Granted Patent B2

US 12,627,558 · App. 18/534,526 · Granted May 12, 2026

Inventors: Jayaraman Iyer (Sunnyvale, CA); Zhong Wang (Danville, CA); Bhaswati Deka Talukdar (Fremont, CA); Pradheep Shrinivasan (Austin, TX); Samir Dilipkumar Saklikar (Milpitas, CA)

Assignee: Cisco Technology, Inc.

H04L41/0806H04L69/22

Abstract

Claims (85)

1 . A method comprising:

instantiating a first service having a first data plane control point;

instantiating a second service configured to access the first data plane control point in a data plane, the second service being provided based on instructions by an external bytecode;

receiving a first packet at the first service in a network path;

providing at least one of the first packet and first metadata associated with the first packet to the second service to analyze or process the first packet and the first metadata in conjunction with the first service;

processing at least one of the first packet or the first metadata in the second service based on the external bytecode and generating second metadata based on the processing;

receiving the second metadata to the first service; and

processing the first packet or a second packet in the first service according to the second metadata, wherein the second service comprises a runtime engine that executes the external bytecode in a virtual machine and exposes, a plurality of host interfaces including a first interface for controlling network requests associated with the first service, a second interface controlling network protocols associated with the data plane, and a third interface controlling network routing functions.

2 . The method of claim 1 , further comprising:

at least partially processing the first packet in the first service, wherein the first metadata is extracted from the first packet or generated during the processing of the first packet;

when a trigger is identified based on the first data plane control point, providing the first packet and the first metadata to the second service; and

receiving the second packet from the second service.

3 . The method of claim 1 , wherein the processing of the first packet comprises at least one of:

dropping the first packet to prevent further transmission of the first packet;

inspecting and filtering data within the first packet to generate the second packet;

modifying headers within the first packet to generate the second packet;

performing a control plane function based on headers or data within the first packet;

controlling a session with a counterpart device through a network;

controlling at least one network protocol in the data plane; and

controlling network routing functions.

4 . The method of claim 1 , further comprising:

instantiating a third service having at least one data plane control point;

instantiating a fourth service configured to access a second data plane control point, the fourth service being provided based on instructions by a second external bytecode;

receiving the first packet or the second packet from the first service after being processed according to the second metadata; and

processing the first packet or the second packet in the third service according to third metadata generated by the fourth service.

5 . The method of claim 1 , wherein a runtime engine is configured to verify a cryptographic signature of the external bytecode prior to execution, maintain a revocation list of disallowed modules, and deny execution of unsigned or revoked modules.

6 . The method of claim 5 , wherein the external bytecode comprises webassembly instructions conforming to a Proxy-Wasm compatible interface.

7 . The method of claim 5 , wherein the runtime engine comprises the first interface, the second interface, and the third interface are invocable exclusively via a defined application binary interface (ABI) that restricts the module to pre-authorized host calls.

8 . A computing system comprising:

a storage configured to store instructions; and

a processor configured to execute the instructions and cause the processor to:

instantiate a first service having a first data plane control point;

instantiate a second service configured to access the first data plane control point in a data plane, the second service being provided based on instructions by an external bytecode;

receive a first packet at the first service in a network path;

provide at least one of the first packet and first metadata associated with the first packet to the second service to analyze or process the first packet and the first metadata in conjunction with the first service;

process at least one of the first packet or the first metadata in the second service based on the external bytecode and generating at least second metadata based on the processing;

receive second metadata to the first service; and

process the first packet or a second packet in the first service according to the second metadata, wherein the second service comprises a runtime engine that executes the external bytecode in a virtual machine and exposes, a plurality of host interfaces including a first interface for controlling network requests associated with the first service, a second interface controlling network protocols associated with the data plane, and a third interface controlling network routing functions.

9 . The computing system of claim 8 , wherein the processor is configured to execute the instructions and cause the processor to:

at least partially process the first packet in the first service, wherein the first metadata is extracted from the first packet or generated during the processing of the first packet;

when a trigger is identified based on the first data plane control point, provide the first packet and the first metadata to the second service; and

receive the second packet from the second service.

