# US 10,375,024 B2 · Cloud-based virtual private access systems and methods > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,024 B2 - Document ID: US10375024B2 - Status: Granted - Kind: B2 - Application number: 15/158,153 - Filed: 2016-05-18 - Published: 2016-09-08 - Granted: 2019-08-06 - Earliest claimed: 2014-06-20 - Assignees: Zscaler, Inc. - Applicants: Patrick Foxhoven; John A. Chanak; William Fehring; Denzil Wessels; Purvi Desai; Manoj Apte; Sudhindra P. Herle - Inventors: Patrick Foxhoven; John A. Chanak; William Fehring; Denzil Wessels; Purvi Desai; Manoj Apte; Sudhindra P. Herle - Web page: https://patentgrep.com/patent/US10375024B2 ## CPC - H04L 63/0272: {Virtual private networks} - H04L 63/0281: {Proxies} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/1021: based on client or server locations - G06F 16/285: {Clustering or classification} - H04L 61/4511: using domain name system [DNS] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A virtual private access method implemented by a cloud system, includes receiving a request to access resources from a user device, wherein the resources are located in one of a public cloud and an enterprise network and the user device is remote therefrom on the Internet; forwarding the request to a central authority for a policy look up and for a determination of connection information to make an associated secure connection through the cloud system to the resources; receiving the connection information from the central authority responsive to an authorized policy look up; and creating secure tunnels between the user device and the resources based on the connection information. ## Claims ### Claim 1 A virtual private access method implemented by a cloud system, the method comprising: receiving a request to access resources from a user device, wherein the resources are located in one of a public cloud and an enterprise network and the user device is remote therefrom on the Internet; forwarding the request to a central authority for a policy look up and for a determination of connection information to make an associated secure connection through the cloud system to the resources; receiving the connection information from the central authority responsive to an authorized policy look up; creating secure tunnels by and through the cloud system and between the user device and the resources based on the connection information wherein the creating secure tunnels comprises creating connections between one or more cloud nodes in the cloud system, wherein the one or more cloud nodes do not participate in a key exchange, and the one or more cloud nodes do not have data access to traffic on the secure tunnels; and providing the secure tunnels for connectivity between the user device and the resources, wherein the secure tunnels are between the user device and the cloud system and between the resources and the cloud system, wherein the user device, the cloud system, and the resources are each in separate networks interconnected by associated tunnels with the user device in a first network, the cloud system in a second network, and the resources in a third network, and wherein the user device has access to the resources based on the authorized policy. ### Claim 2 (depends on 1) The virtual private access method of claim 1, wherein, prior to the receiving, a user executes an application on the user device, provides authentication, and provides the request with the application operating on the user device. ### Claim 3 (depends on 2) The virtual private access method of claim 2, wherein the application is configured to connect the user device to the cloud system, via an optimized cloud node based on a location of the user device. ### Claim 4 (depends on 1) The virtual private access method of claim 1, wherein the resources are communicatively coupled to a lightweight connector operating on a computer and communicatively coupled between the resources and the cloud system. ### Claim 5 (depends on 4) The virtual private access method of claim 4, further comprising: detecting the resources based on a query to the lightweight connector. ### Claim 6 (depends on 4) The virtual private access method of claim 4, wherein the lightweight connector is prevented from accepting inbound connections, thereby preventing access of the resources external from the public cloud or the enterprise network. ### Claim 7 (depends on 1) The virtual private access method of claim 1, wherein the creating secure tunnels comprises creating connections between one or more cloud nodes in the cloud system, wherein the one or more cloud nodes create the secure tunnels based on a combination of a client-side certificate and a server-side certificate. ### Claim 8 (depends on 1) The virtual private access method of claim 1, wherein the secure tunnels are created through software on the user device, the cloud system, and a lightweight connector operating on a computer associated with the resources, thereby eliminating dedicated hardware for virtual private network connections. ### Claim 9 A cloud system adapted to implement virtual private access, the cloud system comprising: one or more cloud nodes communicatively coupled to one another; wherein each of the one or more cloud nodes comprises one or more processors and memory storing instructions that, when executed, cause the one or more processors to receive a request