CN104601597B - 用于防火墙群集中状态数据共享的设备和方法 - Google Patents

用于防火墙群集中状态数据共享的设备和方法 Download PDF

Info

Publication number
CN104601597B
CN104601597B CN201510061714.8A CN201510061714A CN104601597B CN 104601597 B CN104601597 B CN 104601597B CN 201510061714 A CN201510061714 A CN 201510061714A CN 104601597 B CN104601597 B CN 104601597B
Authority
CN
China
Prior art keywords
node
fire wall
connection
operable
firewall group
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201510061714.8A
Other languages
English (en)
Chinese (zh)
Other versions
CN104601597A (zh
Inventor
S.米内尔
P.梅耶
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
McAfee LLC
Original Assignee
Mai Kefei Co
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Mai Kefei Co filed Critical Mai Kefei Co
Publication of CN104601597A publication Critical patent/CN104601597A/zh
Application granted granted Critical
Publication of CN104601597B publication Critical patent/CN104601597B/zh
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0209—Architectural arrangements, e.g. perimeter networks or demilitarized zones
    • H04L63/0218—Distributed architectures, e.g. distributed firewalls
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/02—Details
    • H04L12/16—Arrangements for providing special services to substations
    • H04L12/18—Arrangements for providing special services to substations for broadcast or conference, e.g. multicast
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/02—Details
    • H04L12/16—Arrangements for providing special services to substations
    • H04L12/18—Arrangements for providing special services to substations for broadcast or conference, e.g. multicast
    • H04L12/1813—Arrangements for providing special services to substations for broadcast or conference, e.g. multicast for computer conferences, e.g. chat rooms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1001—Protocols in which an application is distributed across nodes in the network for accessing one among a plurality of replicated servers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0654—Management of faults, events, alarms or notifications using network fault recovery
    • H04L41/0668—Management of faults, events, alarms or notifications using network fault recovery by dynamic selection of recovery network elements, e.g. replacement by the most appropriate element after failure
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • Multimedia (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)
CN201510061714.8A 2011-09-08 2012-09-06 用于防火墙群集中状态数据共享的设备和方法 Active CN104601597B (zh)

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
US13/227825 2011-09-08
US13/227,825 US8763106B2 (en) 2011-09-08 2011-09-08 Application state sharing in a firewall cluster
CN201280043666.4A CN103858382B (zh) 2011-09-08 2012-09-06 用于防火墙群集中的应用状态共享的方法和装置

Related Parent Applications (1)

Application Number Title Priority Date Filing Date
CN201280043666.4A Division CN103858382B (zh) 2011-09-08 2012-09-06 用于防火墙群集中的应用状态共享的方法和装置

Publications (2)

Publication Number Publication Date
CN104601597A CN104601597A (zh) 2015-05-06
CN104601597B true CN104601597B (zh) 2018-10-26

Family

ID=47831092

Family Applications (2)

Application Number Title Priority Date Filing Date
CN201510061714.8A Active CN104601597B (zh) 2011-09-08 2012-09-06 用于防火墙群集中状态数据共享的设备和方法
CN201280043666.4A Active CN103858382B (zh) 2011-09-08 2012-09-06 用于防火墙群集中的应用状态共享的方法和装置

Family Applications After (1)

Application Number Title Priority Date Filing Date
CN201280043666.4A Active CN103858382B (zh) 2011-09-08 2012-09-06 用于防火墙群集中的应用状态共享的方法和装置

Country Status (6)

Country Link
US (2) US8763106B2 (enExample)
EP (1) EP2754264A4 (enExample)
JP (2) JP5816374B2 (enExample)
KR (1) KR101531472B1 (enExample)
CN (2) CN104601597B (enExample)
WO (1) WO2013036646A1 (enExample)

