Patent ID: 8612744
Filing Date: 2013-12-17
Classification: H04L

Abstract:
1. A computer-implemented method, comprising: receiving a packet at an input-output (IO) module of a firewall of a gateway device interfacing a local area network (LAN) and an external network, the firewall including at least one IO module for performing IO functionality of the firewall and at least one security processing module for performing security functionality of the firewall, each of the at least one IO module and the at least one security processing module running within a first virtual machine and managed by a firewall controller; identifying a security processing module corresponding to a connections session associated with the packet, the identified security processing module running within a second virtual machine, wherein the identified security processing module is operable to offload, in response to detection of a processing limitation of the identified security processing module, at least one security process to a service processing module to perform at least one particular security service, the service processing module being run within a third virtual machine running on a physical host separated from the second virtual machine running on a different physical host executing the identified security processing module; transmitting the packet to the identified security processing module running within the second virtual machine to perform a security process on the packet; and in response to a signal received from the identified security processing module running within the second virtual machine indicating that the security process has been completed, the IO module running within the first virtual machine transmitting the packet to a destination.