to access resources from a user device, wherein the resources are located in one of a public cloud and an enterprise network and the user device is remote therefrom on the Internet; forward the request to a central authority for a policy look up and for a determination of connection information to make an associated secure connection through the cloud system to the resources; receive the connection information from the central authority responsive to an authorized policy look up; create secure tunnels by and through the cloud system and between the user device and the resources based on the connection information wherein the creating secure tunnels comprises creating connections between one or more cloud nodes in the cloud system, wherein the one or more cloud nodes do not participate in a key exchange, and the one or more cloud nodes do not have data access to traffic on the secure tunnels; and provide the secure tunnels for connectivity between the user device and the resources, wherein the secure tunnels are between the user device and the cloud system and between the resources and the cloud system, wherein the user device, the cloud system, and the resources are each in separate networks interconnected by associated tunnels with the user device in a first network, the cloud system in a second network, and the resources in a third network, and wherein the user device has access to the resources based on the authorized policy. ### Claim 10 (depends on 9) The cloud system of claim 9, wherein, prior to reception of the request, a user executes an application on the user device, provides authentication, and provides the request with the application operating on the user device. ### Claim 11 (depends on 10) The cloud system of claim 10, wherein the application is configured to connect the user device to the cloud system, via an optimized cloud node based on a location of the user device. ### Claim 12 (depends on 9) The cloud system of claim 9, wherein the resources are communicatively coupled to a lightweight connector operating on a computer and communicatively coupled between the resources and the cloud system. ### Claim 13 (depends on 12) The cloud system of claim 12, wherein the memory storing instructions that, when executed, further cause the one or more processors to detect the resources based on a query to the lightweight connector. ### Claim 14 (depends on 12) The cloud system of claim 12, wherein the lightweight connector is prevented from accepting inbound connections, thereby preventing access of the resources external from the public cloud or the enterprise network. ### Claim 15 (depends on 9) The cloud system of claim 9, wherein the secure tunnels are created through connections between one or more cloud nodes in the cloud system, wherein the one or more cloud nodes create the secure tunnels based on a combination of a client-side certificate and a server-side certificate. ### Claim 16 (depends on 9) The cloud system of claim 9, wherein the secure tunnels are created through software on the user device, the cloud system, and a lightweight connector operating on a computer associated with the resources, thereby eliminating dedicated hardware for virtual private network connections. ### Claim 17 A non-transitory computer readable medium comprising stored software instructions executable by a system, which in response to such execution causes the system to perform operations comprising: receiving a request to access resources from a user device, wherein the resources are located in one of a public cloud and an enterprise network and the user device is remote therefrom on the Internet; forwarding the request to a central authority for a policy look up and for a determination of connection information to make an associated secure connection through the cloud system to the resources; receiving the connection information from the central authority responsive to an authorized policy look up; creating secure tunnels by and through the cloud system and between the user device and the resources based on the connection information wherein the creating secure tunnels comprises creating connections between one or more cloud nodes in the cloud system, wherein the one or more cloud nodes do not participate in a key exchange, and the one or more cloud nodes do not have data access to traffic on the secure tunnels; and providing the secure tunnels for connectivity between the user device and the resources, wherein the secure tunnels are between the user device and the cloud system and between the resources and the cloud system, wherein the user device, the cloud system, and the resources are each in separate networks interconnected by associated tunnels with the user device in a first network, the cloud system in a second network, and the resources in a third network, and wherein the user device has access to the resources based on the authorized policy. ### Claim 18 (depends on 17) The non-transitory computer readable medium of claim 17, wherein the resources are communicatively coupled to a lightweight connector operating on a computer and communicatively coupled between the resources and the cloud system, and wherein the instructions executable by the system, which in response to such execution further causes the system to perform operations comprising detecting the resources based on a query to the lightweight connector.