Families Citing this family (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8763106B2 (en) 2011-09-08 2014-06-24 Mcafee, Inc. Application state sharing in a firewall cluster
US8887263B2 (en) 2011-09-08 2014-11-11 Mcafee, Inc. Authentication sharing in a firewall cluster
US9176838B2 (en) * 2012-10-19 2015-11-03 Intel Corporation Encrypted data inspection in a network environment
US9483286B2 (en) 2013-03-15 2016-11-01 Avi Networks Distributed network services
US9106610B2 (en) * 2013-06-07 2015-08-11 International Business Machines Corporation Regional firewall clustering in a networked computing environment
WO2017036535A1 (en) * 2015-09-03 2017-03-09 Huawei Technologies Co., Ltd. Distributed connection tracking
CN106603471B (zh) * 2015-10-16 2019-09-13 北京启明星辰信息安全技术有限公司 一种防火墙策略检测方法及装置
WO2017097352A1 (en) * 2015-12-09 2017-06-15 Huawei Technologies Co., Ltd. Managing a network through connection tracking
EP3349137B1 (en) * 2017-01-11 2026-03-11 Sap Se Client-side attack detection in web applications
CN107835099B (zh) * 2017-11-29 2021-09-03 新华三信息安全技术有限公司 一种信息同步方法及装置
US11258760B1 (en) * 2018-06-22 2022-02-22 Vmware, Inc. Stateful distributed web application firewall
US10771318B1 (en) 2018-10-24 2020-09-08 Vmware, Inc High availability on a distributed networking platform
CN110809330B (zh) * 2019-12-16 2023-07-14 腾讯科技（深圳）有限公司 多终端的连接建立方法和装置、存储介质及电子装置
CN111506480B (zh) * 2020-04-23 2024-03-08 上海达梦数据库有限公司 集群中组件的状态检测方法、装置和系统
US12477033B2 (en) * 2021-04-26 2025-11-18 Arrcus Inc. PFCP session load balancer
US20240267282A1 (en) * 2021-05-31 2024-08-08 Nec Corporation Information processing apparatus, information processing method, computer readable medium, and information processing system

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1725702A (zh) * 2004-07-20 2006-01-25 联想网御科技(北京)有限公司 一种网络安全设备及其组成的实现高可用性的系统及方法
US7254834B2 (en) * 2001-10-18 2007-08-07 The Board Of Regents Of The University Of Nebraska Fault tolerant firewall sandwiches
CN101651680A (zh) * 2009-09-14 2010-02-17 杭州华三通信技术有限公司 一种网络安全部署方法和一种网络安全设备

Family Cites Families (38)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6880089B1 (en) 2000-03-31 2005-04-12 Avaya Technology Corp. Firewall clustering for multiple network servers
US6772226B1 (en) 2000-08-15 2004-08-03 Avaya Technology Corp. VPN device clustering using a network flow switch and a different mac address for each VPN device in the cluster
US7131140B1 (en) 2000-12-29 2006-10-31 Cisco Technology, Inc. Method for protecting a firewall load balancer from a denial of service attack
US7130305B2 (en) * 2001-07-02 2006-10-31 Stonesoft Oy Processing of data packets within a network element cluster
US7107609B2 (en) 2001-07-20 2006-09-12 Hewlett-Packard Development Company, L.P. Stateful packet forwarding in a firewall cluster
US8001279B2 (en) * 2001-12-21 2011-08-16 International Business Machines Corporation Method of synchronizing firewalls in a communication system based upon a server farm
US7734752B2 (en) * 2002-02-08 2010-06-08 Juniper Networks, Inc. Intelligent integrated network security device for high-availability applications
US7447901B1 (en) 2002-06-25 2008-11-04 Cisco Technology, Inc. Method and apparatus for establishing a dynamic multipoint encrypted virtual private network
AU2003292116A1 (en) * 2002-11-27 2004-06-18 Fujitsu Siemens Computers, Inc. Method and appliance for distributing data packets sent by a computer to a cluster system
JP3852017B2 (ja) * 2003-02-05 2006-11-29 日本電信電話株式会社 ファイアウォール装置
US7266715B1 (en) 2003-04-29 2007-09-04 Cisco Technology, Inc. Methods and apparatus for maintaining a virtual private network connection
JP2005128792A (ja) * 2003-10-23 2005-05-19 Trend Micro Inc 通信装置、プログラムおよび記憶媒体
US7389510B2 (en) * 2003-11-06 2008-06-17 International Business Machines Corporation Load balancing of servers in a cluster
US7844731B1 (en) * 2003-11-14 2010-11-30 Symantec Corporation Systems and methods for address spacing in a firewall cluster
US8214481B2 (en) * 2004-02-10 2012-07-03 Seagate Technology Llc Firewall permitting access to network based on accessing party identity
US20050240989A1 (en) 2004-04-23 2005-10-27 Seoul National University Industry Foundation Method of sharing state between stateful inspection firewalls on mep network
JP2006054770A (ja) * 2004-08-16 2006-02-23 Yokogawa Electric Corp ファイアウォール装置
US8146145B2 (en) 2004-09-30 2012-03-27 Rockstar Bidco Lp Method and apparatus for enabling enhanced control of traffic propagation through a network firewall
CA2594020C (en) 2004-12-22 2014-12-09 Wake Forest University Method, systems, and computer program products for implementing function-parallel network firewall
US7870602B2 (en) 2005-09-14 2011-01-11 At&T Intellectual Property I, L.P. System and method for reducing data stream interruption during failure of a firewall device
US9137204B2 (en) * 2006-02-02 2015-09-15 Check Point Software Technologies Ltd. Network security smart load balancing
US8533808B2 (en) * 2006-02-02 2013-09-10 Check Point Software Technologies Ltd. Network security smart load balancing using a multiple processor device
US8353020B2 (en) * 2006-06-14 2013-01-08 Microsoft Corporation Transparently extensible firewall cluster
US20080098113A1 (en) * 2006-10-19 2008-04-24 Gert Hansen Stateful firewall clustering for processing-intensive network applications
US8255985B2 (en) 2006-11-13 2012-08-28 At&T Intellectual Property I, L.P. Methods, network services, and computer program products for recommending security policies to firewalls
JP2008141618A (ja) * 2006-12-04 2008-06-19 Tohoku Univ ネットワークアプリケーション弁別方法、ならびに不正アクセス検出システム
CN101030946A (zh) * 2007-04-12 2007-09-05 华为技术有限公司 一种实现数据业务的方法及系统
US7822841B2 (en) * 2007-10-30 2010-10-26 Modern Grids, Inc. Method and system for hosting multiple, customized computing clusters
US8015298B2 (en) * 2008-02-28 2011-09-06 Level 3 Communications, Llc Load-balancing cluster
CN101350773A (zh) * 2008-06-20 2009-01-21 中兴通讯股份有限公司 一种移动分组网络架构及其多个防火墙负载均衡接入方法
US8782286B2 (en) * 2008-09-12 2014-07-15 Cisco Technology, Inc. Optimizing state sharing between firewalls on multi-homed networks
US8493902B2 (en) 2010-08-16 2013-07-23 Florida Institute for Human and Machine Cognition Opportunistic listening system and method
US8406233B2 (en) * 2010-09-07 2013-03-26 Check Point Software Technologies Ltd. Predictive synchronization for clustered devices
US8776207B2 (en) 2011-02-16 2014-07-08 Fortinet, Inc. Load balancing in a network with session information
US8763106B2 (en) 2011-09-08 2014-06-24 Mcafee, Inc. Application state sharing in a firewall cluster
US8887263B2 (en) 2011-09-08 2014-11-11 Mcafee, Inc. Authentication sharing in a firewall cluster
US9319459B2 (en) 2011-09-19 2016-04-19 Cisco Technology, Inc. Services controlled session based flow interceptor
US20130152156A1 (en) 2011-12-12 2013-06-13 Mcafee, Inc. Vpn support in a large firewall cluster

