Patent ID: 9215129
Filing Date: 2015-12-15
Classification: G06F,H04L

Abstract:
1. A method of constructing and using a protection scope for a virtual network, comprising: generating a set of data structures, each such data structure having one or more entries, wherein each entry includes an address of a virtual resource in the virtual network that is to be protected, together with a reference to a packet inspection unit that is responsible to inspect packets associated with the virtual resource, each data structure generated in association with a packet inspection unit; aggregating information from at least first and second of the data structures to generate an aggregate data structure, the aggregate data structure representing a current protection scope for the virtual network; providing the aggregate data structure to each packet inspection unit; at a given one of the packet inspection units, receiving a data packet, the data packet including source and destination address information; determining, using the current protection scope and the source and destination address information, whether to inspect the data packet by the packet inspection engine; and based on the determination, taking a given action, the given action being one of: inspecting the data packet by the packet inspection engine, and bypassing inspection of the data packet.