Multiple inspection avoidance (MIA) using a protection scope

摘要

A multiple inspection avoidance (MIA) technique is implemented in a virtualized environment. Preferably, the technique is implemented in a packet processing unit (PPU) and takes advantage of a protection scope determined in an automated manner. The protection scope may be MAC-based. The MIA technique ensures that the same packet is not inspected more than once by a same packet processing unit (PPU), and that the same packet is not inspected more than once by different PPUs. According to this disclosure, when a PPU implementing MIA receives a packet, it uses the protection scope to determine whether it needs to process the packet. Preferably, the determination of whether to process the packet depends on the source and destination addresses in the packet, whether those addresses are being protected by the PPU that receives the packet, the direction of the packet flow, and optionally one or more packet processing rules.

主权项

1. A method of multiple packet inspection avoidance for a virtual network, the method being implemented in association with a packet inspection engine, comprising:
receiving data defining a protection scope; receiving a data packet, the data packet including source and destination address information; determining, using the protection scope and the source and destination address information, whether to inspect the data packet by the packet inspection engine; and based on the determination, taking a given action, the given action being one of: inspecting the data packet by the packet inspection engine, and bypassing inspection of the data packet.