Granted Patent B2

US 12,563,097 · App. 18/413,364 · Granted Feb 24, 2026

Inventors: Charles Bransi (Palo Alto, CA); Praveen Yadothare (Sunnyvale, CA); Siva Yarlagadda (San Jose, CA); Vladimir Stepanenko (Sunnyvale, CA)

Assignee: Zscaler, Inc.

H04L63/20G06F16/958

Abstract

Claims (46)

1 . A method for tag based policy enforcement for dynamic cloud comprising steps of:

monitoring, via a cloud-based system, traffic associated with one or more customers of the cloud-based system;

discovering all tags associated with all workloads of a customer from the monitored one or more customers;

synchronizing discovered tags with one or more cloud connectors of the cloud-based system, wherein the one or more cloud connectors are communicatively coupled to the one or more nodes of the cloud-based system;

receiving a packet from a workload associated with one of the monitored one or more customers;

performing a tag lookup from the discovered all tags at the one or more nodes of the cloud-based system based on the received packet; and

enforcing one or more policies based on the performed tag lookup.

2 . The method of claim 1 , wherein the steps further comprise:

performing a policy lookup based on tags discovered during the tag lookup, wherein the enforcing is performed based thereon.

3 . The method of claim 2 , wherein the tag lookup, the policy lookup, and the enforcing are performed at the one or more nodes of the cloud-based system.

4 . The method of claim 1 , wherein based on no tags being found for the workload during the tag lookup at the one or more nodes, the steps further comprise:

dropping the packet;

querying the one or more cloud connectors for workload information; and

receiving, in a next packet, all tags and a version associated with the workload.

5 . The method of claim 4 , wherein the steps further comprise:

storing the received tags and version associated with the workload at the one or more nodes.

6 . The method of claim 4 , wherein the tags and version associated with the workload are received from the one or more cloud connectors via transmission of a Transmission Control Protocol (TCP) Synchronization (SYN) packet.

7 . The method of claim 1 , wherein responsive to identifying a modification of one or more tags of the workload, the steps further comprise:

updating a database associated with one or more cloud connectors with modified tags and a version of the workload based thereon.

8 . The method of claim 7 , wherein based on identifying a new version number of the workload during the tag lookup at the one or more nodes, the steps further comprise:

dropping the packet;

querying the one or more cloud connectors for new workload information; and

receiving, in a next packet, all tags and the new version associated with the workload.

9 . A non-transitory computer-readable medium comprising instructions for tag-based policy enforcement for dynamic cloud, that, when executed, cause one or more processors to perform steps of:

monitoring, via a cloud-based system, traffic associated with one or more customers of the cloud-based system;

discovering all tags associated with all workloads of a customer from the monitored one or more customers;

synchronizing discovered tags with one or more cloud connectors of the cloud-based system, wherein the one or more cloud connectors are communicatively coupled to the one or more nodes of the cloud-based system;

receiving a packet from a workload associated with a customer of the monitored one or more customers;

performing a tag lookup from the discovered all tags at the one or more nodes of the cloud-based system based on the received packet; and

enforcing one or more policies based on the performed tag lookup.

10 . The non-transitory computer-readable medium of claim 9 , wherein the steps further comprise:

performing a policy lookup based on tags discovered during the tag lookup, wherein the enforcing is performed based thereon.

11 . The non-transitory computer-readable medium of claim 10 , wherein the tag lookup, the policy lookup, and the enforcing are performed at the one or more nodes of the cloud-based system.

12 . The non-transitory computer-readable medium of claim 9 , wherein based on no tags being found for the workload during the tag lookup at the one or more nodes, the steps further comprise:

dropping the packet;

querying the one or more cloud connectors for workload information; and

receiving, in a next packet, all tags and a version associated with the workload.

13 . The non-transitory computer-readable medium of claim 12 , wherein the steps further comprise:

storing the received tags and version associated with the workload at the one or more nodes.

14 . The non-transitory computer-readable medium of claim 12 , wherein the tags and version associated with the workload are received from the one or more cloud connectors via transmission of a Transmission Control Protocol (TCP) Synchronization (SYN) packet.

15 . The non-transitory computer-readable medium of claim 9 , wherein responsive to identifying a modification of one or more tags of the workload, the steps further comprise:

updating a database associated with one or more cloud connectors with modified tags and a version of the workload based thereon.

16 . The non-transitory computer-readable medium of claim 15 , wherein based on identifying a new version number of the workload during the tag lookup at the one or more nodes, the steps further comprise:

dropping the packet;

querying the one or more cloud connectors for new workload information; and

receiving, in a next packet, all tags and the new version associated with the workload.

Assignments (1)

Continuity (1)

References Cited (12)