Cluster architecture for network security processing

Abstract

A computing device may be joined to a cluster by discovering the device, determining whether the device is eligible to join the cluster, configuring the device, and assigning the device a cluster role. A device may be assigned to act as a cluster master, backup master, active device, standby device, or another role. The cluster master may be configured to assign tasks, such as network flow processing to the cluster devices. The cluster master and backup master may maintain global, run-time synchronization data pertaining to each of the network flows, shared resources, cluster configuration, and the like. The devices within the cluster may monitor one another. Monitoring may include transmitting status messages comprising indicators of device health to the other devices in the cluster. In the event a device satisfies failover conditions, a failover operation to replace the device with another standby device, may be performed.

We claim: 
     
         1 - 45 . (canceled) 
     
     
         46 . A method, comprising:
 receiving a network flow assignment to assign one or more network flows to a computing device of a cluster, the cluster comprising a plurality of computing devices and including a cluster master, wherein the computing device is communicatively coupled to an external network interface and is capable of processing network flows independently of the cluster master;   processing network traffic at the computing device by,
 identifying network traffic associated with network flows assigned to the computing device, and 
 processing the identified network traffic according to a security policy; and 
   transmitting flow session data of the computing device to the cluster master, the flow session data comprising a session key of a network flow assigned to the computing device.   
     
     
         47 . The method of  claim 46 , further comprising maintaining, at the computing device, a flow assignment data structure identifying the one or more network flows assigned to the computing device. 
     
     
         48 . The method of  claim 47 , wherein the flow assignment data structure identifies network flows using one or more of a source address of the assigned network flow, a destination address of the assigned network flow, a protocol of the assigned network flow, and a port assignment of the assigned network flow. 
     
     
         49 . The method of  claim 46 , further comprising:
 for each network flow assigned to the computing device,
 maintaining run-time synchronization data corresponding to the assigned network flow at the computing device, and 
 synchronizing the run-time synchronization data to the cluster master. 
   
     
     
         50 . The method of  claim 46 , wherein processing the identified network traffic comprises negotiating a security association, the method further comprising accessing a shared Internet Key Exchange (IKE) service provided by one of the cluster computing devices to perform the security association negotiation. 
     
     
         51 . The method of  claim 46 , wherein the flow session data transmitted to the cluster master comprises cache data pertaining to a network flow assigned to the computing device. 
     
     
         52 . The method of  claim 46 , wherein the flow session data transmitted to the cluster master comprises a security association sequence information number pertaining to a network flow assigned to the computing device. 
     
     
         53 . The method of  claim 46 , wherein the flow session data transmitted to the cluster master comprises one or more of an outbound security association and an inbound security association of a network flow assigned to the computing device. 
     
     
         54 . The method of  claim 46 , further comprising transmitting the flow session data to the cluster master via a cluster network interface that is separate from the external network interface of the computing device. 
     
     
         55 . An apparatus, comprising:
 a computing device comprising a processor and memory, the computing device configured for operation in a cluster comprising a plurality of computing devices and having a cluster master, the computing device further comprising,
 a communication interface to communicatively couple the computing device to the cluster master through an electronic communication network, 
 a cluster manager operable on the processor of the computing device that receives network flow assignments from the cluster master, and 
 a traffic processing module operable on the processor of the cluster computing device to process network traffic of network flows assigned to the computing device, wherein processing the assigned network flows comprises maintaining flow session data pertaining to the network flows at the computing device, 
 wherein the cluster manager is further configured to synchronize the flow session data maintained at the computing device to the cluster master through the electronic communication network. 
   
     
     
         56 . The apparatus of  claim 55 , wherein the computing device is configured to maintain the flow session data in a flow assignment data structure identifying the assigned network flows of the computing device, wherein the assigned network flows are identified by one or more of a source address, a destination address, a protocol, and a port assignment. 
     
     
         57 . The apparatus of  claim 55 , wherein the traffic processing module is configured to negotiate a security association for a particular one of the assigned network flows, and wherein negotiating the security association comprises accessing a shared Internet Key Exchange (IKE) service provided by another one of the computing devices of the cluster. 
     
     
         58 . The apparatus of  claim 57 , wherein the traffic processing module is configured to access the IKE service through an internal electronic communication network that is separate from an external electronic communication network of the particular assigned network flow. 
     
     
         59 . The apparatus of  claim 55 , wherein the flow session data transmitted to the cluster master comprises one or more of cache data pertaining to an assigned network flow, a security association sequence information number of an assigned network flow, an outbound security association of an assigned network flow, and an inbound security association of an assigned network flow. 
     
     
         60 . The apparatus of  claim 55 , wherein the communication interface comprises a communication interface to communicatively couple the computing device to an external electronic communication network, and a communication interface to communicatively couple the computing device to an cluster electronic communication network that is separate from the external electronic communication network, and wherein the cluster manager is configured to synchronize the flow session data maintained at the computing device to the cluster master through the cluster electronic communication network. 
     
     
         61 . A non-transitory computer-readable storage medium comprising instructions to cause a computing device to perform operations, comprising:
 receiving network flow assignments from a cluster master for a cluster, the cluster comprising a plurality of computing devices, wherein the computing device is communicatively coupled to an electronic communication network and is capable of processing network flows independently of the cluster master;   processing network traffic of network flows assigned to the computing device by,
 identifying network traffic associated with network flows assigned to the computing device, 
 processing the identified network traffic according to a security policy, and 
 maintaining flow session data for the network flows assigned to the computing device in response to processing the identified network traffic; and 
   transmitting the flow session data maintained at the computing device to the cluster master through the electronic communication network, the flow session data comprising security metadata pertaining to a network flow assigned to the computing device.   
     
     
         62 . The non-transitory computer-readable storage medium of  claim 61 , the operations further comprising synchronizing the flow session data maintained at the computing device with the cluster master through the electronic communication network. 
     
     
         63 . The non-transitory computer-readable storage medium of  claim 61 , wherein the computing device is communicatively coupled to the cluster master through a dedicated cluster network that is separate from an electronic communication network of the network flows assigned to the computing device, the operations further comprising transmitting the flow session data maintained at the computing device to the cluster master through the dedicated cluster network. 
     
     
         64 . The non-transitory computer-readable storage medium of  claim 61 , wherein processing the identified network traffic comprises negotiating a security association, the operations further comprising accessing a shared Internet Key Exchange (IKE) service provided by one of the cluster computing devices to perform the security association negotiation. 
     
     
         65 . The non-transitory computer-readable storage medium of  claim 61 , wherein the flow session data transmitted to the cluster master comprises one or more of cache data pertaining to an assigned network flow, a security association sequence information number of an assigned network flow, an outbound security association of an assigned network flow, and an inbound security association of an assigned network flow.