10 . The computing system of claim 8 , wherein, when the processor processes the first packet or the second packet, the processor is configured to execute the instructions and cause the processor to:

drop the first packet to prevent further transmission of the first packet;

inspect and filtering data within the first packet to generate the second packet;

modify headers within the first packet to generate the second packet;

perform a control plane function based on headers or data within the first packet;

control a session with a counterpart device through a network;

control at least one network protocol in the data plane; or

control network routing functions.

11 . The computing system of claim 8 , wherein the processor is configured to execute the instructions and cause the processor to:

instantiate a third service having at least one data plane control point;

instantiate a fourth service configured to access a second data plane control point, the fourth service being provided based on instructions by a second external bytecode;

receive the first packet or the second packet from the first service after being processed according to the second metadata; and

process the first packet or the second packet in the third service according to third metadata generated by the fourth service.

12 . The computing system of claim 8 , wherein a runtime engine is configured to verify a cryptographic signature of the external bytecode prior to execution, maintain a revocation list of disallowed modules, and deny execution of unsigned or revoked modules.

13 . The computing system of claim 12 , wherein the external bytecode comprises webassembly instructions conforming to a Proxy-Wasm compatible interface.

14 . The computing system of claim 12 , wherein the first interface, the second interface, and the third interface are invocable exclusively via a defined application binary interface (ABI) that restricts the module to pre-authorized host calls.

15 . An integrated circuit comprising instructions comprising a programmable circuit in the integrated circuit and configured to:

instantiate a first service having a first data plane control point;

instantiate a second service configured to access the first data plane control point in a data plane, the second service being provided based on instructions by an external bytecode;

receive a first packet at the first service in a network path;

provide at least one of the first packet and first metadata associated with the first packet to the second service to analyze or process the first packet and the first metadata in conjunction with the first service;

process at least one of the first packet or the first metadata in the second service based on the external bytecode and generating at least second metadata based on the processing;

receive second metadata to the first service; and

process the first packet or a second packet in the first service according to the second metadata, wherein the second service comprises a runtime engine that executes the external bytecode in a virtual machine and exposes, a plurality of host interfaces including a first interface for controlling network requests associated with the first service, a second interface controlling network protocols associated with the data plane, and a third interface controlling network routing functions.

16 . The integrated circuit of claim 15 , wherein the integrated circuit further comprises instructions that, when executed by the programmable circuit, cause the integrated circuit to:

at least partially process the first packet in the first service, wherein the first metadata is extracted from the first packet or generated during the processing of the first packet;

when a trigger is identified based on the first data plane control point, provide the first packet and the first metadata to the second service; and

receive the second packet from the second service.

17 . The integrated circuit of claim 15 , wherein the integrated circuit further comprises instructions that, when executed by the programmable circuit to process of the first packet, cause the integrated circuit to:

drop the first packet to prevent further transmission of the first packet;

inspect and filtering data within the first packet to generate the second packet;

modify headers within the first packet to generate the second packet;

perform a control plane function based on headers or data within the first packet;

control a session with a counterpart device through a network;

control at least one network protocol in the data plane; or

control network routing functions.

18 . The integrated circuit of claim 15 , wherein the integrated circuit further comprises instructions that, when executed by the programmable circuit in the integrated circuit, cause the integrated circuit to:

instantiate a third service having at least one data plane control point;

instantiate a fourth service configured to access a second data plane control point, the fourth service being provided based on instructions by the external bytecode;

receive the first packet or the second packet from the first service after being processed according to the second metadata; and

process the first packet or the second packet in the third service according to third metadata generated by the fourth service.

19 . The integrated circuit of claim 15 , wherein a runtime engine executing in the programmable circuit is configured to verify a cryptographic signature of the external bytecode prior to execution, maintain a revocation list of disallowed modules, and deny execution of unsigned or revoked modules.

20 . The integrated circuit of claim 19 , wherein the external bytecode comprises webassembly instructions conforming to a Proxy-Wasm compatible interface.

Assignments (1)

Continuity (1)

References Cited (13)