Granted Patent B2

US 8,713,663 · App. 12/676,503 · Granted Apr 29, 2014

Abstract

Claims (43)

1. A primary security processing device in an extended security system, wherein the extended security system further comprises at least one secondary security processing device connected with the primary security processing device, and the primary security processing device comprises a primary control module, an interface module and a connection module, wherein

the primary control module is configured to, when receiving a request of processing an external packet and the external packet is a first packet of a traffic flow, select a security processing device for processing the traffic flow corresponding to the first packet according to processing capabilities of the primary security processing device and the at least one secondary security processing device, wherein the selected security processing device is one of the primary security processing device and the at least one secondary security processing device; and further configured to, when a secondary security processing device is selected, generate instruction information for instructing the interface module to send the received first packet to the selected secondary security processing device via the connection module, and instruct the interface module to record information that the secondary security processing device selected by the primary control module is used to process the traffic flow corresponding to the first packet;

the interface module is connected respectively with the connection module and the primary control module, and is configured to receive the first packet, send the request of processing the first packet to the primary control module, send the first packet to the secondary security processing device selected by the primary control module via the connection module, and record the information that the secondary security processing device selected by the primary control module is used to process the traffic flow corresponding to the first packet; and further configured to receive a subsequent packet of the traffic flow, search for the secondary security processing device for processing the first packet from the information recorded in the interface module, and send the subsequent packet to the secondary security processing device for processing the first packet via the connection module; and

the connection module is connected respectively with the interface module and the secondary security processing device, and is configured to send the received first packet to the secondary security processing device selected by the primary control module and send the subsequent packet to the secondary security processing device for processing the first packet;

wherein the primary control module, the interface module and the connection module are implemented by one or more hardware processors.

2. A primary security processing device in an extended security system, wherein the extended security system further comprises at least one secondary security processing device connected with the primary security processing device, and the primary security processing device comprises a primary control module, an extended control interface module, a connection module and a service processing module, wherein

the primary control module is configured to, when receiving a request of processing an external packet and the external packet is a first packet of a traffic flow, select a security processing device for processing the traffic flow corresponding to the first packet according to processing capabilities of the primary security processing device and the at least one secondary security processing device, wherein the selected security processing device is one of the primary security processing device and the at least one secondary security processing device; and further configured to, when a secondary security processing device is selected, generate instruction information for indicating the selected secondary security processing device to process the first packet, send the instruction information via the extended control interface module to the selected secondary security processing device, and instruct a secondary security processing device receiving the first packet to record information that the secondary security processing device selected by the primary control module is used to process the traffic flow corresponding to the first packet; when the primary security processing device is selected, instruct the secondary security processing device receiving the first packet to send the first packet to the connection module, and instruct the service processing module to process the first packet; and instruct the secondary security processing device receiving the first packet to record information that the primary security processing device is used to process the traffic flow corresponding to the first packet;

the extended control interface module is connected respectively with the primary control module and the secondary security processing device, and is configured to receive the request of processing the first packet from the secondary security processing device receiving the first packet, and send the instruction information generated by the primary control module to the selected secondary security processing device and sending the instruction of the primary control module to the secondary security processing device receiving the first packet;

the connection module is connected respectively with the service processing module and the secondary security processing device, and is configured to receive the first packet sent from the secondary security processing device receiving the first packet, and send the first packet to the service processing module to be processed; and

the service processing module is connected respectively with the connection module and the primary control module, and is configured to process the first packet received by the connection module according to the instruction of the primary control module

wherein the primary control module, the extended control interface module, the connection module and the service processing module are implemented by one or more hardware processors.

3. A primary security processing device in an extended security system, wherein the extended security system further comprises at least one secondary security processing device connected with the primary security processing device, and the primary security processing device comprises a primary control module, an interface module, a connection module and a service processing module, wherein

the primary control module is configured to, when receiving a request of processing an external packet and the external packet is a first packet of a traffic flow, select a security processing device for processing the traffic flow corresponding to the first packet according to processing capabilities of the primary security processing device and the at least one secondary security processing device, wherein the selected security processing device is one of the primary security processing device and the at least one secondary security processing device; and further configured to, when a secondary security processing device is selected to process the first packet, instruct a security processing device receiving the first packet to send the received first packet to the selected secondary security processing device, and instruct the security processing device receiving the first packet to record information that the secondary security processing device selected by the primary control module is used to process the traffic flow corresponding to the first packet; when the primary security processing device is selected to process the first packet, instruct the service processing module to process the first packet received, via the connection module, from the security processing device receiving the first packet, and instruct the interface module to record information that the primary security processing device is used to process the traffic flow corresponding to the first packet;

the interface module is connected respectively with the connection module and the primary control module, and is configured to receive the first packet, send the request of processing the first packet to the primary control module, and record the information that the security processing device selected by the primary control module is used to process the traffic flow corresponding to the first packet; and further configured to receive a subsequent packet of the traffic flow, search for the security processing device for processing the first packet according to the information recorded in the interface module, and send the subsequent packet to the security processing device for processing the first packet via the connection module;

the connection module is connected respectively with the interface module, the service processing module and the secondary security processing device, and is configured to send the first packet to the selected secondary security processing device to be processed if the primary control module selects the secondary security processing device; or receive the first packet sent by the secondary security processing device receiving the first packet;

the service processing module is connected respectively with the connection module and the primary control module, and is configured to process the first packet sent by the connection module according to the instruction of the primary control module;

wherein the primary control module, the interface module, the connection module and the service processing module are implemented by one or more hardware processors.

