US 12,231,403 B2
Cloud-based intrusion prevention system, multi-tenant firewall, and stream scanner
Srikanth Devarajan, San Jose, CA (US); Sushil Pangeni, Fremont, CA (US); Vladimir Stepanenko, Sunnyvale, CA (US); Ravinder Verma, San Jose, CA (US); and Naresh Kumar Povlavaram Munirathnam, San Jose, CA (US)
Assigned to Zscaler, Inc., San Jose, CA (US)
Filed by Zscaler, Inc., San Jose, CA (US)
Filed on Jan. 26, 2022, as Appl. No. 17/584,467.
Application 17/584,467 is a continuation of application No. 16/858,892, filed on Apr. 27, 2020, granted, now 11,277,383.
Application 16/858,892 is a continuation in part of application No. 16/781,505, filed on Feb. 4, 2020, granted, now 11,582,192.
Application 16/781,505 is a continuation of application No. 14/943,579, filed on Nov. 17, 2015, granted, now 10,594,656, issued on Mar. 17, 2020.
Prior Publication US 2022/0217121 A1, Jul. 7, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); H04L 43/028 (2022.01); H04L 67/10 (2022.01); H04L 67/141 (2022.01); H04L 67/146 (2022.01)
CPC H04L 63/0254 (2013.01) [H04L 43/028 (2013.01); H04L 63/0218 (2013.01); H04L 67/10 (2013.01)] 18 Claims
OG exemplary drawing
 
1. A method implemented by a cloud-based system comprising steps of:
responsive to connecting to a user device with a user associated with a first tenant of a plurality of tenants, obtaining security policies for the user that are configured for the tenant, wherein the security policies for the user are the same regardless of connection type, location of the user, and device type and operating system of the user device;
stream scanning traffic between the user device and the Internet based on the security policies, wherein the security policies are for firewall and intrusion prevention functions and the security policies includes a plurality of rules, wherein the stream scanning includes applying the plurality of rules to packets associated with the traffic for pattern matching, maintaining a state of the pattern matching across packet boundaries while not buffering any of the traffic where there are a plurality of patterns each broken intro parts for monitoring across the packet boundaries, and determining the pattern matching based on the state utilizing a rule option Directed Acyclic Graph (DAG) to track the plurality of patterns wherein the DAG defines a dependency determined by a rule option modifier; and
one of allowing and blocking the traffic based on the pattern matching of the stream scanning.