Zscaler, Inc.

Abhinav Bansal

Purvi J Desai

Vikas Mahajan

Ajit Singh

Vivek Raman

Rohit Goyal

Sandeep Kumar

Srikanth Devarajan

Thomas Evan Keiser, Jr

Vijay Bulusu

Tejus Gangadharappa

John H O'Neil

Roy Rajan

Systems and methods for securely handling data traffic on local or private networks, such as by using cloud computing, are provided. A non-transitory computer-readable medium, according to one implementation, may be configured to store executable instructions enabling a processor of a user device to perform the step of discovering an origin of a source application associated with network packets bound for a private address space. The executable instructions may further enable the processor to send a tuple regarding the discovered origin to a cloud server to request an analysis of the tuple. Upon receiving an allow instruction from the cloud server, the instructions enable the processor to allow the network packets to flow normally to a destination associated with the private address space. Upon receiving a deny instruction from the cloud server, the instructions enable the processor to drop the network packets.

Securing local network traffic using cloud computing

The present disclosure relates to systems and methods for risk-based session resumption. The present disclosure addresses the security gaps in the access control workflow of an organization while significantly enhancing the user experience. Instead of users being inquired to reauthenticate at a periodic interval, the present disclosure provides risk-based session resumption and reauthentication established on a verdict determination based on changes detected in metadata. The present disclosure not only prevents unnecessary prompts for user to authenticate again but also improves the security profile of an organization as users need to reauthenticate only if something has changed, malicious activity is detected, and there is a real risk to access control.

Risk based session resumption

Systems and methods implemented by a mobile device include establishing a plurality of tunnels to a gateway, wherein each of the plurality of tunnels is on one of a plurality of link layer channels at the mobile device; intercepting network traffic on the mobile device; forwarding the network traffic to one of the plurality of tunnels based on a set of traffic forwarding rules; and responsive to a network change for the mobile device, managing the plurality of tunnels and continuing the forwarding based on the managing. The systems and methods can further include determining characteristics including bandwidth of each of the plurality of link layer channels; and utilizing the characteristics with the set of traffic forwarding rules for the forwarding.

Adaptive multipath tunneling in cloud-based systems

Systems and methods include establishing a control channel of a tunnel utilizing a first encryption technique, wherein the tunnel is between a local node including one or more processors and a remote node, and wherein the control channel includes a session identifier; establishing a data channel of the tunnel utilizing a second encryption technique, wherein the data tunnel is bound to the control channel based on the session identifier; performing, over the control channel, device authentication and user authentication of one or more users associated with the remote node, wherein each of the one or more users includes a user identifier; and, subsequent to the device authentication and the user authentication, exchanging data packets over the data channel with each data packet including a corresponding user identifier. The first encryption technique can be one of TLS and SSL, and the second encryption technique can be one of TLS and DTLS.

Cloud-based tunnel protocol systems and methods for multiple ports and protocols

Systems and methods include obtaining a plurality of parameters associated with a host; determining a fingerprint of the host utilizing the plurality of parameters; and providing the fingerprint to cloud service for enrollment and management of the host in the cloud service. The cloud service can include microsegmentation of the host. The cloud service can include any of Internet access for the host and private resource access by the host.

Fingerprinting to identify devices and applications for use in management and policy in the cloud

Systems and methods for security and control of Internet of Things (IOT) and ZeroConf devices using cloud services. The present disclosure uses an application that runs on a user device in a promiscuous mode to look for potentially vulnerable and compromised machines on the local network. Specifically, the user device can fingerprint ZeroConf and IOT networks based on their static and dynamic behavior. The application discovers all hosts on the network and uses a cloud service such as via a cloud-based system to detect potentially malicious IOTs with known vulnerabilities. Based on an enterprise policy or user's preferences, the solution can alert if any IOT device tries to communicate with the user's device or if the user's device itself broadcasts services running on the device such as screen sharing/file sharing.

Systems and methods for security and control of internet of things and ZeroConf devices using cloud services

Systems and methods for device identification for management and policy in the cloud, using a combination of several hardware parameters and user's identification to generate a unique identifier for a user device and associated user. IOCTL and Assembly can be used to get the different hardware parameters. All the hardware parameters can then run through a process to generate a fixed size hardware fingerprint. A base64 encoding can be performed to convert it into a string, for consumption of database. The resultant identifier is unique and it is never stored on machine. The application can simply generate it whenever needed. The resultant identifier can used by a service provider to uniquely identify the device even when the device is moving hands or locations. The resultant identifier is never stored, so moving data from one device to another will not result in the same identifier for two devices.