4. A method for using an extended security system, comprising: configuring one of security processing devices in the extended security system as a primary security processing device and configuring other security processing devices as at least one secondary security processing device connected with the primary security processing device, wherein the primary security processing device comprises a primary control module, an interface module and a connection module, and the method comprises:

receiving, by the interface module, an external packet, and, when the external packet is a first packet of a traffic flow, sending a request of processing the first packet to the primary control module;

when receiving the request of processing the first packet, selecting, by the primary control module, a security processing device for processing the traffic flow corresponding to the first packet according to processing capabilities of the primary security processing device and the at least one secondary security processing device, wherein the selected security processing device is one of the primary security processing device and the at least one secondary security processing device;

when a secondary security processing device is selected, generating, by the primary control module, instruction information for instructing the interface module to send the received first packet to the selected secondary security processing device via the connection module, and instructing the interface module to record information that the secondary security processing device selected by the primary control module is used to process the traffic flow corresponding to the first packet;

sending, by the interface module, the first packet to the connection module, and recording the information that the secondary security processing device selected by the primary control module is used to process the traffic flow corresponding to the first packet;

sending, by the connection module, the received first packet to the secondary security processing device selected by the primary control module;

receiving, by the interface module, a subsequent packet of the traffic flow, searching for the secondary security processing device for processing the first packet from the information recorded in the interface module, and sending the subsequent packet to the connection module; and

sending, by the connection module, the subsequent packet to the secondary security processing device for processing the first packet.

5. A method for using an extended security system, comprising: configuring one of security processing devices in the extended security system as a primary security processing device and configuring other security processing devices as at least one secondary security processing device connected with the primary security processing device, wherein the primary security processing device comprises a primary control module, an extended control interface module, a connection module and a service processing module, and the method comprises:

receiving, by the extended control interface module, a request of processing a first packet of a traffic flow from a secondary security processing device receiving the first packet, and sending the request of processing the first packet to the primary control module;

when receiving the request of processing the first packet, selecting, by the primary control module, a security processing device for processing the traffic flow corresponding to the first packet according to processing capabilities of the primary security processing device and the at least one secondary security processing device, wherein the selected security processing device is one of the primary security processing device and the at least one secondary security processing device;

when a secondary security processing device is selected, generating, by the primary control module, instruction information for indicating the selected secondary security processing device to process the first packet, sending the instruction information via the extended control interface module to the selected secondary security processing device, and instructing the secondary security processing device receiving the first packet to record information that the secondary security processing device selected by the primary control module is used to process the traffic flow corresponding to the first packet;

when the primary security processing device is selected, instructing, by the primary control module, the secondary security processing device receiving the first packet to send the first packet to the connection module, instructing the service processing module to process the first packet, and instructing the secondary security processing device receiving the first packet to record information that the primary security processing device is used to process the traffic flow corresponding to the first packet;

sending, by the extended control interface module, the instruction information generated by the primary control module to the selected secondary security processing device and sending the instruction of the primary control module to the secondary security processing device receiving the first packet;

receiving, by the connection module, the first packet from the secondary security processing device receiving the first packet, and sending the first packet to the service processing module to be processed; and

processing, by the service processing module, the first packet received by the connection module according to the instruction of the primary control module.

6. A method for using an extended security system, comprising: configuring one of security processing devices in the extended security system as a primary security processing device and configuring other security processing devices as at least one secondary security processing device connected with the primary security processing device, wherein the primary security processing device comprises a primary control module, an interface module, a connection module and a service processing module, and the method comprises:

receiving, by the interface module, a first packet of a traffic flow, sending a request of processing the first packet to the primary control module;

when receiving the request of processing the first packet, selecting, by the primary control module, a security processing device for processing the traffic flow corresponding to the first packet according to processing capabilities of the primary security processing device and the at least one secondary security processing device, wherein the selected security processing device is one of the primary security processing device and the at least one secondary security processing device;

when a secondary security processing device is selected to process the first packet, instructing, by the primary control module, a security processing device receiving the first packet to send the received first packet to the selected secondary security processing device, and instructing the security processing device receiving the first packet to record information that the secondary security processing device selected by the primary control module is used to process the traffic flow corresponding to the first packet;

sending, by the connection module, the first packet to the selected secondary security processing device to be processed if the primary security processing device receives the first packet;

when the primary security processing device is selected to process the first packet, instructing, by the primary control module, the service processing module to process the first packet received, and instructing the interface module to record information that the primary security processing device is used to process the traffic flow corresponding to the first packet;

receiving, by the connection module, the first packet if a secondary security processing receives the first packet, and sending the first to the service processing module;

recording, by the interface module, the information that the security processing device selected by the primary control module is used to process the traffic flow corresponding to the first packet;

processing, by the service processing module, the first packet sent by the connection module according to the instruction of the primary control module; and

receiving, by the interface module, a subsequent packet of the traffic flow, searching for the security processing device for processing the first packet according to the information recorded in the interface module, and sending the subsequent packet to the security processing device for processing the first packet via the connection module.

Assignments (9)