Intelligent flow state synchronization to improve resiliency, availability, and/or performance of redundant network security devices

A security system for use between at least one upstream router and at least one downstream router, the security system comprising:

• a first plurality (N) of security devices arranged between the at least one upstream router and the at least one downstream router, each of the first plurality of security devices being configured to provide bidirectional security services for a plurality of bidirectional flows between the at least one upstream router and the at least one downstream router,
• wherein, for each of the plurality of bidirectional flows, (1) one of the first plurality of security devices is assigned, as a primary security device to the bidirectional flow, using a consistent hash ring algorithm for generating a consistent hash ring, and (2) a set (M) of one or more of the first plurality of security devices is assigned, as backup security device(s) to the bidirectional flow, using the consistent hash ring algorithm, wherein M+1 is less than N,
• each of the first plurality of security devices being configured with a state synchronization process in which, for each of the plurality of bidirectional flows, the primary security device assigned to the bidirectional flow and set of M backup security device(s) assigned to the bidirectional flow, synchronize bidirectional flow state information with one another, but do not synchronize bidirectional flow state information with all of the N security devices.

A computer-implemented method for use in a system having (1) at least one upstream router, (2) at least one downstream router, and (3) a first plurality (N) of security devices arranged between the at least one upstream router and the at least one downstream router, each of the first plurality of security devices being configured to provide bidirectional security services for packets received from the at least one upstream router and for packets received from the at least one downstream router, the computer-implemented method comprising:

• a) assigning, using a consistent hash ring algorithm for generating a consistent hash ring, for each of a plurality of bidirectional flows,
• (1) one of the first plurality of security devices as a primary security device to the bidirectional flow, and
• (2) a set (M) of one or more of the first plurality of security devices as backup security device(s) to the bidirectional flow,
• wherein M+1 is less than N;
• b) receiving, from either (A) one of the at least one upstream router, or (B) one of the at least one downstream router, a packet belonging to a given bidirectional flow;
• c) responsive to receiving the packet,
• 1) creating or updating a state of the given bidirectional flow to which the received packet belongs, and
• 2) storing the state of the given bidirectional flow;
• and
• d) synchronizing the stored state of the given bidirectional flow among the primary security device assigned to the given bidirectional flow and the set of M backup security device(s) assigned to the given bidirectional flow, but not with all of the N security devices.