Cluster Architecture for Network Security Processing

A system comprising:

• a cluster comprising a plurality of communicatively coupled computing devices, wherein one of the cluster computing devices is configured to operate as a cluster master;
• a network interface communicatively coupling the cluster to an external network;
• a flow assignment module implemented on the cluster master computing device and configured to assign network flows to the cluster computing devices according to one or more flow assignment rules,
• wherein the cluster computing devices are configured to receive inbound network traffic via the network interface, and wherein each of the cluster computing devices comprises a traffic processing module configured to ignore inbound network traffic that is not associated with a network flow assigned thereto, and to process inbound network traffic related to network flows that are assigned to the cluster computing device according to a security policy.

A method for assigning network flows within a cluster comprising a plurality of computing devices, the method comprising:

• maintaining a flow assignment data structure comprising mappings between network flows and computing devices assigned thereto;
• receiving network traffic on a network interface, the network traffic corresponding to a network flow;
• determining whether the received network flow has been assigned one of the computing devices using the flow assignment data structure;
• dropping the network traffic if the received network flow has been assigned to a computing device;
• and
• assigning the network flow to a selected one of the plurality of computing devices if the network flow is not assigned to a computing device by:
• identifying one or more computing devices that are eligible to be assigned the received network flow using the flow assignment data structure and one or more flow assignment rules,
• selecting one of the one or more eligible computing devices according to a selection criteria, and
• configuring the selected computing device to process network traffic associated with the received network flow.

A method for processing network traffic by a computing device in a cluster comprising a plurality of computing devices, comprising:

• receiving a network flow assignment to assign one or more network flows to the computing device;
• receiving network traffic relating to a plurality of different network flows;
• processing the received network traffic by:
• identifying network traffic associated with network flows assigned to the computing device,
• processing the identified network traffic according to a security policy, and
• dropping network traffic that is not identified as associated with a network flow assigned to the computing device.

A cluster computing device, comprising:

• a communication interface communicatively coupled to an external network interface and a cluster interface;
• and
• a traffic processing module operable on a processor of the cluster computing device and configured to receive a network flow assignment from a cluster master via the cluster interface, the network flow assignment identifying one or more network flows assigned to the cluster computing device,
• wherein the traffic processing module is configured to receive network traffic associated with a plurality of different network flows on the external network interface, and wherein upon receiving the network traffic, the traffic processing module is configured to identify network traffic associated with the one or more network flows assigned to the cluster computing device, to process the identified network traffic according to a security policy, and to drop network traffic that is not identified as assigned to the cluster computing device.