Systems and methods for cloud based unified service discovery and secure availability

Patent metadata

Field	Value
Publication number	US-9935955-B2
Application number	US-201615153108-A
Country	US
Kind code	B2
Filing date	May 12, 2016
Priority date	Mar 28, 2016
Publication date	Apr 3, 2018
Grant date	Apr 3, 2018

Abstract

Systems and methods implemented by a unified agent application executed on a mobile device, for unified service discovery and secure availability include authenticating a user into a plurality of cloud services including a proxy service and a Virtual Private Network (VPN) service, wherein the proxy service is utilized for Internet traffic and the VPN service is for Intranet traffic; creating and operating a link local network at the mobile device with a virtual network interface and multiple listening sockets; and intercepting traffic at the virtual network interface from one or more client applications on the mobile device and splitting the traffic between the proxy service, the VPN service, and the Internet based on a type of the traffic, a destination, and the one or more client applications.

First claim

What is claimed is:

1. A method, implemented by a unified agent application executed on a mobile device, for unified service discovery and secure availability, the method comprising:
authenticating a user into a plurality of cloud services comprising a proxy service and a Virtual Private Network (VPN) service, wherein the proxy service is utilized for Internet traffic and the VPN service is for Intranet traffic;
creating and operating a link local network at the mobile device with a virtual network interface and multiple listening sockets; and
intercepting traffic at the virtual network interface from one or more client applications on the mobile device and splitting the traffic between the proxy service, the VPN service, and the Internet based on a type of the traffic, a destination, and the one or more client applications.

2. The method of claim 1 , wherein the proxy service is through a distributed security system configured to detect and preclude malware, spyware, viruses, email spam, and other undesirable content in a cloud system, wherein the VPN service is configured to securely connect to Intranet enterprise resources while external from the enterprise.

3. The method of claim 1 , further comprising:
prior to the authenticating, installing the unified agent application and enrolling the user in the plurality of cloud services, wherein the enrolling is automated through discovery by communicating the user to a Cloud Administrative Server in an agent manager cloud.

4. The method of claim 1 , further comprising:
discovering the plurality of cloud services or the user;
authenticating the user through an Identity Provider (IDP); and
enrolling the user in the plurality of cloud services.

5. The method of claim 1 , further comprising:
executing the unified agent application concurrently with another VPN application, wherein traffic destined for the another VPN application is not intercepted.

6. The method of claim 1 , further comprising:
during enrollment of the user in the plurality of cloud services, developing a device fingerprint of the mobile device and using the device fingerprint in the proxy service and the VPN service.

7. The method of claim 1 , wherein the authenticating utilizes one or more of Active Directory, Lightweight Directory Access Protocol, and Security Assertion Markup Language.

8. The method of claim 1 , wherein the multiple listening sockets comprise a User Datagram Protocol (UDP) listening socket for all UDP traffic and two Transmission Control Protocol (TCP) listening sockets with one for the VPN service and another for all other traffic.

9. The method of claim 8 , wherein the virtual network interface is configured to change packet destinations to one of the multiple listening sockets, wherein the UDP listening socket is configured to create and write local Domain Name System (DNS) responses, wherein the TCP listening socket for the VPN service is configured to exchange packets with a VPN server for the VPN service.

10. The method of claim 1 , further comprising:
evaluating network conditions and seamlessly migrating tunnels as required based on the network conditions, wherein the tunnels support the VPN service and the proxy service.

11. The method of claim 1 , further comprising:
enforcing access control by the unified agent application preventing network connectivity until enrolled into the plurality of cloud services.

12. A mobile device configured to provide unified service discovery and secure availability through a unified agent application, the mobile device comprising:
a network interface, a data store, and a processor communicatively coupled to one another; and
memory storing computer executable instructions, and in response to execution by the processor, the computer-executable instructions cause the processor to
authenticate a user into a plurality of cloud services comprising a proxy service and a Virtual Private Network (VPN) service, wherein the proxy service is utilized for Internet traffic and the VPN service is for Intranet traffic;
create and operate a link local network at the mobile device with a virtual network interface and multiple listening sockets; and
intercept traffic at the virtual network interface from one or more client applications on the mobile device and split the traffic between the proxy service, the VPN service, and the Internet based on a type of the traffic, a destination, and the one or more client applications.

13. The mobile device of claim 12 , wherein the proxy service is through a distributed security system configured to detect and preclude malware, spyware, viruses, email spam, and other undesirable content in a cloud system, wherein the VPN service is configured to connect to Intranet enterprise resources while external from the enterprise.

14. The mobile device of claim 12 , wherein the computer-executable instructions further cause the processor to
prior to authentication, install the unified agent application and enroll the user in the plurality of cloud services, wherein enrollment is automated through discovery by communicating the user to a Cloud Administrative Server in an agent manager cloud.

15. The mobile device of claim 12 , wherein the computer-executable instructions further cause the processor to
discover the plurality of cloud services or the user;
authenticate the user through an Identity Provider (IDP); and
enroll the user in the plurality of cloud services.

16. The mobile device of claim 12 , wherein the computer-executable instructions further cause the processor to
execute the unified agent application concurrently with another VPN application, wherein traffic destined for the another VPN application is not intercepted.

17. The mobile device of claim 12 , wherein the computer-executable instructions further cause the processor to
during enrollment of the user in the plurality of cloud services, develop a device fingerprint of the mobile device and use the device fingerprint in the proxy service and the VPN service.

18. The mobile device of claim 12 , wherein authentication utilizes one or more of Active Directory, Lightweight Directory Access Protocol, and Security Assertion Markup Language.

19. The mobile device of claim 12 , wherein the multiple listening sockets comprise a User Datagram Protocol (UDP) listening socket for all UDP traffic and two Transmission Control Protocol (TCP) listening sockets with one for the VPN service and another for all other traffic.

20. A cloud system, comprising:
a plurality of cloud nodes each comprising a processor and memory storing instructions that, when executed, cause the processor to
for a user with a user device executing a unified agent application, authenticate the user into a plurality of cloud services comprising a proxy service and a Virtual Private Network (VPN) service, wherein the proxy service is utilized for Internet traffic and the VPN service is for Intranet traffic;
receive traffic from the user device, wherein the unified agent application is configured to create and operate a link local network at the user device with a virtual network interface and multiple listening sockets; and
direct the traffic to the Internet or an Intranet based on which tunnel, the traffic is received on, wherein the unified agent application is configured to intercept traffic at the virtual network interface from one or more client applications on the user device and split the traffic between tunnels for the proxy service, the VPN service, and the Internet ba

Assignees

• Desai Purvi
• Mahajan Vikas
• Bansal Abhinav
• Singh Ajit
• Kumar Sandeep
• Raman Vivek
• Zscaler Inc

Inventors

• Desai Purvi
• Mahajan Vikas
• Bansal Abhinav
• Singh Ajit
• Kumar Sandeep
• Raman Vivek

Classifications

• H04L61/1511

  Electricity · mapped topic

• H04L67/16

  Electricity · mapped topic

• H04L69/162

  involving adaptations of sockets based mechanisms (secure socket layer H04L63/168) · CPC title

• H04L63/0884 Primary

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04L63/0272

  Virtual private networks · CPC title