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7254834B2 (en) * 2001-10-18 2007-08-07 The Board Of Regents Of The University Of Nebraska Fault tolerant firewall sandwiches
CN1725702A (zh) * 2004-07-20 2006-01-25 联想网御科技(北京)有限公司 一种网络安全设备及其组成的实现高可用性的系统及方法
CN101651680A (zh) * 2009-09-14 2010-02-17 杭州华三通信技术有限公司 一种网络安全部署方法和一种网络安全设备

Also Published As

Publication number Publication date
JP2014529259A (ja) 2014-10-30
JP5816374B2 (ja) 2015-11-18
KR20140058615A (ko) 2014-05-14
EP2754264A4 (en) 2015-05-13
US9876763B2 (en) 2018-01-23
US20130067556A1 (en) 2013-03-14
WO2013036646A1 (en) 2013-03-14
CN104601597A (zh) 2015-05-06
US20150082412A1 (en) 2015-03-19
US8763106B2 (en) 2014-06-24
JP6069717B2 (ja) 2017-02-01
CN103858382B (zh) 2018-01-16
CN103858382A (zh) 2014-06-11
JP2016028501A (ja) 2016-02-25
KR101531472B1 (ko) 2015-06-24
EP2754264A1 (en) 2014-07-16

Similar Documents

Publication Publication Date Title
JP6069717B2 (ja) ファイアウォールクラスターにおけるアプリケーション状態共有
US10721209B2 (en) Timing management in a large firewall cluster
CN105407099B (zh) 防火墙群集中的验证共享
WO2002101516A2 (en) Method and apparatus for distributed network security
Khalaf et al. A simulation study of syn flood attack in cloud computing environment
Kugisaki et al. Bot detection based on traffic analysis
Yang et al. A survey of peer-to-peer attacks and counter attacks
WO2017013894A1 (ja) フィルタリングシステム、管理装置、フィルタリング方法及び管理プログラム
Gital et al. On consistency and security issues in collaborative virtual environment systems
Ftima et al. Misconfigurations discovery between distributed security components using the mobile agent approach
Daskapan et al. Designing cyber warfare information infrastructure resilience

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant
CP01 Change in the name or title of a patent holder

Address after: American California

Patentee after: McAfee limited liability company

Address before: American California

Patentee before: Mai Kefei company

CP01 Change in the name or title of a patent holder