Zscaler, Inc.

Vijay Bulusu

Srikanth Devarajan

Leslie McCutcheon

Narinder Paul

Abhinav Bansal

Vikas Mahajan

Ajit Singh

Pooja Deshmukh

Naresh Kumar

Lidor Pergament

Santhosh Kumar

Akshat Maheshwari

Harpreet Singh

Sravani Manukonda

Roy Rajan

Sujay Kumar

A method implemented by a node in a cloud-based system includes responsive to monitoring a user device, detecting a request for encrypted traffic to a domain from the user device; checking if a domain certificate for the domain is available in cache; responsive to the domain certificate being in the cache, creating a first tunnel to the domain and a second tunnel to the user device; and, responsive to the domain certificate not being in the cache, generating the domain certificate with a cloud hardware security module (HSM) system, and creating the first tunnel and the second tunnel.

Cloud-based man-in-the-middle inspection of encrypted traffic using cloud-based multi-tenant HSM infrastructure

A node configured as any of a proxy, a Secure Web Gateway, and a Secure Internet Gateway is configured to perform steps of, responsive to establishing a connection with a user device having a user associated with a tenant and obtaining policy for the user, monitoring traffic between the user device and the Internet where the monitoring is at a middle location, inline between the user device and an endpoint; responsive to the traffic being encrypted as a tunnel, performing one or more operations to enable accessing the encrypted traffic; analyzing the traffic based on the policy, including at least checking for malicious traffic and Data Loss Prevention (DLP) for the tenant; and one of allowing, blocking, or limiting the traffic based on the analyzing.

Encrypted traffic inspection in a cloud-based security system

Systems and methods include obtaining a profile for an application, wherein the profile includes one or more tenants, rules for use of the application by the one or more tenants, and users for the rules; monitoring a user of a tenant of the one or more tenants inline via a node in a cloud-based system; identifying an application of the one or more applications based on the monitoring and associated rules for the user; and enforcing the associated rules for the user for the application.

Granular SaaS tenant restriction systems and methods

Systems and methods include establishing a control channel of a tunnel utilizing a first encryption technique, wherein the tunnel is between a local node including one or more processors and a remote node, and wherein the control channel includes a session identifier; establishing a data channel of the tunnel utilizing a second encryption technique, wherein the data tunnel is bound to the control channel based on the session identifier; performing, over the control channel, device authentication and user authentication of one or more users associated with the remote node, wherein each of the one or more users includes a user identifier; and, subsequent to the device authentication and the user authentication, exchanging data packets over the data channel with each data packet including a corresponding user identifier. The first encryption technique can be one of TLS and SSL, and the second encryption technique can be one of TLS and DTLS.

Cloud-based tunnel protocol systems and methods for multiple ports and protocols

A node configured as any of a proxy, a Secure Web Gateway, and a Secure Internet Gateway is configured to perform steps of establishing a connection with a user device having a user associated with a tenant; obtaining policy for the user; monitoring traffic between the user device and the Internet including snooping session keys for any encrypted traffic; analyzing the traffic based on the policy including utilizing the session keys on the encrypted traffic; and one of allowing, blocking, or limiting the traffic based on the analyzing.

Systems and methods include, in a node operating as a snooping proxy, monitoring traffic between a user device and the Internet; detecting and monitoring a handshake between the user device and an endpoint for determining keys associated with encryption between the user device and the endpoint; monitoring encrypted traffic between the user device and the endpoint subsequent to the handshake based on the keys; and performing one or more security functions on the encrypted traffic based on the monitoring. The node can be part of a cloud-based security system and configured inline between the user device and the endpoint.

Growing community of inventors

Fremont, CA, United States of America

Vijay Bulusu