node labeling, as the client autonomously provides the necessary information for service chaining.
2Reliability
If service chaining is implemented without cryptographic verification, then service functions can be applied, but security and authorized content delivery cannot be ensured
Solution Approach 1:
The service chain identification information is cryptographically signed in advance by the orchestrator before being included in the HTTP request. This preliminary cryptographic verification setup enables security and authorized content delivery without adding complex runtime verification mechanisms, as the authentication is already embedded in the request itself.
3Productivity
If redirect messages include all necessary service chain information, then service chaining becomes efficient and flexible, but message size increases
Solution Approach 1:
The HTTP request URL serves multiple functions: it identifies the service chain, carries cryptographic verification information, and directs traffic to the appropriate service nodes. This multi-functionality allows all necessary service chain information to be conveyed in a single, standardized HTTP request without requiring separate signaling messages or increasing overall message size.
Data Source
AI summary
In one embodiment, secure service chaining can be implemented efficiently for content delivery systems. An orchestrator can determine a service chain for processing a request from a client for content. The orchestrator can determine a capability identifying nodes of the service chain. The orchestrator can then transmit, to the client, a redirect message having the capability, wherein the redirect message redirects the request to a first node of the service chain. The nodes of the service chain can verify the capability and carry out the service chain. Service functions can be applied to the traffic flow associated with delivering the content to the user.