Granted Patent B2

US 12,513,073 · App. 18/587,699 · Granted Dec 30, 2025

Inventors: Parag Pritam Thakore (Los Gatos, CA); Sunil Mukundan (Chennai, IN); Anupam Rai (Fremont, CA)

Assignee: Netskope, Inc.

H04L45/02H04L12/4633

Abstract

Claims (59)

1 . A method for providing a data exchange using a secure tunnel in a multi-tenant cloud native control plane system, the method comprises:

receiving by a cloud control plane via a gateway device, a request for accessing data from a client endpoint of an end-user device, wherein the request is provided by sending data packets, wherein the cloud control plane provisions a network connection to a service endpoint at a cloud provider for providing access to the data using a data plane and a control plane;

identifying by the control plane, routing information of network traffic from a plurality of end-user devices to establish the network connection for the request;

identifying a resiliency of a network of the multi-tenant cloud native control plane system based on whether the control plane or the data plane has failed, wherein based on a failure of the control plane, the data plane maintains the network connection, and based on a failure of the data plane, the control plane maintains the network connection;

identifying network patterns associated with the network traffic from the plurality of end-user devices, wherein the network patterns are used by the cloud control plane to determine a network policy associated with access to the data, and the network policy specifies routing for access to the data;

determining the secure tunnel from a plurality of tunnels for providing access to the data based on the network policy and the network patterns from the routing information, wherein the secure tunnel connects the client endpoint and the service endpoint;

forwarding the data packets by the data plane for access to the data on the secure tunnel using the routing information; and

providing the access to the data from the cloud provider to the client endpoint on the gateway device using the secure tunnel.

2 . The method for providing a data exchange using a secure tunnel in a multi-tenant cloud native control plane system as recited in claim 1 , wherein the control plane is isolated from the data plane.

3 . The method for providing a data exchange using a secure tunnel in a multi-tenant cloud native control plane system as recited in claim 2 , further comprising:

identifying a tenant associated with the request, wherein the tenant is associated with a tenant identifier or a tenant ID; and

isolating the tenant from a plurality of tenants and tenant information by a multi-tenant controller of the cloud control plane.

4 . The method for providing a data exchange using a secure tunnel in a multi-tenant cloud native control plane system as recited in claim 1 , further comprising:

determining network policies from a policy store based on the request, wherein the policy store includes network policies and tag policies, and the network policies and the tag policies are predefined either by an administrator, an enterprise, or an end-user.

5 . The method for providing a data exchange using a secure tunnel in a multi-tenant cloud native control plane system as recited in claim 4 , wherein:

an orchestrator of the cloud control plane provides the data exchange, the data exchange is associated with the network policies, and

the network policies are based on tenant specific rules, applications, user locations, networks, preferences, and/or priorities.

6 . The method for providing a data exchange using a secure tunnel in a multi-tenant cloud native control plane system as recited in claim 1 , wherein the network patterns include connections between end-user devices, gateway endpoints, user location, and device address.

7 . The method for providing a data exchange using a secure tunnel in a multi-tenant cloud native control plane system as recited in claim 1 , wherein routes and the secure tunnel are associated with past and current network patterns and network policies.

8 . A multi-tenant cloud native control plane system for providing a data exchange using a secure tunnel between a plurality of gateway endpoints, the multi-tenant cloud native control plane system comprises:

an end-user device including a client endpoint, the client endpoint is configured to provide via a gateway device, a request for accessing data from the client endpoint, wherein the request is provided by sending data packets;

a cloud control plane coupled to the end-user device; and

a cloud provider configured to provide access to the data, wherein the cloud control plane is configured to:

receive the request from the client endpoint of the end-user device;

provision a network connection to a service endpoint at the cloud provider for providing access to the data using a data plane and a control plane;

identify by the control plane, routing information of network traffic from a plurality of end-user devices to establish the network connection for the request;

identify a resiliency of a network of the multi-tenant cloud native control plane system based on whether the control plane or the data plane has failed, wherein based on a failure of the control plane, the data plane maintains the network connection, and based on a failure of the data plane, the control plane maintains the network connection;

identify network patterns associated with the network traffic from the plurality of end-user devices, wherein the network patterns are used by the cloud control plane to determine a network policy associated with access to the data, and the network policy specifies routing for access to the data;

determine the secure tunnel from a plurality of tunnels for providing access to the data based on the network policy and the network patterns from the routing information, wherein the secure tunnel connects the client endpoint and the service endpoint;

forward the data packets by the data plane for access to the data on the secure tunnel using the routing information; and

provide the access to the data from the cloud provider to the client endpoint on the gateway device using the secure tunnel.

