Fortinet, Inc.

Xiaodong Xu

Michael Xie

Robert A May

Yixin Pan

Hongwei Li

Jordan E Thompson

Yong Wang

Shenghe Wang

Systems and methods for implementing a cooperative security fabric (CSF) protocol are provided. According to one embodiment, an NSD of multiple NSDs participates in the dynamic construction of a CSF interconnecting the NSDs in a form of a tree, having multiple nodes each representing one of the NSDs, based on hierarchical interconnections between the NSD and directly connected upstream and downstream NSDs. A communication channel is established by a backend daemon of the NSD with a directly connected upstream node of the NSD within the CSF through which queries and replies are communicated and through which periodic keep-alive messages and responses are exchanged between the upstream node and the NSD. A CSF protocol is enforced by a forward daemon of the NSD that limits issuance of query messages to those originated by a source NSD representing an upstream node and directed to a destination NSD representing a downstream node.

Building a cooperative security fabric of hierarchically interconnected network security devices

Systems and methods for coordinating security operations among members of a cooperative security fabric (CSF) are provided. According to one embodiment, a first network security appliance of a CSF receives incoming network traffic and determines if the incoming network traffic is transmitted from a second network security appliance based on the source address of the network traffic. If the incoming network traffic is from the second network security appliance, the first network security appliance determines operations that are executed by the second network security appliance and then determines local operations. The first network security appliance executes local operations to the incoming network traffic.

Reducing redundant operations performed by members of a cooperative security fabric

Systems and methods for coordinating security operations among members of a cooperative security fabric (CSF) are provided. According to one embodiment, a first network security appliance of a CSF receives incoming network traffic and determines whether the network traffic has been transmitted from a second network security appliance based on a flag carried by one or more packets of the network traffic. If the incoming network traffic is from the second network security appliance, the first network security appliance determines network security operations that are executed by the second network security appliance and then determines local network security operations. The first network security appliance executes the local network security operations on the network traffic.

Growing community of inventors

Surrey, Canada

Xiaodong Xu