System and method for security service collaboration

1. A method at a service function chaining (SFC) node, comprising:

receiving a packet including a first SFC Path identifier (ID) and a first SFC Index;

determining whether to apply a first service function to the packet;

setting a treated indicator in the packet in accordance with applying the first service function to the packet; and one of:

responsive to determining that the packet has not been treated by the first service function:

forwarding the packet in accordance with first SFC Path ID and first SFC Index; or

responsive to determining that the packet has been treated by the first service function:

selecting a second SFC Path ID and a second SFC Index associated with the first SFC Path ID and the first SFC Index;

modifying the packet by replacing the first SFC Path ID and first SFC Index with the second SFC Path ID and second SFC Index; and

forwarding the modified packet in accordance with the second SFC Path ID and second SFC Index.

2. The method of claim 1 , further comprising, determining whether to apply the first service function to the packet in accordance with determining if the first service function has already been applied to the packet.

3. The method of claim 2 , further comprising, determining if the first service function has already been applied to the packet in accordance with the treated indicator in the packet.

4. The method of claim 1 , further comprising, determining whether to apply the first service function to the packet in accordance with a collaboration agreement.

5. The method of claim 4 , wherein the collaboration agreement defines at least one of an amount of resources the SFC node has allocated for applying the first service function and a bandwidth of traffic to which the SFC node will apply the first service function.

6. The method of claim 1 , further comprising, determining whether to apply the first service function to the packet in accordance with a tunnel the packet was received on.

7. The method of claim 1 , wherein the treated indicator is stored as metadata in the packet.

8. The method of claim 1 , wherein the treated indicator is a field in a network service header.

9. The method of claim 1 , wherein the second SFC Path ID and the second SFC Index to are selected to bypass a subsequent instance of the first service function in the first SFC Path.

10. The method of claim 1 , further comprising, selecting a tunnel for forwarding the packet to a second domain in accordance with the second SFC Path ID and second SFC Index.

11. A service function chaining (SFC) node comprising circuitry including a processor and a memory, the memory containing instructions executable by the processor whereby the SFC node is operative to:

receive a packet including a first SFC Path identifier (ID) and a first SFC Index;

determine whether to apply a first service function to the packet;

set a treated indicator in the packet in accordance with applying the first service function to the packet; and one of:

responsive to determining that the packet has not been treated by the first service function:

forward the packet in accordance with first SFC Path ID and first SFC Index; or

responsive to determining that the packet has been treated by the first service function:

select a second SFC Path ID and a second SFC Index associated with the first SFC Path ID and the first SFC Index;

modify the packet by replacing the first SFC Path ID and first SFC Index with the second SFC Path ID and second SFC Index; and

forward the modified packet in accordance with the second SFC Path ID and second SFC Index.

12. The SFC node of claim 11 , further operative to determine whether to apply the first service function to the packet in accordance with determining if the first service function has already been applied to the packet.

13. The SFC node of claim 12 , further operative to determine if the first service function has already been applied to the packet in accordance with the treated indicator in the packet.

14. The SFC node of claim 11 , further operative to determine whether to apply the first service function to the packet in accordance with a collaboration agreement.

15. The SFC node of claim 14 , wherein the collaboration agreement defines at least one of an amount of resources the SFC node has allocated for applying the first service function and a bandwidth of traffic to which the SFC node will apply the first service function.

16. The SFC node of claim 11 , further operative to determine whether to apply the first service function to the packet in accordance with a tunnel the packet was received on.

17. The SFC node of claim 11 , wherein the treated indicator is stored as metadata in the packet.

18. The SFC node of claim 11 , wherein the treated indicator is a field in a network service header.

19. The SFC node of claim 11 , wherein the second SFC Path ID and the second SFC Index to are selected to bypass a subsequent instance of the first service function in the first SFC Path.

20. The SFC node of claim 11 , further operative to select a tunnel for forwarding the packet to a second domain in accordance with the second SFC Path ID and second SFC Index.

21. A non-transitory computer readable storage medium storing executable instructions, which when executed by a processor, cause the processor to:

receive a packet including a first SFC Path identifier (ID) and a first SFC Index;

determine whether to apply a first service function to the packet;

set a treated indicator in the packet in accordance with applying the first service function to the packet; and one of:

responsive to determining that the packet has not been treated by the first service function:

forward the packet in accordance with first SFC Path ID and first SFC Index; or

responsive to determining that the packet has been treated by the first service function:

select a second SFC Path ID and a second SFC Index associated with the first SFC Path ID and the first SFC Index;

modify the packet by replacing the first SFC Path ID and first SFC Index with the second SFC Path ID and second SFC Index; and

forward the modified packet in accordance with the second SFC Path ID and second SFC Index.