Patent ID: 11874845
Assignee: FORTINET, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 4:
5. A computer system with a centralized state engine on a security device of a distributed security environment having a plurality of packet processing devices communicatively coupled to a data communication network, the system wherein the computer system comprises:
a non-transitory storage device having embodied therein instructions representing a state engine; and
one or more processors coupled to the non-transitory storage device and operable to execute the state engine to perform a method comprising:
facilitating decoupling of state storage from packet processing within the distributed security environment by maintaining, in a state database, state information for each of a plurality of end-to-end packet flows,
wherein the state information further comprises security state information from an IPS (Intrusion Prevention System) representing progress of packet security scanning as reported by a plurality of packet processing devices participating in the distributed security environment over the data communication network and which operate at different times as state producers or state consumers,
wherein the state information associated with the packet is created responsive to receiving the state information associated with the packet from at least two packet processing devices of the plurality of packet processing devices, each packet processing device providing, in the state information, metadata information representing one or more packet processing actions performed upstream in the particular end-to-end packet flow by the packet processing device;
receiving from a first packet processing device of the plurality of packet processing devices a query pertaining to state information associated with a packet to be processed by the first packet processing device, wherein the state information associated with the packet to be processed influences how the packet is to be processed by the first packet processing device;
responsive to the query, identifying the state information for the particular end-to-end packet flow based on the query by processing the received query with reference to the state database; and
providing the first packet processing device with the identified state information by generating a response to the query containing the identified state information,
wherein the identified state information indicates that no further scanning is necessary responsive to the security state information indicative of a completed IPS scan.