# US 2018/0324147 A1 · Reducing redundant operations performed by members of a cooperative security fabric > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0324147 A1 - Document ID: US20180324147A1 - Status: Published application - Kind: A1 - Application number: 15/717,723 - Filed: 2017-09-27 - Published: 2018-11-08 - Earliest claimed: 2017-05-08 - Assignees: Fortinet, Inc. - Applicants: Fortinet, Inc. - Inventors: Hongwei Li; Yixin Pan; Xiaodong Xu - Web page: https://patentgrep.com/patent/US20180324147A1 ## CPC - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/0209: {Architectural arrangements, e.g. perimeter networks or demilitarized zones} - H04L 63/0263: {Rule management} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1433: {Vulnerability analysis} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 12/06: Authentication - H04W 24/02: Arrangements for optimising operational condition - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Systems and methods for coordinating security operations among members of a cooperative security fabric (CSF) are provided. According to one embodiment, a first network security appliance of a CSF receives incoming network traffic and determines if the incoming network traffic is transmitted from a second network security appliance based on the source address of the network traffic. If the incoming network traffic is from the second network security appliance, the first network security appliance determines operations that are executed by the second network security appliance and then determines local operations. The first network security appliance executes local operations to the incoming network traffic. ## Claims ### Claim 1 A method comprising: receiving, by a first network security appliance of a private network that is participating in a cooperative security fabric (CSF), network traffic that is to be inspected by the first network security appliance; determining, by the first network security appliance, whether the network traffic has been transmitted from a second network security appliance that is participating in the CSF based on the source address of the network traffic; when the network traffic is determined to have been transmitted from the second network security appliance: determining, by the first network security appliance, one or more network security operations that are executed by the second network security appliance; determining, by the first network security appliance, one or more local network security operations to be executed by the first network security appliance based on the one or more network security operations that are executed by the second network security appliance; and executing, by the first network security appliance, the one or more local network security operations on the network traffic. ### Claim 2 (depends on 1) The method of claim 1, wherein determining, by the first network security appliance, one or more operations of the first network security appliance to be executed by the first network security appliance based on the one or more network security operations that are executed by the second network security appliance comprises skipping, by the first network security appliance, the one or more network security operations that are executed by the second network security appliance. ### Claim 3 (depends on 1) The method of claim 1, wherein determining, by the first network security appliance, one or more network security operations of the first network security appliance to be executed by the first network security appliance based on the one or more network security operations that are executed by the second network security appliance comprises determining, by the first network security appliance, one or more network security operations that are to be executed by the first network security appliance except the one or more network security operations that are executed by the second network security appliance based on local network polices. ### Claim 4 (depends on 1) The method of claim 1, wherein determining, by the first network security appliance, one or more network security operations of the first network security appliance to be executed by the first network security appliance based on the one or more network security operations that are executed by the second network security appliance comprises determining, by the first network security appliance, that the one or more network security operations that are executed by the second network security appliance are to be executed by the first network security appliance. ### Claim 5 (depends on 1) The method of claim 1, further comprising when the network traffic is not transmitted from the second network security appliance, executing, by the first network security appliance, one or more local network security operations defined by one or more local policies. ### Claim 6 (depends on 1) The method of claim 1, further comprising maintaining, by the first network security appliance, a list of a plurality of network security appliances participating in the CSF, wherein multiple network security operations to be applied to network traffic are distributed among each network security appliance of the plurality of network security appliances that are along a path on which the network traffic is transmitted through the private network. ### Claim 7 (depends on 6) The method of claim 6, further comprising: periodically broadcasting, by the first network security appliance, a source address of the first network security appliance on the private network to the plurality of network security appliances; receiving, by the first network security appliance, a source address of the second network security appliance broadcasted by the second security appliance on the private network; updating, by the first network security appliance, the list by storing the source address of the second security appliance within the list. ### Claim 8 (depends on 7) The method of claim 7, further comprising removing, by the first network security appliance, a third network security appliance of the plurality of network security appliances from the list when no broadcast is received from the third network security appliance by the first network security appliance within a predetermined or configurable period of time. ### Claim 9 (depends on 6) The method of claim 6, wherein the list is received by the first network security appliance from a management appliance within the private network. ### Claim 10 (depends on 6) The method of claim 6, wherein the list is created manually on the first network security appliance. ### Claim 11 (depends on 6) The method of claim 6, wherein the list further comprises information regarding a distribution of network security operations to be performed by the plurality of network security appliances. ### Claim 12 (depends on 1) The method of claim 1, wherein the source address of the network traffic comprises a media access control (MAC) address of a frame of the network traffic or an Internet protocol (IP) address of a packet of the incoming network traffic. ### Claim 13 (depends on 11) The method of claim 11, further comprising: changing, by the first network security appliance, the source MAC address of the network traffic to a MAC address of the first network security appliance; and transmitting, by the first network security appliance, the network traffic to a next hop network security appliance of the plurality of network security appliances. ### Claim 14 (depends on 11) The method of claim 11, further comprising: translating, by the first network security appliance, the source IP address of the network traffic to an IP address of the first network security appliance; and transmitting, by the first network security appliance, the network traffic to a next hop network security appliance of the plurality of network security appliances. ### Claim 15 (depends on 1) The method of claim 1, wherein the one or more network security operations include network traffic logging. ### Claim 16 (depends on 1) The method of claim 1, wherein the one or more network security operations include one or more of antivirus scanning, intrusion prevention (IPS), content filtering, data leak prevention, antispam, antispyware, reputation-based protections, event correlation, network access control, vulnerability management, load balancing, application control and traffic shaping.