Netskope, Inc.

Jonathan Michael Bosanac

Jason Eggleston

Lonhyn T Jasinskyj

Naiming Chu

Kallol Banerjee

Madhu J Sharma

Michael R Hickey

Milind Gunjan

Christopher Robert Geeringh

John Sengenberger

Scott M Leibrand

A system for providing policy-controlled communication between a plurality of different cloud computing environments includes a user interface that receives configuration settings to be applied to a plurality of first instances and a plurality of second instances. A plurality of collectors of the system that retrieve information from a first cloud computing environment and a second cloud computing environment, and a controller determines policies for the plurality of first instances and the plurality of second instances. A configurator of the system applies the policies to the plurality of first instances and the plurality of second instances, a first tester that inspects operations of the plurality of first instances and detects violations of the policies, and an enforcer responds to the detected violations. The controller instructs the configurator to apply the first policy to the first instance again, shut down the first instance or cut off communications with the first instance.

Policy management across multiple cloud computing environments within a network

A capacity resolver system in a cloud-based multi-tenant system includes point of presence (POP) systems and a cloud orchestration server. The POPs include hypervisors and the hypervisors includes nodes. A request for provisioning a node in a POP is received. Parameters are received from the hypervisors of the POP. Triggering of parameters above respective threshold values is determined. Downsizing or migration of one or more nodes based on the triggering of the one or more parameters is determined. The downsizing includes reduction in provisioned CPU core utilization or memory utilization that are determined to be underutilized. The migration includes the nodes migrated from the hypervisor to another hypervisor. The downsizing has higher priority of selection than the migration. Based on the selection of the downsizing or the migration of the one or more nodes, the requested node is provisioned at the hypervisor of the POP.

Provisioning of node based on downsizing or migration

A clientless security system to secure cellular devices across a network in a cloud-based environment. The clientless security system includes a tenant with multiple cellular devices, tunnels for transmitting traffic, and a traffic steering module for directing traffic toward a gateway. The clientless security system further includes gateways to apply policies based on a device profile and an alert generator. The traffic steering module provides a SIM with network identifiers, configures the SIM with a custom network identifier, creates a device-to-IP mapping, and distributes the device-to-IP mapping to gateways in real-time. The gateways apply multiple policies based on a device profile, receive traffic from the traffic steering module, and perform a reverse lookup. The gateways further determine a device identity, apply policies, and forward traffic to a destination. The alert generator is also used to notify the tenant of further remediation in case of policy violations.

Global secure SIM clientless SASE architecture for cellular devices

A cellular security system that uses multiple policies to protect a cellular network against various threats in a cloud-based environment. The cellular security system includes a tenant with multiple cellular devices, multiple tunnels that receive and route traffic, monitor traffic, capture real-time traffic attributes, and detect anomalies. The cellular security system further includes an anomaly detection model, an alert generator, and an anomaly reporter. The anomaly detection model retrieves baseline profiles from a threat database, loads policies related to a threat, and compares real-time traffic features with baseline profiles. The anomaly detection model further applies an anomaly detection algorithm to a traffic instance, assigns an anomaly score, and raises a flag for anomaly detection. The alert generator sends an alert to the tenant in the cloud-based environment, and the anomaly reporter notifies a management plane for further remediation of the anomaly.

Cellular IoT security using dynamic policy-driven mechanisms for threat mitigation

A capacity resolver system for provisioning and management of nodes at point of presence (POP) in a cloud-based multi-tenant system. The capacity resolver system includes a plurality of POPs and a cloud orchestration server. The POPs include hypervisors that include a plurality of nodes. The cloud orchestration receives a request for provisioning a node. The request is provisioned at the POP based on parameters from the hypervisors of the POP. The parameters include Central Processing Unit (CPU) Core utilization, memory utilization, disk utilization and Virtual File System (VFS) availability of the node. A triggering of one or more parameters above their respective threshold values is determined at the POP. Nodes are identified for downsizing or migration based on the triggering of the one or more parameters. The node is provisioned at the hypervisor of the POP in accordance with a priority for the downsizing or the migration of the nodes.

Capacity resolver for point of presence (POP) systems

A system for providing policy-controlled communication between a plurality of different cloud computing environments includes a user interface that receives configuration settings to be applied to a plurality of first instances within a first cloud computing environment and a plurality of second instances within a second cloud computing environment. The system also includes a plurality of collectors that retrieve information from the first cloud computing environment and the second cloud computing environment, and a controller that determines policies for the plurality of first instances and the plurality of second instances as functions of the configuration settings and the information. Further, the system includes a configurator that applies the policies to the plurality of first instances and the plurality of second instances; a first tester that inspects operations of the plurality of first instances and detects violations of the policies; and an enforcer that responds to the detected violations.

Growing community of inventors

San Francisco, CA, United States of America

Jonathan Michael Bosanac