Methods and systems for application and policy based network traffic isolation and data transfer

1. A method by a computer processor comprising:

creating isolated overlay tunnels over a physical underlay and creating isolated network segments in a wide area network (WAN), wherein each of the tunnels is encrypted with a different set of keys;

exposing, by a multi-tenant controller, an application programming interface (API) through which a policy of a plurality of policies is defined;

allocating a respective identity of a plurality of identities, a respective application of a plurality of applications, and a respective network-isolation identifier of a plurality of network-isolation identifiers to each of the plurality of policies for controlling a plurality of data flows in the wide area network (WAN), wherein each of the plurality of identities comprises at least a user identity for one user associated with an enterprise, wherein each of the plurality of applications comprises an application name, and wherein each of the network-isolation identifiers is a virtual WAN isolation identifier;

inserting a specific network-isolation-identifier of the plurality of network-isolation identifiers at a network-entry and removing the specific network-isolation-identifier at a network-exit, wherein the specific network-isolation identifier is bidirectional or traffic in a virtual WAN;

transmitting, by the multi-tenant controller, the plurality of policies, and a plurality of application signatures for the plurality of applications, and a plurality of application definitions for the plurality of applications to a device, wherein each of the plurality of application signatures is based on one of: (a) a size pattern of encrypted flow transactions, and (b) a frequency pattern of the encrypted flow transactions; wherein each of the plurality of application definitions is customized for the device based on a location of the device by sending the device a customized domain name for each of the plurality of applications, wherein each of the plurality of applications has a plurality of domain names;

identifying, by the device, a specific application out of the plurality of applications and a specific identity out of the plurality of identities for a data flow of the plurality of data flows, wherein the specific application and the specific identity are associated with the data flow, wherein the identifying includes analyzing the data flow to detect a presence of an application signature; and

applying, by the device, a policy of the plurality of policies to the data flow based on the specific application and the specific identity.

2. The method of claim 1 , wherein the wide area network comprises connectivity selected from a group including hybrid, physical, and logical.

3. The method of claim 1 , further comprising performing application analysis on application data flows on the network on a per session basis.

4. The method of claim 1 , wherein a policy string defines a business policy applicable to traffic associated with the specific application on the network.

5. The method of claim 4 , wherein the policy string comprises a policy string format.

6. The method of claim 5 , wherein the policy string format is standardized.

7. The method of claim 1 , wherein traffic associated with the specific application on the network is encrypted.

8. A system comprising:

at least one processor and a memory coupled to the at least one processor;

a device; and

a centrally controllable multi-tenant controller that executes on the at least one processor, wherein the memory is configured to store data, and the at least one processor is configured to control a plurality of assets across a plurality of distributed computing environments;

wherein the at least one processor coupled to the memory is configured to:

create isolated overlay tunnels over a physical underlay and create isolated network segments in a wide area network (WAN), wherein each of the tunnels is encrypted with a different set of keys, and the wide area network connects the plurality of distributed computing environments;

expose, via the multi-tenant controller, an application programmer interface (API) through which a policy of a plurality of policies is defined;

allocate a respective identity of a plurality of identities, a respective application of a plurality of applications, and a respective network-isolation identifier of a plurality of network-isolation identifiers to each of the plurality of policies for controlling a plurality of data flows in the wide area network (WAN), wherein each of the plurality of identities comprises at least a user identity for one user associated with an enterprise, wherein each of the plurality of applications comprises an application name, and wherein each of the network-isolation identifiers is a virtual WAN isolation identifier;

insert a specific network-isolation-identifier of the plurality of network-isolation identifiers at a network-entry and remove the specific network-isolation-identifier at a network-exit, wherein the specific network-isolation identifier is bidirectional for traffic in a virtual WAN;

transmit, via the multi-tenant controller, the plurality of policies, and a plurality of application signatures for the plurality of applications, and a plurality of application definitions for the plurality of applications to the device, wherein each of the plurality of application signatures is based on one of: (a) a size pattern of encrypted flow transactions, and (b) a frequency pattern of the encrypted flow transactions, wherein each of the plurality of application definitions is customized for the device based on a location of the device by sending the device a customized domain name for each of the plurality of applications, wherein each of the plurality of applications has a plurality of domain names;

identify, via the devices, a specific application out of the plurality of applications and a specific identity out of the plurality of identities for a data flow of the plurality of data flows, wherein the specific application and the specific identity are associated with the data flow, wherein the identifying includes analyzing the data flow to detect a presence of an application signature; and

apply, via the device, a policy of the plurality of policies to the data flow based on the specific application and the specific identity.

9. The system of claim 8 , wherein the wide area network comprises connectivity selected from a group including hybrid, physical, and logical.

10. The system of claim 8 , further configured to perform application analysis on application data flows on the network on a per session basis.

11. The system of claim 8 , wherein a policy string defines a business policy applicable to traffic associated with the specific application on the network.

12. The system of claim 11 , wherein the policy string comprises a policy string format.

13. The system of claim 12 , wherein the policy string format is standardized.

14. The system of claim 8 , wherein traffic associated with the specific application on the network is encrypted.

15. A non-transitory computer-readable medium storing instructions that adapt at least one processor to:

create isolated overlay tunnels over a physical underlay and create isolated network segments in a wide area network (WAN), wherein each of the tunnels is encrypted with a different set of keys;

expose, by a multi-tenant controller, an application programmer interface (API) through which a policy of a plurality of policies is defined;

allocate a respective identity of a plurality of identities, a respective application of a plurality of applications, and a respective network-isolation identifier of a plurality of network-isolation identifiers to each of the plurality of policies for controlling a plurality of data flows in the wide area network (WAN), wherein each of the plurality of identities comprises at least a user identity for one user associated with an enterprise, wherein each of the plurality of applications comprises an application name, and wherein each of the network-isolation identifiers is a virtual WAN isolation identifier;

insert a specific network-isolation-identifier of the plurality of network-isolation identifiers at a network-entry and remove the specific network-isolation-identifier at a network-exit, wherein the specific network-isolation identifier is bidirectional for traffic in a virtual WAN;

transmit, by the multi-tenant controller, the plurality of policies, and a plurality of application signatures for the plurality of applications, and a plurality of application definitions for the plurality of applications to a device, wherein each of the plurality of application signatures is based on one of: (a) a size pattern of encrypted flow transactions, and (b) a frequency pattern of the encrypted flow transactions; wherein each of the plurality of application definitions is customized for the device based on a location of the device by sending the device a customized domain name for each of the plurality of applications, wherein each of the plurality of applications has a plurality of domain names;

identify, by the device, a specific application out of the plurality of applications and a specific identity out of the plurality of identities for a data flow of the plurality of data flows, wherein the specific application and the specific identity are associated with the data flow, wherein the identifying includes analyzing the data flow to detect a presence of an application signature; and

apply, by the device, a policy of the plurality of policies to the data flow based on the specific application and the specific identity.

16. The non-transitory computer-readable medium of claim 15 , wherein the wide area network comprises connectivity selected from a group including hybrid, physical, and logical.

17. The non-transitory computer-readable medium of claim 15 , wherein each policy comprises a policy string defining a business policy applicable to traffic associated with the specific application.

18. The non-transitory computer-readable medium of claim 17 , wherein the policy string comprises a policy string format.

19. The non-transitory computer-readable medium of claim 18 , wherein the policy string format is standardized.

20. The non-transitory computer-readable medium of claim 17 , wherein traffic associated with the application is encrypted.