Patent ID: 9304801
Filing Date: 2016-04-05
CPC Classification: G06F,H04L

Claim Text:
1. A method performed by a controller in a split architecture network to control network connectivity for a cloud computing environment, the split architecture network including a plurality of switches coupled to the controller, wherein the controller manages a control plane for the plurality of switches and policy enforcement for network security for a plurality of virtual machines (VMs) including a source VM and a destination VM that execute applications in the cloud computing environment and exchange data via the split architecture network, the method comprising the steps of: receiving by the controller a packet from the plurality of switches, the packet originating from the source VM, where the controller manages the control plane for the plurality of switches and the plurality of switches implement the data plane of the split architecture network; extracting by the controller an application identifier from the received packet, the application identifier identifying an application running on the source VM; determining by the controller a chain of middlebox types based on the application identifier; mapping by the controller one or more of the middlebox types in the chain to corresponding one or more middlebox instances based on current availability of resources in the cloud computing environment, wherein one or more of the middlebox instances perform network security operations on the packet and the one or more middlebox instances are in communication with one or more of the plurality of switches; and sending by the controller a set of rules to the plurality of switches, the set of rules to add a set of tags to the packet to cause the plurality of switches to forward the packet toward the destination VM via the one or more middlebox instances to thereby enforce network security in the cloud computing environment.