Security processing in active security devices

A computer program product, encoded on a non-transitory computer-readable medium, comprising computer instructions that when executed cause a first security device to perform operations comprising:

• receiving a packet at the first security device;
• determining whether the packet is associated with a previously assigned flow;
• in the event that the packet is not associated with the previously assigned flow:
• storing a new flow relating to the packet in the first security device;
• and
• notifying a distinct second security device that the new flow is stored in the first security device;
• in the event that the packet is associated with the previously assigned flow:
• determining whether the packet is associated with a flow assigned to the distinct second security device;
• in the event that the packet is determined to be associated with the flow assigned to the distinct second security device:
• sending the packet to the distinct second security device;
• after the distinct second security device performs security processing using the packet, receiving from the distinct second security device a message regarding the packet;
• and
• transmitting the packet;
• in the event that the packet is not associated with the flow assigned to the distinct second security device, classifying a second flow according to an application associated with the second flow, the packet being associated with the second flow.

A system comprising:

• a first security device comprising one or more processors and one or more network interfaces;
• where the first security device has encoded on a computer-readable medium instructions operable to cause one or more of the processors of the first security device to perform operations comprising:
• receiving a packet at the first security device using one of the network interfaces;
• determining whether the packet is associated with a previously assigned flow;
• in the event that the packet is not associated with the previously assigned flow:
• storing a new flow relating to the packet in the first security device;
• and
• notifying a distinct second security device that the new flow is stored in the first security device;
• in the event that the packet is associated with the previously assigned flow:
• determining whether the packet is associated with a flow assigned to the distinct second security device;
• in the event that the packet is determined to be associated with the flow assigned to the distinct second security device:
• sending the packet to the distinct second security device;
• after the distinct second security device performs security processing using the packet, receiving from the distinct second security device a message regarding the packet;
• and
• transmitting the packet using one of the network interfaces;
• in the event that the packet is not associated with the flow assigned to the distinct second security device, classifying a second flow according to an application associated with the second flow, the packet being associated with the second flow.