Patent ID: 8695059

Claim:
A method comprising: establishing, via a common network cloud managed by a service provider, a plurality of security policies, each corresponding, respectively, to one of a plurality of subscribers; providing to each subscriber, according to a respective security policy, access to two or more security services over the common network cloud using a multi-tenancy format for the subscribers to communicate with the common network cloud, wherein the common network cloud includes one or more service aggregators to which data traffic is routed to perform the two or more security services, and wherein the two or more security services are performed in sequence by two or more different security modules, each performing a different security service; establishing one or more virtual private network sessions from one or more networks associated with the plurality of subscribers into the common network cloud and connecting to a routing engine, wherein the one or more virtual private network sessions are established over an unsecured public data network according to a multiprotocol labeling switching protocol, and wherein the one or more service aggregators receive security addressed content after a respective security service is performed; and determining to send the security addressed content from the one or more service aggregators to the routing engine, wherein the security services include network firewalling and filtering of content originating from or destined to one or more networks associated with the subscribers, wherein each of the one or more service aggregators includes a service sequencing module that controls the sequence of the two or more security services that are performed for each of the plurality of subscribers, and wherein, when the data traffic routed to the to the one or more service aggregators within the common network cloud is sent from a sender that is a subscriber and is destined for a receiver that is another subscriber, two sets of security services are separately applied to the data traffic, one set of security services corresponding to the sender subscriber and one set of security services corresponding to the receiver subscriber.