US 12,015,619 B2
Dynamic routing of access request streams in a unified policy enforcement system
Kartik Subbanna, Bangalore (IN); Amit Ganesh Datar, Fremont, CA (US); and Kand Ly, San Francisco, CA (US)
Assigned to Netskope, Inc., Santa Clara, CA (US)
Filed by NetSkope, Inc., Santa Clara, CA (US)
Filed on Jan. 30, 2021, as Appl. No. 17/163,415.
Prior Publication US 2022/0247761 A1, Aug. 4, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); H04L 67/02 (2022.01)
CPC H04L 63/1416 (2013.01) [H04L 63/0236 (2013.01); H04L 63/1425 (2013.01); H04L 63/20 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A system for providing cloud-based network security, the system including:
a cloud access security broker (CASB) component that runs on cloud-based hardware and is configured for providing security with respect to access to a cloud-based resource by users within an organization, via processing of one or more received packets being communicated between said users of said organization through a set of firewall components to said cloud-based resource, in compliance with a unified security policy;
a secure web gateway (SWG) component that runs on cloud-based hardware and is configured for providing security with respect to access to a web accessible destination by said users within an organization, via processing of one or more received packets being communicated between said users of said organization through the set of firewall components and said web accessible destination, in compliance with the unified security policy;
the set of firewall components that run on cloud-based hardware and are configured for providing packet-level and protocol-level traffic inspection and access control, with respect to received packets, and for selectively forwarding said received packets to the CASB and SWG dependent on a type of stream to which said received packets belong; and
a restrictive state analyzer that runs on cloud-based hardware, that is configured to be in communication with each of said components, and that is configured for determining if and what action should be performed with respect to said each packet, in response to said communication with at least one of said components and in compliance with the unified security policy.