# US 2018/0324217 A1 · Building a cooperative security fabric of hierarchically interconnected network security devices

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2018/0324217 A1
- Document ID: US20180324217A1
- Status: Published application
- Kind: A1
- Application number: 15/855,230
- Filed: 2017-12-27
- Published: 2018-11-08
- Earliest claimed: 2017-05-08
- Assignees: Fortinet, Inc.
- Applicants: Fortinet, Inc.
- Inventors: Michael Xie; Robert A. May; Xiadong Xu; Yong Wang; Jordan E. Thompson; Shenghe Wang
- Web page: https://patentgrep.com/patent/US20180324217A1

## CPC

- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/0209: {Architectural arrangements, e.g. perimeter networks or demilitarized zones}
- H04L 63/0263: {Rule management}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04W 12/06: Authentication
- H04W 24/02: Arrangements for optimising operational condition
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Systems and methods for implementing a cooperative security fabric (CSF) protocol are provided. According to one embodiment, a CSF of multiple network security devices (NSDs) deployed within a protected network is constructed in a form of a tree, having a root node, one or more intermediate nodes and one or more leaf nodes, based on hierarchical interconnections among the NSDs by determining a relative upstream or downstream relationship among each NSD. Backend daemons of the NSDs establish and maintain a bi-directional tunnel between each parent node within the CSF and its respective child nodes through which queries and replies are communicated and through which periodic keep-alive messages and responses are exchanged. Forward daemons of the NSDs enforce a CSF protocol that limits the issuance of query messages to those originated by an upstream node within the CSF and directed to a downstream node within the CSF.

## Claims

### Claim 1

A method comprising:
dynamically constructing a cooperative security fabric (C SF) of a plurality of network security devices deployed within a protected network in a form of a tree, having a plurality of nodes, including a root node, one or more intermediate nodes and one or more leaf nodes, based on hierarchical interconnections among the plurality of network security devices by determining a relative upstream or downstream relationship among each network security device of the plurality of network security devices, wherein each node of a plurality of nodes within the CSF represents a network security device of the plurality of network security devices and each node of the CSF, except the root node and the one or more leaf nodes, includes both a parent node and one or more child nodes;
establishing and maintaining, by backend daemons running within corresponding network security devices of the plurality of network security devices, a bi-directional tunnel between each parent node within the CSF and its respective child nodes through which queries and replies are communicated and through which periodic keep-alive messages and responses are exchanged; and
enforcing, by forward daemons running within each of the plurality of network security devices, a CSF protocol that limits the issuance of query messages to those originated by a source network security device of the plurality of network security devices associated with an upstream node within the CSF and directed to a destination network security device of the plurality of network security devices associated with a downstream node within the CSF.

### Claim 2 (depends on 1)

The method of claim 1, wherein the plurality of network security devices comprise gateway devices, firewall devices, Intrusion Detection Systems (IDSs), Intrusion Prevention Systems (IPSs), or Unified Threat Management (UTM) devices.

### Claim 3 (depends on 1)

The method of claim 1, wherein, other than the root node, each network security device of the plurality of network security devices participating in the CSF is aware of only those of the plurality of network security devices that are directly connected to it.

### Claim 4 (depends on 1)

The method of claim 1, further comprising gathering, by the root node of the CSF, network topology information regarding the CSF by issuing a query to each of one or more child nodes of the root node regarding their respective subtrees

### Claim 5 (depends on 4)

The method of claim 4, wherein the network topology information includes identifying information associated with nodes within the respective subtrees.

### Claim 6 (depends on 5)

The method of claim 5, wherein the identifying information includes one or more of an Internet Protocol (IP) address, a Media Access Control (MAC) address and a serial number.

### Claim 7 (depends on 4)

The method of claim 4, wherein the network topology information includes information regarding a type, functionality, capabilities and configuration of the nodes within the respective subtrees.

### Claim 8 (depends on 1)

The method of claim 1, wherein said dynamically constructing includes the root node identifying itself as such based on having a direct wide area network (WAN) connection.

### Claim 9 (depends on 8)

The method of claim 8, wherein said dynamically constructing includes a child node of the plurality network security devices representing a child node of the root node joining the CSF by providing authentication information including a group name of the CSF and a password associated with the CSF.