Device identification for management and policy in the cloud

Systems and methods implemented by an application executed on a user device for service discovery and connectivity include discovering one or more cloud services for a user associated with the user device; creating and operating an interface on the user device; and intercepting traffic at the interface from one or more client applications on the user device and splitting the traffic based on configuration to the one or more cloud services. The method can further include authenticating the user into the one or more cloud services prior to the splitting.

Systems and methods for cloud based unified service discovery and secure availability

A cloud-based security system enforcing application-based control of network resources includes a plurality of nodes communicatively coupled to the Internet; and one or more authority nodes communicatively coupled to the plurality of nodes; wherein a node of the plurality of nodes is communicatively coupled to a user device via the Internet, and wherein the node is configured to receive a request from a user device for network resources on the Internet or in an external network, to evaluate the request to determine an application on the user device associated with the request, and to provide application-based control of the request based on the determined application and the network resources.

Client application based access control in cloud security systems for mobile devices

Systems and methods implemented by an application executed on a mobile device for service driven split tunneling include receiving and configuring the application on the mobile device; responsive to a set of rules, opening one or more tunnels to one or more host concentrators in the cloud; and intercepting packets being transmitted from the mobile device and one of forwarding the packets over the one or more tunnels and forwarding the packets directly based on the set of rules.

Service driven split tunneling of mobile network traffic

Systems and methods of identifying and processing certificate pinned applications through a cloud based security system include monitoring traffic associated with a connection; developing a profile of an application associated with the traffic based on the monitoring, wherein the profile comprises whether or not the application is a certificate pinned application which requires a predefined set of criterion to be matched against an advertised certificate; and selectively performing SSL interception of the connection in the cloud based security system based on the profile. The monitoring can include monitoring handshake messages between a client and a server to determine a handshake status and a certificate status.

Identification of certificate pinned mobile applications in cloud based security systems

Systems and methods of assessing Wi-Fi network vulnerability and enforcing policy based thereon in a cloud-based security system include obtaining and storing security risk scores for a plurality of Wi-Fi networks based in part on analysis performed by user equipment in range of each of the plurality of Wi-Fi networks; detecting user equipment associated with the cloud-based security system either desiring to connect to or already connected to a Wi-Fi network; obtaining a security risk score of the Wi-Fi network; and enforcing policy for the user equipment based on the obtained security risk score of the Wi-Fi network.

Systems and methods for network vulnerability assessment and protection of Wi-fi networks using a cloud-based security system

A cloud-based method of service function chaining using Security Assertion Markup Language (SAML) assertions includes receiving configuration information related to any of users, services, and correspondence between the users and the services; responsive to a request from a user, generating a SAML assertion for the request and attaching a stack of service tags with the SAML assertion, wherein the stack of service tags defines a service chain for the user and for the request; and providing the SAML assertion with the stack of service tags to the user in response to the request. The method can further include providing the SAML assertion by the user to one or more services, wherein each of the services creates a context based on the stack of service tags. Each of the services identifies itself in the stack and sends the SAML assertion to a next service or application in the stack.

Systems and methods for cloud-based service function chaining using security assertion markup language (SAML) assertion

A server configured to profile a mobile device for a cloud-based system, includes a network interface, a data store, and a processor communicatively coupled to one another; and memory storing computer executable instructions, and in response to execution by the processor, the computer-executable instructions cause the processor to, based on communication to a client application on the mobile device, cause the client application to collect data associated with the mobile device; receive the collected data; and determine a device fingerprint and a risk index for the mobile device based on the collected data, wherein the device fingerprint is utilized to uniquely identify the mobile device and the risk index is utilized to manage the mobile device.

Multidimensional risk profiling for network access control of mobile devices through a cloud based security system

Systems and methods of monitoring and controlling Internet of Things (IOT) and ZeroConf devices using a cloud-based security system include receiving fingerprints of the IOT and ZeroConf devices and data related to operation from a plurality of user devices; receiving updates related to the IOT and ZeroConf devices, configuration thereof, and proper operation thereof; determining security risk of the IOT and ZeroConf devices based on the fingerprints, the data related to operation, and the updates; and providing the security risk to the plurality of user devices and causing one or more policy-based actions to be performed based on the security risk.

Growing community of inventors

San Jose, CA, United States of America

Abhinav Bansal