Abstract: A network security system is provided comprising a plurality of network bubbles wherein each bubble includes bubble members configured to transmit and receive data. Bubbles have network security policies that may be enforced by a plurality of network control point devices. The system further includes a private virtual backbone configured to interconnect the plurality of network control points connected to known bubbles. The privacy of the private virtual backbone is maintained by an inter-bubble device and/or set of two network control points. The inter-bubble device and set of control points enforce the network security policies of any connected bubble and relay data packets between address spaces. The private virtual backbone may operate in private address space. The system also includes an instance-specific virtual backbone that interconnects only bubble partitions from the same network bubble, thus simplifying the enforcement of a network security policy.

Abstract: A method is disclosed for processing data using multiple interconnected firewall devices. A connection is initiated between an internal host and an external network, through a home firewall device. A separate, receiving firewall device may then receive a data packet for the internal host as part of a flow. The receiving device attempts to determine the home device for the packet. The receiving device sends a multicast to all other firewall devices in the firewall cluster. The multicast includes the data packet and information about the receiving device. The home device receives the multicast and responds, indicating that it is the home device. The home device extracts the data packet from the multicast and forwards it to the internal host. The receiving device stores the response information along with other forwarding information that is used to automatically forward to the home device subsequent data packets for the flow.

Abstract: A method is disclosed for processing data using multiple interconnected firewall devices. A connection is initiated between an internal host and an external network, through a home firewall device. A separate, receiving firewall device may then receive a data packet for the internal host as part of a flow. The receiving device attempts to determine the home device for the packet. The receiving device sends a multicast to all other firewall devices in the firewall cluster. The multicast includes the data packet and information about the receiving device. The home device receives the multicast and responds, indicating that it is the home device. The home device extracts the data packet from the multicast and forwards it to the internal host. The receiving device stores the response information along with other forwarding information that is used to automatically forward to the home device subsequent data packets for the flow.