Multi-tenant cloud-based firewall systems and methods

Patent metadata

Field	Value
Publication number	US-11582192-B2
Application number	US-202016781505-A
Country	US
Kind code	B2
Filing date	Feb 4, 2020
Priority date	Nov 17, 2015
Publication date	Feb 14, 2023
Grant date	Feb 14, 2023

Abstract

Multi-tenant cloud-based firewall systems and methods are described. The firewall systems and methods can operate overlaid with existing branch office firewalls or routers as well as eliminate the need for physical firewalls. The firewall systems and methods can protect users at user level control, regardless of location, device, etc., over all ports and protocols (not only ports 80/443) while providing administrators a single unified policy for Internet access and integrated reporting and visibility. The firewall systems and methods can eliminate dedicated hardware at user locations, providing a software-based cloud solution. The firewall systems and methods support application awareness to identify application; user awareness to identify users, groups, and locations regardless of physical address; visibility and policy management providing unified administration, policy management, and reporting; threat protection and compliance to block threats and data leaks in real-time; high performance through an in-line cloud-based, scalable system; etc.

First claim

What is claimed is:

1. A non-transitory computer-readable storage medium having computer readable code stored thereon for programming a processor, in a node of a cloud-based security system, to perform steps of:
receiving a plurality of packets, each of the plurality of packets being received from a respective network device, each respective device being associated with one of a plurality of tenants associated with the cloud-based security system and being external to the node, the cloud-based security system enabling communication over a Wide Area Network (WAN),
selecting firewall policies for processing each respective packet of the plurality of packets based on a matching criteria, wherein the cloud-based security system supports the plurality of tenants and the firewall policies are selected based on which tenant is in the matching criteria for the respective packet and which of a plurality of firewall policies are associated with the tenant;
dropping one or more of the plurality of packets responsive to the one or more packets not being location based and not being Hypertext Transfer Protocol (HTTP) or HTTP Secure (HTTPS) traffic;
generating a new firewall session, at the node, for each packet matching a distinctive firewall policy by allocating resources thereto, wherein the new firewall session is generated for each packet based on if the packet is location based and not destined for the cloud node;
processing each of the plurality of packets utilizing one of the firewall sessions generated by directing packets to a respective firewall session based on the matching criteria to determine whether or not to block the respective packet from transmission over the WAN, the block is performed in the node in the cloud-based security system;
logging every firewall session for multiple users, multiple user devices, multiple locations, multiple applications, multiple ports, and multiple protocols; and
generating one of a real-time report generated by compressed stats and an analyze report generated by full session log analysis.

2. The non-transitory computer-readable storage medium of claim 1 , wherein the firewall policies are further based on a location in the matching criteria.

3. The non-transitory computer-readable storage medium of claim 1 , wherein each respective network device is configured to route Internet-bound traffic to the cloud-based security system.

4. The non-transitory computer-readable storage medium of claim 1 , wherein the firewall policies are configured to operate over all ports and protocols associated with the WAN.

5. The non-transitory computer-readable storage medium of claim 1 , wherein each of the plurality of packets includes one of Secure Sockets Layer (SSL) and Transport Layer Security (TLS) traffic.

6. The non-transitory computer-readable storage medium of claim 1 , wherein the steps further include
performing Deep Packet Inspection (DPI) on each of the plurality of packets in a same session; and
determining an application associated with the same session based on the DPI.

7. The non-transitory computer-readable storage medium of claim 1 , wherein the cloud-based security system is configured to operate the firewall policies in a cloud without firewall hardware deployed at local Internet breakouts.

8. The non-transitory computer-readable storage medium of claim 1 , wherein the firewall policies are security policies based on user identity, application awareness, and location.

9. The non-transitory computer-readable storage medium of claim 1 , wherein the steps further include
receiving an update based on detection of zero-day/zero-hour threats; and
updating the firewall based on the update.

10. A node in a cloud-based security system, comprising:
a processor and memory storing instructions that, when executed, cause the processor to
receive a plurality of packets, each of the plurality of packets being received from a respective network device, each respective device being associated with one of a plurality of tenants associated with the cloud-based security system and being external to the node, the cloud-based security system enabling communication over a Wide Area Network (WAN),
select firewall policies for processing each respective packet of the plurality packets based on a matching criteria, wherein the cloud-based security system supports the plurality of tenants and the firewall policies are selected based on which tenant is in the matching criteria for the respective packet and which of a plurality of firewall policies are associated with the tenant;
drop one or more of the plurality of packets responsive to the one or more packets not being location based and not being Hypertext Transfer Protocol (HTTP) or HTTP Secure (HTTPS) traffic;
generate a new firewall session, at the node, for each packet matching a distinctive firewall policy by allocating resources thereto, wherein the new firewall session is generated for each packet based on if the packet is location based and not destined for the cloud node;
process each of the plurality of packets utilizing one of the firewall sessions generated by directing packets to a respective firewall session based on the matching criteria to determine whether or not to block the respective packet from transmission over the WAN, the block is performed in the node in the cloud-based security system;
logging every firewall session for multiple users, multiple user devices, multiple locations, multiple applications, multiple ports, and multiple protocols; and
generating one of a real-time report generated by compressed stats and an analyze report generated by full session log analysis.

11. The node of claim 10 , wherein the firewall policies are further based on a location in the matching criteria.

12. The node of claim 10 , wherein each respective network device is configured to route Internet-bound traffic to the cloud-based security system.

13. The node of claim 10 , wherein the firewall policies are configured to operate over all ports and protocols associated with the WAN.

14. The node of claim 10 , wherein each of the plurality of packets includes one of Secure Sockets Layer (SSL) and Transport Layer Security (TLS) traffic.

15. The node of claim 10 , wherein the instructions that, when executed, further cause the processor to
perform Deep Packet Inspection (DPI) on each of the plurality of packets in a same session; and
determine an application associated with the same session based on the DPI.

16. The node of claim 10 , wherein the cloud-based security system is configured to operate the firewall policies in a cloud without firewall hardware deployed at local Internet breakouts.

17. The node of claim 10 , wherein the firewall policies are security policies based on user identity, application awareness, and location.

18. The node of claim 10 , wherein the steps further include
receiving an update based on detection of zero-day/zero-hour threats; and
updating the firewall based on the update.

19. A method implemented in a node of a cloud-based security system, the method comprising:
receiving a plurality of packets, each of the plurality of packets being received from a respective network device, each respective device being associated with one of a plurality of tenants associated with the cloud-based security system and being external to the node, the cloud-based security system enabling communication over a Wide Area Network (WAN),
selecting firewall policies for processing each respective packet of the plurality of packets based on

Assignees

• Zscaler Inc

Inventors

• Devarajan Srikanth
• Stepanenko Vladimir
• Verma Ravinder
• KAWAMOTO James

Classifications

• H04L67/141

  Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) · CPC title

• H04L43/028

  by filtering · CPC title

• H04L63/0218

  Distributed architectures, e.g. distributed firewalls · CPC title

• H04L63/0254 Primary

  Stateful filtering · CPC title

• H04L67/146

  Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding · CPC title