Patent ID: 9628505
Date: 2017-04-18
CPC Classifications: H04L

Claim:
1. A method for operating a security appliance system in a high availability environment, the security appliance system contains a plurality of intrusion prevention systems connected to a load balancer and a client computing device, each intrusion prevention system containing stored session state information in a local session state data store, the load balancer containing a shared hash algorithm, the client computing device containing a connection state manager and a topology manager, the connection state manager containing a network session state data store, the topology manager recording connectivity changes of the intrusion prevention systems and adjusting the shared hash algorithm to accommodate the changes, the method comprising: receiving, in the load balancer, a string of data packets that include session state information and routing information wherein the string includes data packets sent from an identified source to an identified destination; generating, in the load balancer, a hash value for the string using the shared hash algorithm and the routing information, wherein the generated hash value is a hexadecimal value; selecting, by the load balancer, one of the plurality of intrusion prevention systems based on the generated hash value, wherein a last digit of the generated hash value corresponds to a primary intrusion prevention system within the plurality of intrusion prevention systems to which the received string of data packets will be forwarded, and wherein a penultimate digit of the generated hash value corresponds to an alternate intrusion prevention system within the plurality of intrusion prevention systems to which the received string of data packets will be forwarded; in response to the primary intrusion prevention system being operational, forwarding the string from the load balancer to the primary intrusion prevention system based on the generated hash value; in response to the primary intrusion prevention system not being operational, forwarding the string from the load balancer to the alternate intrusion prevention system based on the generated hash value; in response to determining, by the primary intrusion prevention system, that the forwarded string has stored session state information within the local session state data store using the generated hash value, processing, by the primary intrusion prevention system, the forwarded string using the stored session state information; in response to forwarding the string to the alternate intrusion prevention system: updating the stored session state information in the local session state data store and the network session state data store using the processed string.