Netskope, Inc.

Amit Ganesh Datar

Kand Ly

Kartik Subbanna

The technology discloses a computer-implemented policy manager device for a cloud-based security system that manages cloud-based unified functions of packet-level and protocol-level access control and traffic inspection, threat detection and activity contextualization on inspectable and non-inspectable traffic. Packet-level access control inspects packet headers for malformation, protocol-level access control performs deep packet inspection for malicious signatures, threat detection determines whether traffic in an HTTP/S stream as directed to a threat destination, and activity contextualization recognizes whether an activity in an HTTP/S stream accessing a cloud-based application is a compromising activity. Policy manager for a superset of fields specifying security policies across the cloud-based unified functions includes common fields shared by the unified functions, specification receiver handles policy specifications in a common format for values of the common fields, and policy manager is configured to validate, save and distribute policy specifications applicable to respective functions among the cloud-based unified functions.

Computer-based policy manager for cloud-based unified functions

The technology discloses processing incoming access requests of packets through cloud-based components that perform (a) packet-level access control and traffic inspection, (b) protocol-level access control and traffic inspection, (c) threat detection, and (d) activity contextualization, including a packet and stream router conveying each incoming access request of packets through all of components (a)-(d) that apply, at least until one of the components sets a restrictive state on at least one object corresponding to the incoming access request or until all of the components that apply have passed the incoming access request. The disclosed method also includes a restrictive state analyzer determining whether the first, second, third or fourth restrictive state has been set due to malformed packets, malicious signatures, requests directed to a threat destination or an activity classified as compromising, and based on setting of any of the states, taking restrictive steps in response to the incoming access request.

Dynamic routing of access request streams in a unified policy enforcement system

The technology discloses a method applied by a policy manager to a cloud-based security system that unifies functions of access control and traffic inspection, threat detection and activity contextualization on inspectable and non-inspectable traffic, with a data manager coupled to the policy manager storing a superset of fields used to specify security policies across the cloud-based unified functions, including common fields shared by two or more of the functions. The method includes the manager validating, saving and distributing policy specifications applicable to respective functions among the functions, and receiving requests for policy specifications stored in common fields from each of the functions, converting the common fields into values used by a respective requesting function, and returning the values of the field used by the respective requesting function to any requesting function among the functions of access control and traffic inspection, threat detection and activity contextualization on inspectable and non-inspectable traffic.

Dynamic distribution of unified policies in a cloud-based policy enforcement system

Disclosed is a unified security system of cloud-based components configured for (a) packet-level and (b) protocol-level access control and traffic inspection, (c) threat detection and (d) activity contextualization. Packet-level inspects and classifies headers in requests or responses, sets a first restrictive state or passes the request or response. Protocol-level performs deep packet inspection for malicious signatures then sets a second state or passes. Threat detection, when the request or response is an HTTP/S stream, classifies as directed to a threat destination or not, then sets a third state or passes the request or response and activity contextualization, when the request is an HTTP/S stream seeking access to a cloud-based application, recognizes, processes and classifies content-containing activity as compromising or not, then sets a fourth state or passes. A restrictive state analyzer determines whether the first, second, third or fourth restrictive state has been set and takes restrictive steps in response.

Unified system for detecting policy enforcement issues in a cloud-based environment

The technology discloses a computer-implemented policy manager device for a cloud-based security system that unifies functions of packet-level and protocol-level access control and traffic inspection, threat detection and activity contextualization on inspectable and non-inspectable traffic. The device includes a data manager for a superset of fields that specify security policies across the cloud-based unified functions, including common fields shared by two or more of the unified functions, means for receiving and storing policy specifications in a common format for values of the common fields as applied to each of the unified functions, whereby a user interacting with the means for receiving can specify security policies governing the cloud-based unified functions of access control and traffic inspection, threat detection and activity contextualization on inspectable and non-inspectable traffic. Also included is a policy manager configured to validate, save and distribute the policy specifications applicable to respective functions among the cloud-based unified functions.

Growing community of inventors

Fremont, CA, United States of America

Amit Ganesh Datar