Synchronization of security gateway state information

• US 7,162,737 B2
• Filed: 10/12/2001
• Issued: 01/09/2007
• Est. Priority Date: 02/13/2001
• Status: Expired due to Term

• Current Assignee: Forcepoint LLC (Francisco Partners Management LLC)
• Original Assignee: Stonesoft Corporation
• Inventors: Jalava, Mika, Syvanne, Tuomo
• Primary Examiner(s): Zand; Kambiz
• Application Number:
  US09/976,802
• Publication Number:
  US 20020112189A1
• Time in Patent Office: 1,915 Days
• Field of Search: 713/153, 713/200, 713/201, 709/229, 726/12
• US Class Current: 726/12
• CPC Class Codes: G06F 11/1662 the resynchronized component or unit being a persistent storage device re-synchronization of failed mirror storage G06F11/2082; rebuild or reconstruction of parity RAID storage G06F11/1008
• CPC Class Codes: G06F 11/2028 eliminating a faulty processor or activating a spare
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes

Abstract

A method (400, 500, 600, 700) for synchronizing state information in a security gateway cluster comprising at least two nodes comprises the following steps. Synchronizing (403) state information by sending state information from a first node of said at least two nodes, detecting (401) in said security gateway cluster a predetermined irregularly occurring action, and initiating (402) synchronization of state information as a response to said action. The state information is sent to at least a second node of said at least two nodes. Corresponding computer program, computer program product, software entities (910, 920), a node (900) of a security gateway cluster (950) and a security gateway cluster are also presented.

Claims

1. A method for synchronizing state information in a security gateway cluster, said security gateway cluster comprising at least two nodes, said method:

storing state information in a first node and in at least a second node of said at least two nodes in said security gateway cluster,

state information stored in said first node comprises common state information and node-specific state information,

defining for each node belonging to said security gateway cluster a node-specific backup group comprising at least one node-specific backup node,

synchronizing said state information in said security gateway cluster by sending state information from said first node to at least said second node of said at least two nodes,

detecting in said security gateway cluster a predetermined irregularly occurring action,

initiating said step of synchronization of state information as a response to said predetermined irregularly occurring action, said predetermined irregularly occurring action including a modification of state information so that modification of common state information initiates synchronization of common state information to all other nodes of said security gateway cluster, and modification of node-specific state information initiates synchronization of node-specific state information to nodes belonging to backup group of said first node.

2. A method according to claim 1, wherein said predetermined action is modification of said state information stored in said first node.

3. A method according to claim 2, wherein in the step of synchronizing state information only modified part of the state information stored in said first node is sent.

4. A method according to claim 3, wherein the modified part of the state information is sent from said first node to all other nodes of said security gateway cluster.

5. A method according to claim 4, wherein the modified part of the state information relates to a certain protocol, authentication information, virtual private network parameters or intrusion detection system.

6. A method according to claim 1, wherein in the step of synchronizing state information all state information stored in said first node is sent.

7. A method according to claim 1, further comprising the step of:

periodically synchronizing state information from said first node to at least a second node.

8. A method according to claim 1, wherein said predetermined action affects number of nodes in said security gateway cluster, said method further comprising the step of:

redefining for at least one node belonging to said security gateway cluster a backup group comprising at least one backup node.

9. A method according to claim 1, wherein said predetermined action is said first node failing to continue normal operation.

10. A method according to claim 1, wherein said predetermined action is said second node requesting for state information.

11. A method according to claim 1, wherein said predetermined action is said first node initiating a transition to offline state.

12. A method according to claim 1, wherein said predetermined action is handling of data packets relating to a communication session in at least two nodes, one of them being said first node, and in that said synchronization of state information is performed between at least said at least two nodes.

13. A method according to claim 1, wherein said predetermined action is a receipt of a data packet in said first node of said security gateway cluster, said data packet relating to a command to open a new connection via said security gateway cluster.

14. A method according to claim 13, further comprising the

delaying sending of said data packet from said first node until said synchronization of state information is performed.

15. A method according to claim 1, further comprising the step of:

delaying sending of a plurality of data packets from said first node until said synchronization of state information is performed.

16. A node of a security gateway cluster comprising

means for storing state information of said node, said state information comprising common state information and node-specific state information,

means for defining for said node a node-specific backup group of nodes comprising at least one node-specific backup node,

means for synchronizing said state information in said security gateway cluster by sending state information from said node to at least one other node in said security gateway cluster,

means for detecting a predetermined irregularly occurring action,

means for triggering said synchronization means as a response to said predetermined irregularly occurring action, said predetermined irregularly occurring action including a modification of state information so that modification of common state information initiates synchronization of common state information to all other nodes of said security gateway cluster, and modification of node-specific state information initiates synchronization of node-specific state information to nodes belonging to backup group of said node.

17. A security gateway cluster having a plurality of nodes, at least one node comprising

means for storing state information of said node, said state information comprising common state information and node-specific state information,

means for defining for said node a node-specific backup group of nodes comprising at least one node-specific backup node,

means for synchronizing said state information in said security gateway cluster by sending state information from said node to at least one other node in said security gateway cluster,

means for detecting a predetermined irregularly occurring action,

means for triggering said synchronization means as a response to said predetermined irregularly occurring action, said predetermined irregularly occurring action including a modification of state information so that modification of common state information initiates synchronization of common state information to all other nodes of said security gateway cluster, and modification of node-specific state information initiates synchronization of node-specific state information to nodes belonging to backup group of said node.

18. A computer readable medium containing a a computer-executable configured to perform at least the following routines for synchronizing state information in a security gateway cluster of at least two nodes when said program

storing state information in a said node and in at least a second node in said security gateway cluster, said stored state information stored comprising common state information and node-specific state information,

defining for said node a node-specific backup group of nodes comprising at least one node-specific backup node,

synchronizing said state information in said security gateway cluster by sending state information from said node to at least said second node,

detecting in said security gateway cluster a predetermined irregularly occurring action,

initiating said step of synchronization of state information as a response to said predetermined irregularly occurring action, said predetermined irregularly occurring action including a modification of state information so that modification of common state information initiates synchronization of common state information to all other nodes of said security gateway cluster, and modification of node-specific state information initiates synchronization of node-specific state information to nodes belonging to backup group of said node.