9 . The multi-tenant cloud native control plane system for providing a data exchange using a secure tunnel between a plurality of gateway endpoints as recited in claim 8 , wherein the control plane is isolated from the data plane.

10 . The multi-tenant cloud native control plane system for providing a data exchange using a secure tunnel between a plurality of gateway endpoints as recited in claim 9 , further configured to:

identify a tenant associated with the request, wherein the tenant is associated with a tenant identifier or a tenant ID; and

isolate the tenant from a plurality of tenants and tenant information by a multi-tenant controller of the cloud control plane.

11 . The multi-tenant cloud native control plane system for providing a data exchange using a secure tunnel between a plurality of gateway endpoints as recited in claim 8 , further configured to determine network policies from a policy store based on the request, wherein the policy store includes network policies and tag policies, and the network policies and the tag policies are predefined either by an administrator, an enterprise, or an end-user.

12 . The multi-tenant cloud native control plane system for providing a data exchange using a secure tunnel between a plurality of gateway endpoints as recited in claim 11 , wherein:

an orchestrator of the cloud control plane provides the data exchange, the data exchange is associated with the network policies, and

the network policies are based on tenant specific rules, applications, user locations, networks, preferences, and/or priorities.

13 . The multi-tenant cloud native control plane system for providing a data exchange using a secure tunnel between a plurality of gateway endpoints as recited in claim 8 , wherein the network patterns include connections between end-user devices, the gateway endpoints, user location, and device address.

14 . The multi-tenant cloud native control plane system for providing a data exchange using a secure tunnel between a plurality of gateway endpoints as recited in claim 8 , wherein routes and the secure tunnel are associated with past and current network patterns and network policies.

15 . A non-transitory computer-readable medium comprising computer-executable code, the computer-executable code configured for:

receiving by a cloud control plane via a gateway device of a multi-tenant cloud native control plane system, a request for accessing data from a client endpoint of an end-user device, wherein the request is provided by sending data packets, wherein the cloud control plane provisions a network connection to a service endpoint at a cloud provider for providing access to the data using a data plane and a control plane;

identifying by the control plane, routing information of network traffic from a plurality of end-user devices to establish the network connection for the request;

identifying a resiliency of a network of the multi-tenant cloud native control plane system based on whether the control plane or the data plane has failed, wherein based on a failure of the control plane, the data plane maintains the network connection, and based on a failure of the data plane, the control plane maintains the network connection;

identifying network patterns associated with the network traffic from the plurality of end-user devices, wherein the network patterns are used by the cloud control plane to determine a network policy associated with access to the data, and the network policy specifies routing for access to the data;

determining a secure tunnel from a plurality of tunnels for providing access to the data based on the network policy and the network patterns from the routing information, wherein the secure tunnel connects the client endpoint and the service endpoint;

forwarding the data packets by the data plane for access to the data on the secure tunnel using the routing information; and

providing the access to the data from the cloud provider to the client endpoint on the gateway device using the secure tunnel.

16 . The non-transitory computer-readable medium comprising computer-executable code as recited in claim 15 , wherein the control plane is isolated from the data plane.

17 . The non-transitory computer-readable medium comprising computer-executable code as recited in claim 16 , further comprising:

identifying a tenant associated with the request; and

isolating the tenant from a plurality of tenants and tenant information by a multi-tenant controller of the cloud control plane, wherein the tenant is associated with a tenant identifier or a tenant ID.

18 . The non-transitory computer-readable medium comprising computer-executable code as recited in claim 15 , further comprising:

determining network policies from a policy store based on the request, wherein the policy store includes network policies and tag policies, and the network policies and the tag policies are predefined either by an administrator, an enterprise, or an end-user.

19 . The non-transitory computer-readable medium comprising computer-executable code as recited in claim 18 , wherein:

an orchestrator of the cloud control plane provides a data exchange, the data exchange is associated with the network policies, and

the network policies are based on tenant specific rules, applications, user locations, networks, preferences, and/or priorities.

20 . The non-transitory computer-readable medium comprising computer-executable code as recited in claim 15 , wherein the network patterns include connections between end-user devices, gateway endpoints, user location, and device address.

Assignments (1)

Priority Claims (1)

Continuity (2)

References Cited (140)