Granular SaaS tenant restriction systems and methods

Patent metadata

Field	Value
Publication number	US-12041053-B2
Application number	US-202017102688-A
Country	US
Kind code	B2
Filing date	Nov 24, 2020
Priority date	Oct 12, 2020
Publication date	Jul 16, 2024
Grant date	Jul 16, 2024

Abstract

Systems and methods include obtaining a profile for an application, wherein the profile includes one or more tenants, rules for use of the application by the one or more tenants, and users for the rules; monitoring a user of a tenant of the one or more tenants inline via a node in a cloud-based system; identifying an application of the one or more applications based on the monitoring and associated rules for the user; and enforcing the associated rules for the user for the application.

First claim

What is claimed is:

1. A non-transitory computer-readable storage medium having computer-readable code stored thereon for programming a node in a cloud-based system to perform steps of:
obtaining a profile for an application of one or more applications, wherein the profile includes one or more tenants, rules for use of the application by the one or more tenants, and users for the rules;
monitoring a user of a tenant of the one or more tenants inline;
identifying, based on the monitoring, the application, the user requesting to access the application, and associated rules for the user;
creating a sub-application based on the identified application and the associated rules for the user, wherein the created sub-application includes specific sub-regions of the identified application; and
enforcing the associated rules for the user for accessing the specific sub-regions of the identified application.

2. The non-transitory computer-readable storage medium of claim 1 , wherein traffic between the application and the node includes a header with information related to the application for the identifying.

3. The non-transitory computer-readable storage medium of claim 1 , wherein the node is located between the user and the application, and wherein the identifying is based on a request from the user to the application monitored at the node and a response from the application to the user monitored at the node.

4. The non-transitory computer-readable storage medium of claim 1 , wherein the identified application is any of a social media application, a consumer application, and a Software-as-a-Service application, and wherein the steps further include limiting bandwidth to one or more of the specific sub-regions based on the associated rules.

5. The non-transitory computer-readable storage medium of claim 1 , wherein the one or more applications include a video sharing application, and wherein the associated rules enforce access to specific sub-regions within the one or more applications including any of allowing or blocking channels and allowing or blocking content categories.

6. The non-transitory computer-readable storage medium of claim 1 , wherein the monitoring is via a Cloud Access Security Broker (CASB) service implemented through the cloud-based system.

7. The non-transitory computer-readable storage medium of claim 1 , wherein the monitoring includes inspection of encrypted traffic.

8. The non-transitory computer-readable storage medium of claim 1 , wherein the tenant is one of a plurality of tenants configured to operate with the cloud-based system, wherein, for a given application, the associated rules are different for at least two tenants.

9. The non-transitory computer-readable storage medium of claim 1 , wherein the application is a first application, and wherein the steps further include:
identifying a second application of the one or more applications based on the monitoring and associated rules for the user; and
enforcing the associated rules for the user for the second application, wherein the associated rules for the second application are different from the associated rules for the first application.

10. A method comprising:
obtaining a profile for an application of one or more applications, wherein the profile includes one or more tenants, rules for use of the application by the one or more tenants, and users for the rules;
monitoring a user of a tenant of the one or more tenants inline via a node in a cloud-based system;
identifying, based on the monitoring, the application, the user requesting to access the application, and associated rules for the user;
creating a sub-application based on the identified application and the associated rules for the user, wherein the created sub-application includes specific sub-regions of the identified application; and
enforcing the associated rules for the user for accessing the specific sub-regions of the identified application.

11. The method of claim 10 , wherein traffic between the application and the node includes a header with information related to the application for the identifying.

12. The method of claim 10 , wherein the node is located between the user and the application, and wherein the identifying is based on a request from the user to the application monitored at the node and a response from the application to the user monitored at the node.

13. The method of claim 10 , wherein the identified application is any of a social media application, a consumer application, and a Software-as-a-Service application, and wherein the steps further include limiting bandwidth to one or more of the specific sub-regions based on the associated rules.

14. The method of claim 10 , wherein the one or more applications include a video sharing application, and wherein the associated rules enforce access to specific sub-regions within the one or more applications including any of allowing or blocking channels and allowing or blocking content categories.

15. The method of claim 10 , wherein the monitoring is via a Cloud Access Security Broker (CASB) service implemented through the cloud-based system.

16. The method of claim 10 , wherein the monitoring includes inspection of encrypted traffic.

17. The method of claim 10 , wherein the tenant is one of a plurality of tenants configured to operate with the cloud-based system, wherein, for a given application, the associated rules are different for at least two tenants.

18. The method of claim 10 , wherein the application is a first application, and further comprising:
identifying a second application of the one or more applications based on the monitoring and associated rules for the user; and
enforcing the associated rules for the user for the second application, wherein the associated rules for the second application are different from the associated rules for the first application.

19. A node in a cloud-based system comprising:
one or more processors and memory comprising instructions that, when executed, cause the one or more processors to
obtain a profile for an application of one or more applications, wherein the profile includes one or more tenants, rules for use of the application by the one or more tenants, and users for the rules;
monitor a user of a tenant of the one or more tenants in line;
identify, based on the monitoring, the application, the user requesting to access the application, and associated rules for the user; and
create a sub-application based on the identified application and the associated rules for the user, wherein the created sub-application includes specific sub-regions of the identified application; and
enforce the associated rules for the user for accessing the specific sub-regions of the identified application.

20. The node of claim 19 , wherein the tenant is one of a plurality of tenants configured to operate with the cloud-based system, wherein, for a given application, the associated rules are different for at least two tenants.

Assignees

• Zscaler Inc

Inventors

• Deshmukh Pooja
• Paul Narinder
• Kumar Naresh
• Kumar Santhosh
• Manukonda Sravani
• Bulusu Vijay

Classifications

• G06F21/629

  to features or functions of an application · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/102 Primary

  Entity profiles · CPC title

• H04L63/0263 Primary

  Rule management · CPC title