# US 11,902,145 B2 · Generating and deploying security policies for microsegmentation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,902,145 B2 - Document ID: US11902145B2 - Status: Granted - Kind: B2 - Application number: 17/969,314 - Filed: 2022-10-19 - Published: 2023-04-06 - Granted: 2024-02-13 - Earliest claimed: 2019-06-11 - Assignees: Zscaler, Inc. - Applicants: Zscaler, Inc. - Inventors: Scott Laplante; Peter Nahas; Xing Li; Suji Suresh; Daniel R. Perkins; Peter Smith - Web page: https://patentgrep.com/patent/US11902145B2 ## CPC - H04L 63/10: {for controlling access to devices or network resources} - H04L 45/02: Topology update or discovery - H04L 47/82: {Miscellaneous aspects} - H04L 63/105: {Multiple levels of security} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods include receiving network communication information about hosts in a network and applications executed on the hosts; automatically generating one or more microsegments in the network based on analysis of the obtained network communication information, wherein each microsegment of the one or more microsegments is a grouping of resources including the hosts and the applications executed on the hosts that have rules for network communication; and providing the one or more microsegments to one or more hosts of the hosts, for use by the one or more hosts to allow or block communications locally based on the one or more microsegments. Each of the one or more microsegments can be a grouping of workloads inside a data center. ## Claims ### Claim 1 A non-transitory computer-readable storage medium having computer-readable code stored thereon for programming a computing system to perform steps of: receiving network communication information about hosts in a network and applications executed on the hosts; analyzing the network communication information to identify server-to-server traffic, application-to-server traffic, and application-to-application traffic; automatically generating one or more microsegments in the network based on the analyzing, wherein each microsegment of the one or more microsegments is a grouping of resources including the hosts and the applications executed on the hosts that have rules for network communication based on the identified server-to-server traffic, application-to-server traffic, and application-to-application traffic; and providing the one or more microsegments to one or more hosts of the hosts, for use by the one or more hosts to allow or block communications locally based on the one or more microsegments. ### Claim 2 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein each of the one or more microsegments is a grouping of workloads inside a data center. ### Claim 3 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein the steps further include: subsequent to deploying the one or more microsegments, observing communication between a plurality of hosts on the network for detecting unassigned communication paths that are either blocked due to no associated microsegment. ### Claim 4 (depends on 3) The non-transitory computer-readable storage medium of claim 3, wherein the steps further include: creating a new microsegment for the detected unassigned communication paths. ### Claim 5 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein the automatically generating is based on a trained machine learning model. ### Claim 6 (depends on 5) The non-transitory computer-readable storage medium of claim 5, wherein the trained machine learning model is trained based on particular network communications labeled as healthy meaning they are permitted and unhealthy meaning they are blocked. ### Claim 7 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein the network communication information includes any of Internet Protocol (IP) addresses, ports, host names, unique identifiers, and application names. ### Claim 8 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein the network communication information includes flow objects with data on both sides of a particular application. ### Claim 9 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein the automatically generating is based on a machine learning model that is trained via unsupervised learning using the flow objects. ### Claim 10 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein each host includes a unique fingerprint. ### Claim 11 A method comprising steps of: receiving network communication information about hosts in a network and applications executed on the hosts; analyzing the network communication information to identify server-to-server traffic, application-to-server traffic, and application-to-application traffic; automatically generating one or more microsegments in the network based on the analyzing, wherein each microsegment of the one or more microsegments is a grouping of resources including the hosts and the applications executed on the hosts that have rules for network communication based on the identified server-to-server traffic, application-to-server traffic, and application-to-application traffic; and providing the one or more microsegments to one or more hosts of the hosts, for use by the one or more hosts to allow or block communications locally based on the one or more microsegments. ### Claim 12 (depends on 11) The method of claim 11, wherein each of the one or more microsegments is a grouping of workloads inside a data center. ### Claim 13 (depends on 11) The method of claim 11, wherein the steps further include: subsequent to deploying the one or more microsegments, observing communication between a plurality of hosts on the network for detecting unassigned communication paths that are either blocked due to no associated microsegment. ### Claim 14 (depends on 13) The method of claim 13, wherein the steps further include: creating a new microsegment for the detected unassigned communication paths. ### Claim 15 (depends on 11) The method of claim 11, wherein the automatically generating is based on a trained machine learning model. ### Claim 16 (depends on 15) The method of claim 15, wherein the trained machine learning model is trained based on particular network communications labeled as healthy meaning they are permitted and unhealthy meaning they are blocked. ### Claim 17 (depends on 11) The method of claim 11, wherein the network communication information includes any of Internet Protocol (IP) addresses, ports, host names, unique identifiers, and application names. ### Claim 18 (depends on 11) The method of claim 11, wherein the network communication information includes flow objects with data on both sides of a particular application. ### Claim 19 (depends on 18) The method of claim 18, wherein the automatically generating is based on a machine learning model that is trained via unsupervised learning using the flow objects. ### Claim 20 (depends on 11) The method of claim 11, wherein each host includes a unique fingerprint.