Patent ID: 11874845
Assignee: FORTINET, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 8:
9. A method in a centralized state engine on a security device of a distributed security environment having a plurality of packet processing devices communicatively coupled to a data communication network comprising:
facilitating decoupling of state storage from packet processing by maintaining in a database, by a cloud-based state engine running on a computing device and associated with the distributed security environment, state information for each of a plurality of end-to-end packet flows,
wherein the state information for a particular end-to-end packet flow of the plurality of end-to-end packet flows influences how a packet associated with the particular end-to-end packet flow is processed by the plurality of packet processing devices,
wherein the state information further comprises security state information from an IPS (Intrusion Prevention System) representing progress of packet security scanning as reported by a plurality of packet processing devices participating in the distributed security environment over the data communication network and which operate at different times as state producers or state consumers,
wherein the state information associated with the packet is created responsive to receiving the state information associated with the packet from at least two packet processing devices of the plurality of packet processing devices, each packet processing device providing, in the state information, metadata information representing one or more packet processing actions performed upstream in the particular end-to-end packet flow by the packet processing device,
wherein the state information for the packet indicates that no further scanning is necessary responsive to the security state information indicative of a completed IPS scan;
receiving from a first packet processing device of the plurality of packet processing devices, by the cloud-based state engine, an update pertaining to the state information for the particular end-to-end packet flow of the plurality of end-to-end packet flows; and
responsive to receipt of the update:
modifying, by the cloud-based state engine, the database to reflect the update; and
pushing, by the cloud-based state engine, the update to a second packet processing device of the plurality of packet processing devices.