US 2017/0324708 A1 · Concurrent Security Processing Of Network Packets By Multiple In-Line Network Security Tools

Abstract

Systems and methods provide concurrent security processing for multiple network security tools. An input packet is received at a network packet forwarding system from a network packet source, and the network packet forwarding system concurrently sends an output packet based upon the input packet to multiple security tools. Return packets are received based upon the output packet from the security tools after their respective security processing. Once return packets are received from each of the security tools, the network packet forwarding system forwards a secure packet to a packet destination. If a timeout occurs before all return packets are received, the network packet forwarding system can assume that the original packet was unsafe and discard information stored for the input packet. If security tools are configured to modify packets, these modifications can also be tracked.

Claims26

Dependent claims

A method to forward secure network packets to a plurality of network security tools coupled to a network system, comprising:

receiving an input packet from a network source;
concurrently sending an output packet to a plurality of network security tools, the output packet being based upon the input packet;
receiving return packets from the plurality of network security tools, the return packets being based upon the output packet;
and
after a return packet has been received from each of the plurality network security tools, forwarding a secure packet to a network destination, the secure packet being based upon at least one of the return packets.

2 more elements

A network system to forward secure network packets to a plurality of network security tools coupled to the network system, comprising:

a source port configured to receive an input packet from a network source;
a plurality of tool ports configured to transmit an output packet to a plurality of network security tools and to receive return packets from the plurality of network security tools, the output packet being based upon the input packet and the return packets being based upon the output packet;
a destination port configured to forward a secure packet to a network destination, the secure packet being based upon at least one of the return packets;
and
one or more programmable integrated circuits programmed to:
receive the input packet from the source port;
concurrently send the output packet to the plurality of network security tools through the tool ports;
receive the return packets from the tool ports;
and
forward the secure packet to the destination port after a return packet has been received from each of the plurality of network security tools.

7 more elements

Dependencies are inferred from the claim text.

Concurrent Security Processing Of Network Packets By Multiple In-Line Network Security Tools

Life of this patent

Concurrent Security Processing Of Network Packets By Multiple In-Line Network Security Tools

Life of this patent

Abstract

Claims26