Granted Patent B2

US 12,309,295 · App. 17/843,095 · Granted May 20, 2025

Inventors: Vijay Bulusu (Fremont, CA); Akshat Maheshwari (Bangalore, IN); Harpreet Singh (San Jose, CA); Sujay Kumar (Bangalore, IN); Lidor Pergament (San Mateo, CA); Srikanth Devarajan (Cupertino, CA)

Assignee: Zscaler, Inc.

H04L9/3263H04L63/0428H04L63/1416

Abstract

Claims (51)

1. A method implemented by a node in a cloud-based system, the method comprising steps of:

responsive to monitoring a user device, detecting a request for encrypted traffic to a domain from the user device;

checking if a domain certificate for the domain is available in cache;

responsive to the domain certificate being in the cache, creating a first tunnel to the domain and a second tunnel to the user device; and

responsive to the domain certificate not being in the cache, generating the domain certificate in the cloud-based system, and creating the first tunnel and the second tunnel.

2. The method of claim 1 , wherein the steps include

responsive to generating the domain certificate, caching the domain certificate and synchronizing with other nodes in the cloud-based system.

3. The method of claim 1 , wherein the steps include

monitoring the encrypted traffic for one or more security functions.

4. The method of claim 3 , wherein the steps include

one of blocking or allowing the encrypted traffic based on the one or more security functions.

5. The method of claim 1 , wherein the steps include

prior to the detecting, enrolling the domain in the cloud HSM with a customer certificate authority.

6. The method of claim 5 , wherein a cleartext private key associated with the customer certificate authority is constrained to a hardware security module (HSM).

7. The method of claim 1 , wherein the generating includes

generating a key pair and certificate signing request;

requesting a cloud hardware security module (HSM) in or connected to the cloud-based system asymmetrically sign;

receiving a digital signature from the cloud HSM; and

merging the digital signature and a certificate.

8. The method of claim 1 , wherein the first tunnel and the second tunnel are created based on a plurality of certificates including a customer root certificate that resides in a customer hardware security module (HSM), customer intermediate certificates previously stored in the cloud HSM, and the domain certificates issued at runtime or from the cache.

9. A non-transitory computer-readable medium comprising instructions executed by one or more nodes in a cloud-based system to perform steps of:

responsive to monitoring a user device, detecting a request for encrypted traffic to a domain from the user device;

checking if a domain certificate for the domain is available in cache;

responsive to the domain certificate being in the cache, creating a first tunnel to the domain and a second tunnel to the user device; and

responsive to the domain certificate not being in the cache, generating the domain certificate in the cloud-based system, and creating the first tunnel and the second tunnel.

10. The non-transitory computer-readable medium of claim 9 , wherein the steps include

responsive to generating the domain certificate, caching the domain certificate and synchronizing with other nodes in the cloud-based system.

11. The non-transitory computer-readable medium of claim 10 , wherein the steps include

one of blocking or allowing the encrypted traffic based on the one or more security functions.

12. The non-transitory computer-readable medium of claim 9 , wherein the steps include

monitoring the encrypted traffic for one or more security functions.

13. The non-transitory computer-readable medium of claim 12 , wherein a cleartext private key associated with the customer certificate authority is constrained to a hardware security module (HSM).

14. The non-transitory computer-readable medium of claim 9 , wherein the steps include prior to the detecting, enrolling the domain with a customer certificate authority.

15. The non-transitory computer-readable medium of claim 9 , wherein the generating includes

generating a key pair and certificate signing request;

requesting a cloud hardware security module (HSM) asymmetrically sign;

receiving a digital signature from the cloud HSM; and

merging the digital signature and a certificate.

16. The non-transitory computer-readable medium of claim 9 , wherein the first tunnel and the second tunnel are created based on a plurality of certificates including a customer root certificate that resides in a customer hardware security module (HSM), customer intermediate certificates previously stored in the cloud HSM, and the domain certificates issued at runtime or from the cache.

17. A node in a cloud-based system, the node comprising:

one or more processors and memory storing instructions that, when executed, cause the one or more processors to:

responsive to monitoring a user device, detect a request for encrypted traffic to a domain from the user device;

check if a domain certificate for the domain is available in cache;

responsive to the domain certificate being in the cache, create a first tunnel to the domain and a second tunnel to the user device; and

responsive to the domain certificate not being in the cache, generate the domain certificate in the cloud-based system, and create the first tunnel and the second tunnel.

18. The node of claim 17 , wherein the instructions that, when executed, further cause the one or more processors to:

responsive to generating the domain certificate, cache the domain certificate and synchronizing with other nodes in the cloud-based system.

19. The node of claim 17 , wherein the instructions that, when executed, further cause the one or more processors to:

monitor the encrypted traffic for one or more security functions.

20. The node of claim 19 , wherein the instructions that, when executed, further cause the one or more processors to:

one of block or allow the encrypted traffic based on the one or more security functions.

Assignments (1)

Continuity (3)

References Cited (29)